diff --git a/libcontainer/internal/userns/userns_maps.c b/libcontainer/internal/userns/userns_maps.c deleted file mode 100644 index 84f2c6188c3..00000000000 --- a/libcontainer/internal/userns/userns_maps.c +++ /dev/null @@ -1,79 +0,0 @@ -#define _GNU_SOURCE -#include -#include -#include -#include -#include -#include - -/* - * All of the code here is run inside an aync-signal-safe context, so we need - * to be careful to not call any functions that could cause issues. In theory, - * since we are a Go program, there are fewer restrictions in practice, it's - * better to be safe than sorry. - * - * The only exception is exit, which we need to call to make sure we don't - * return into runc. - */ - -void bail(int pipefd, const char *fmt, ...) -{ - va_list args; - - va_start(args, fmt); - vdprintf(pipefd, fmt, args); - va_end(args); - - exit(1); -} - -int spawn_userns_cat(char *userns_path, char *path, int outfd, int errfd) -{ - char buffer[4096] = { 0 }; - - pid_t child = fork(); - if (child != 0) - return child; - /* in child */ - - /* Join the target userns. */ - int nsfd = open(userns_path, O_RDONLY); - if (nsfd < 0) - bail(errfd, "open userns path %s failed: %m", userns_path); - - int err = setns(nsfd, CLONE_NEWUSER); - if (err < 0) - bail(errfd, "setns %s failed: %m", userns_path); - - close(nsfd); - - /* Pipe the requested file contents. */ - int fd = open(path, O_RDONLY); - if (fd < 0) - bail(errfd, "open %s in userns %s failed: %m", path, userns_path); - - int nread, ntotal = 0; - while ((nread = read(fd, buffer, sizeof(buffer))) != 0) { - if (nread < 0) - bail(errfd, "read bytes from %s failed (after %d total bytes read): %m", path, ntotal); - ntotal += nread; - - int nwritten = 0; - while (nwritten < nread) { - int n = write(outfd, buffer, nread - nwritten); - if (n < 0) - bail(errfd, "write %d bytes from %s failed (after %d bytes written): %m", - nread - nwritten, path, nwritten); - nwritten += n; - } - if (nread != nwritten) - bail(errfd, "mismatch for bytes read and written: %d read != %d written", nread, nwritten); - } - - close(fd); - close(outfd); - close(errfd); - - /* We must exit here, otherwise we would return into a forked runc. */ - exit(0); -} diff --git a/libcontainer/internal/userns/userns_maps_linux.go b/libcontainer/internal/userns/userns_maps_linux.go index 7a8c2b023b3..1990b7fdae6 100644 --- a/libcontainer/internal/userns/userns_maps_linux.go +++ b/libcontainer/internal/userns/userns_maps_linux.go @@ -5,21 +5,13 @@ package userns import ( "bufio" "bytes" + "errors" "fmt" - "io" "os" - "unsafe" "github.com/opencontainers/runc/libcontainer/configs" - "github.com/sirupsen/logrus" ) -/* -#include -extern int spawn_userns_cat(char *userns_path, char *path, int outfd, int errfd); -*/ -import "C" - func parseIdmapData(data []byte) (ms []configs.IDMap, err error) { scanner := bufio.NewScanner(bytes.NewReader(data)) for scanner.Scan() { @@ -36,79 +28,6 @@ func parseIdmapData(data []byte) (ms []configs.IDMap, err error) { return ms, nil } -// Do something equivalent to nsenter --user= cat , but more -// efficiently. Returns the contents of the requested file from within the user -// namespace. -func spawnUserNamespaceCat(nsPath string, path string) ([]byte, error) { - rdr, wtr, err := os.Pipe() - if err != nil { - return nil, fmt.Errorf("create pipe for userns spawn failed: %w", err) - } - defer rdr.Close() - defer wtr.Close() - - errRdr, errWtr, err := os.Pipe() - if err != nil { - return nil, fmt.Errorf("create error pipe for userns spawn failed: %w", err) - } - defer errRdr.Close() - defer errWtr.Close() - - cNsPath := C.CString(nsPath) - defer C.free(unsafe.Pointer(cNsPath)) - cPath := C.CString(path) - defer C.free(unsafe.Pointer(cPath)) - - childPid := C.spawn_userns_cat(cNsPath, cPath, C.int(wtr.Fd()), C.int(errWtr.Fd())) - - if childPid < 0 { - return nil, fmt.Errorf("failed to spawn fork for userns") - } else if childPid == 0 { - // this should never happen - panic("runc executing inside fork child -- unsafe state!") - } - - // We are in the parent -- close the write end of the pipe before reading. - wtr.Close() - output, err := io.ReadAll(rdr) - rdr.Close() - if err != nil { - return nil, fmt.Errorf("reading from userns spawn failed: %w", err) - } - - // Ditto for the error pipe. - errWtr.Close() - errOutput, err := io.ReadAll(errRdr) - errRdr.Close() - if err != nil { - return nil, fmt.Errorf("reading from userns spawn error pipe failed: %w", err) - } - errOutput = bytes.TrimSpace(errOutput) - - // Clean up the child. - child, err := os.FindProcess(int(childPid)) - if err != nil { - return nil, fmt.Errorf("could not find userns spawn process: %w", err) - } - state, err := child.Wait() - if err != nil { - return nil, fmt.Errorf("failed to wait for userns spawn process: %w", err) - } - if !state.Success() { - errStr := string(errOutput) - if errStr == "" { - errStr = fmt.Sprintf("unknown error (status code %d)", state.ExitCode()) - } - return nil, fmt.Errorf("userns spawn: %s", errStr) - } else if len(errOutput) > 0 { - // We can just ignore weird output in the error pipe if the process - // didn't bail(), but for completeness output for debugging. - logrus.Debugf("userns spawn succeeded but unexpected error message found: %s", string(errOutput)) - } - // The subprocess succeeded, return whatever it wrote to the pipe. - return output, nil -} - func GetUserNamespaceMappings(nsPath string) (uidMap, gidMap []configs.IDMap, err error) { var ( pid int @@ -139,26 +58,12 @@ func GetUserNamespaceMappings(nsPath string) (uidMap, gidMap []configs.IDMap, er if tryFastPath { path := fmt.Sprintf("/proc/%d/%s", pid, mapType.name) data, err := os.ReadFile(path) - if err != nil { - // Do not error out here -- we need to try the slow path if the - // fast path failed. - logrus.Debugf("failed to use fast path to read %s from userns %s (error: %s), falling back to slow userns-join path", mapType.name, nsPath, err) - } else { - mapData = data - } - } else { - logrus.Debugf("cannot use fast path to read %s from userns %s, falling back to slow userns-join path", mapType.name, nsPath) - } - - if mapData == nil { - // We have to actually join the namespace if we cannot take the - // fast path. The path is resolved with respect to the child - // process, so just use /proc/self. - data, err := spawnUserNamespaceCat(nsPath, "/proc/self/"+mapType.name) if err != nil { return nil, nil, err } mapData = data + } else { + return nil, nil, errors.New("userns-cat missing") } idMap, err := parseIdmapData(mapData) if err != nil {