diff options
| author | Lennart Poettering <lennart@poettering.net> | 2021-04-27 14:37:19 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2021-05-07 22:43:05 +0200 |
| commit | 33eac552ab22af58b303342b1fa912900fa42820 (patch) | |
| tree | df3ed16374cbf766a75328b1baa9ad3cbc763ad3 | |
| parent | 0cd70d43a36d94b578004dfbf176007de3fd1f8a (diff) | |
| download | systemd-33eac552ab22af58b303342b1fa912900fa42820.tar.gz | |
nspawn: add high-level option for identity userns mapping
userns identity 1:1 mapping is a pretty useful concept since it isolates
capability sets between containers and hosts, even if it doesn't map
any uid ranges. Let's support it with an explicit concept.
(Note that this is identical to --private-users=0:65536 (which in turn
is identical to --private-users=0), but I think it makes to emphasize
this concept as a high-level one that makes sense to support.)
| -rw-r--r-- | src/nspawn/nspawn.c | 24 |
1 files changed, 19 insertions, 5 deletions
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 53b9fa84a7..c124607431 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -1195,29 +1195,41 @@ static int parse_argv(int argc, char *argv[]) { break; case ARG_PRIVATE_USERS: { - int boolean = -1; + int boolean; if (!optarg) boolean = true; else if (!in_charset(optarg, DIGITS)) /* do *not* parse numbers as booleans */ boolean = parse_boolean(optarg); + else + boolean = -1; - if (boolean == false) { + if (boolean == 0) { /* no: User namespacing off */ arg_userns_mode = USER_NAMESPACE_NO; arg_uid_shift = UID_INVALID; arg_uid_range = UINT32_C(0x10000); - } else if (boolean == true) { + } else if (boolean > 0) { /* yes: User namespacing on, UID range is read from root dir */ arg_userns_mode = USER_NAMESPACE_FIXED; arg_uid_shift = UID_INVALID; arg_uid_range = UINT32_C(0x10000); } else if (streq(optarg, "pick")) { /* pick: User namespacing on, UID range is picked randomly */ - arg_userns_mode = USER_NAMESPACE_PICK; + arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_chown = true, + * is implied by USER_NAMESPACE_PICK, + * further down. */ arg_uid_shift = UID_INVALID; arg_uid_range = UINT32_C(0x10000); + + } else if (streq(optarg, "identity")) { + /* identitiy: User namespaces on, UID range is map the 0…0xFFFF range to + * itself, i.e. we don't actually map anything, but do take benefit of + * isolation of capability sets. */ + arg_userns_mode = USER_NAMESPACE_FIXED; + arg_uid_shift = 0; + arg_uid_range = UINT32_C(0x10000); } else { _cleanup_free_ char *buffer = NULL; const char *range, *shift; @@ -1255,7 +1267,9 @@ static int parse_argv(int argc, char *argv[]) { case 'U': if (userns_supported()) { - arg_userns_mode = USER_NAMESPACE_PICK; + arg_userns_mode = USER_NAMESPACE_PICK; /* Note that arg_userns_chown = true, + * is implied by USER_NAMESPACE_PICK, + * further down. */ arg_uid_shift = UID_INVALID; arg_uid_range = UINT32_C(0x10000); |