technocloud-public/nginx-unit
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Isolation: allowed the use of credentials with unpriv userns.

Browse Source 
The setuid/setgid syscalls requires root capabilities but if the kernel
supports unprivileged user namespace then the child process has the full
set of capabilities in the new namespace, then we can allow setting "user"
and "group" in such cases (this is a common security use case).

Tests were added to ensure user gets meaningful error messages for
uid/gid mapping misconfigurations.
This commit is contained in:
Tiago Natel
2019-12-06 16:52:50 +00:00
parent ed2492a66a
commit 411daeaa53
13 changed files with 1187 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
src/nxt_clone.h
View File

@@ -7,11 +7,47 @@
#define _NXT_CLONE_INCLUDED_
pid_t nxt_clone(nxt_int_t flags);
#if (NXT_HAVE_CLONE_NEWUSER)
typedef struct {
nxt_int_t container;
nxt_int_t host;
nxt_int_t size;
} nxt_clone_map_entry_t;
typedef struct {
nxt_uint_t size;
nxt_clone_map_entry_t *map;
} nxt_clone_credential_map_t;
#endif
typedef struct {
nxt_int_t flags;
#if (NXT_HAVE_CLONE_NEWUSER)
nxt_int_t nxt_clone_proc_map(nxt_task_t *task, pid_t pid,
nxt_process_clone_t *clone);
nxt_clone_credential_map_t uidmap;
nxt_clone_credential_map_t gidmap;
#endif
} nxt_clone_t;
pid_t nxt_clone(nxt_int_t flags);
#if (NXT_HAVE_CLONE_NEWUSER)
#define NXT_CLONE_USER(flags) \
((flags & CLONE_NEWUSER) == CLONE_NEWUSER)
NXT_EXPORT nxt_int_t nxt_clone_credential_map(nxt_task_t *task, pid_t pid,
nxt_credential_t *creds, nxt_clone_t *clone);
NXT_EXPORT nxt_int_t nxt_clone_vldt_credential_uidmap(nxt_task_t *task,
nxt_clone_credential_map_t *map, nxt_credential_t *creds);
NXT_EXPORT nxt_int_t nxt_clone_vldt_credential_gidmap(nxt_task_t *task,
nxt_clone_credential_map_t *map, nxt_credential_t *creds);
#endif
#endif /* _NXT_CLONE_INCLUDED_ */