Skip to content

rootless: single user namespace #2706

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-robot merged 2 commits into from
Apr 4, 2019
Merged

rootless: single user namespace #2706

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ed32620
rootless: remove SkipStorageSetup()
giuseppe Mar 19, 2019
72382a1
rootless: use a single user namespace
giuseppe Mar 19, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 0 additions & 34 deletions cmd/podman/cp.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,15 @@
package main

import (
"io/ioutil"
"os"
"path/filepath"
"strconv"
"strings"

"github.com/containers/buildah/pkg/chrootuser"
"github.com/containers/buildah/util"
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/libpodruntime"
"github.com/containers/libpod/libpod"
"github.com/containers/libpod/pkg/rootless"
"github.com/containers/storage"
"github.com/containers/storage/pkg/archive"
"github.com/containers/storage/pkg/chrootarchive"
Expand Down Expand Up @@ -58,9 +55,6 @@ func cpCmd(c *cliconfig.CpValues) error {
if len(args) != 2 {
return errors.Errorf("you must provide a source path and a destination path")
}
if os.Geteuid() != 0 {
rootless.SetSkipStorageSetup(true)
}

runtime, err := libpodruntime.GetRuntime(&c.PodmanCommand)
if err != nil {
Expand Down Expand Up @@ -90,34 +84,6 @@ func copyBetweenHostAndContainer(runtime *libpod.Runtime, src string, dest strin
ctr = destCtr
}

if os.Geteuid() != 0 {
s, err := ctr.State()
if err != nil {
return err
}
var became bool
var ret int
if s == libpod.ContainerStateRunning || s == libpod.ContainerStatePaused {
data, err := ioutil.ReadFile(ctr.Config().ConmonPidFile)
if err != nil {
return errors.Wrapf(err, "cannot read conmon PID file %q", ctr.Config().ConmonPidFile)
}
conmonPid, err := strconv.Atoi(string(data))
if err != nil {
return errors.Wrapf(err, "cannot parse PID %q", data)
}
became, ret, err = rootless.JoinDirectUserAndMountNS(uint(conmonPid))
} else {
became, ret, err = rootless.BecomeRootInUserNS()
}
if err != nil {
return err
}
if became {
os.Exit(ret)
}
}

mountPoint, err := ctr.Mount()
if err != nil {
return err
Expand Down
6 changes: 0 additions & 6 deletions cmd/podman/create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,10 @@ package main

import (
"fmt"
"os"

"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/libpodruntime"
"github.com/containers/libpod/cmd/podman/shared"
"github.com/containers/libpod/pkg/rootless"
"github.com/opentracing/opentracing-go"
"github.com/pkg/errors"
"github.com/spf13/cobra"
Expand Down Expand Up @@ -54,10 +52,6 @@ func createCmd(c *cliconfig.CreateValues) error {
return err
}

if os.Geteuid() != 0 {
rootless.SetSkipStorageSetup(true)
}

runtime, err := libpodruntime.GetRuntime(&c.PodmanCommand)
if err != nil {
return errors.Wrapf(err, "error creating libpod runtime")
Expand Down
28 changes: 0 additions & 28 deletions cmd/podman/exec.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ import (
"github.com/containers/libpod/cmd/podman/libpodruntime"
"github.com/containers/libpod/cmd/podman/shared/parse"
"github.com/containers/libpod/libpod"
"github.com/containers/libpod/pkg/rootless"
"github.com/pkg/errors"
"github.com/spf13/cobra"
)
Expand Down Expand Up @@ -67,7 +66,6 @@ func execCmd(c *cliconfig.ExecValues) error {
if c.Latest {
argStart = 0
}
rootless.SetSkipStorageSetup(true)
cmd := args[argStart:]
runtime, err := libpodruntime.GetRuntime(&c.PodmanCommand)
if err != nil {
Expand Down Expand Up @@ -107,32 +105,6 @@ func execCmd(c *cliconfig.ExecValues) error {

}

if os.Geteuid() != 0 {
var became bool
var ret int

data, err := ioutil.ReadFile(ctr.Config().ConmonPidFile)
if err == nil {
conmonPid, err := strconv.Atoi(string(data))
if err != nil {
return errors.Wrapf(err, "cannot parse PID %q", data)
}
became, ret, err = rootless.JoinDirectUserAndMountNS(uint(conmonPid))
} else {
pid, err := ctr.PID()
if err != nil {
return err
}
became, ret, err = rootless.JoinNS(uint(pid), c.PreserveFDs)
}
if err != nil {
return err
}
if became {
os.Exit(ret)
}
}

// ENVIRONMENT VARIABLES
env := map[string]string{}

Expand Down
5 changes: 0 additions & 5 deletions cmd/podman/export.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ import (
"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/shared/parse"
"github.com/containers/libpod/pkg/adapter"
"github.com/containers/libpod/pkg/rootless"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"github.com/spf13/cobra"
Expand Down Expand Up @@ -41,10 +40,6 @@ func init() {

// exportCmd saves a container to a tarball on disk
func exportCmd(c *cliconfig.ExportValues) error {
if os.Geteuid() != 0 {
rootless.SetSkipStorageSetup(true)
}

runtime, err := adapter.GetRuntime(&c.PodmanCommand)
if err != nil {
return errors.Wrapf(err, "could not get runtime")
Expand Down
7 changes: 2 additions & 5 deletions cmd/podman/kill.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,10 @@ import (
"fmt"
"reflect"

"github.com/containers/libpod/pkg/adapter"
"github.com/opentracing/opentracing-go"

"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/pkg/rootless"
"github.com/containers/libpod/pkg/adapter"
"github.com/docker/docker/pkg/signal"
"github.com/opentracing/opentracing-go"
"github.com/pkg/errors"
"github.com/spf13/cobra"
)
Expand Down Expand Up @@ -63,7 +61,6 @@ func killCmd(c *cliconfig.KillValues) error {
return err
}

rootless.SetSkipStorageSetup(true)
runtime, err := adapter.GetRuntime(&c.PodmanCommand)
if err != nil {
return errors.Wrapf(err, "could not get runtime")
Expand Down
87 changes: 47 additions & 40 deletions cmd/podman/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,16 @@ package main
import (
"context"
"io"
"io/ioutil"
"log/syslog"
"os"
"runtime/pprof"
"strconv"
"strings"
"syscall"

"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/cmd/podman/libpodruntime"
"github.com/containers/libpod/libpod"
_ "github.com/containers/libpod/pkg/hooks/0.1.0"
"github.com/containers/libpod/pkg/rootless"
Expand Down Expand Up @@ -59,36 +62,6 @@ var mainCommands = []*cobra.Command{
systemCommand.Command,
}

var cmdsNotRequiringRootless = map[*cobra.Command]bool{
_versionCommand: true,
_createCommand: true,
_execCommand: true,
_cpCommand: true,
_exportCommand: true,
//// `info` must be executed in an user namespace.
//// If this change, please also update libpod.refreshRootless()
_loginCommand: true,
_logoutCommand: true,
_mountCommand: true,
_killCommand: true,
_pauseCommand: true,
_podRmCommand: true,
_podKillCommand: true,
_podRestartCommand: true,
_podStatsCommand: true,
_podStopCommand: true,
_podTopCommand: true,
_restartCommand: true,
&_psCommand: true,
_rmCommand: true,
_runCommand: true,
_unpauseCommand: true,
_searchCommand: true,
_statsCommand: true,
_stopCommand: true,
_topCommand: true,
}

var rootCmd = &cobra.Command{
Use: "podman",
Long: "manage pods and images",
Expand Down Expand Up @@ -152,18 +125,52 @@ func before(cmd *cobra.Command, args []string) error {
logrus.Errorf(err.Error())
os.Exit(1)
}
if rootless.IsRootless() {
notRequireRootless := cmdsNotRequiringRootless[cmd]
if !notRequireRootless && !strings.HasPrefix(cmd.Use, "help") {
became, ret, err := rootless.BecomeRootInUserNS()
if err != nil {
logrus.Errorf(err.Error())
os.Exit(1)
}
if became {
os.Exit(ret)
if os.Geteuid() != 0 && cmd != _searchCommand && cmd != _versionCommand && !strings.HasPrefix(cmd.Use, "help") {
podmanCmd := cliconfig.PodmanCommand{
cmd,
args,
MainGlobalOpts,
}
runtime, err := libpodruntime.GetRuntime(&podmanCmd)
if err != nil {
return errors.Wrapf(err, "could not get runtime")
}
defer runtime.Shutdown(false)

ctrs, err := runtime.GetRunningContainers()
Copy link
Member

@mheon mheon Apr 1, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh dear. The performance implications here are unpleasant - make a runtime, tear it down, retrieve all containers, make a new runtime for the command itself...

Copy link
Member Author

@giuseppe giuseppe Apr 1, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is what we already do in most cases :( we create a runtime from the podman instance running with uid != 0 and then evaluate if we need a new userns or to join an existing one. The difference is that now we do this before evaluating each command.

Hopefully it leaves some margin for improvements, as there is not much logic now to find out what userns must be joined.

Copy link
Member

@baude baude Apr 2, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if might be interesting to brain storm on this, but longer term, maybe we should keep a db table for container namespaces only so we don't have to discover them? I have some other ideas too.

if err != nil {
logrus.Errorf(err.Error())
os.Exit(1)
}
var became bool
var ret int
if len(ctrs) == 0 {
became, ret, err = rootless.BecomeRootInUserNS()
} else {
for _, ctr := range ctrs {
data, err := ioutil.ReadFile(ctr.Config().ConmonPidFile)
if err != nil {
logrus.Errorf(err.Error())
os.Exit(1)
}
conmonPid, err := strconv.Atoi(string(data))
if err != nil {
logrus.Errorf(err.Error())
os.Exit(1)
}
became, ret, err = rootless.JoinUserAndMountNS(uint(conmonPid))
if err == nil {
break
}
}
}
if err != nil {
logrus.Errorf(err.Error())
os.Exit(1)
}
if became {
os.Exit(ret)
}
}

if MainGlobalOpts.Syslog {
Expand Down
4 changes: 0 additions & 4 deletions cmd/podman/mount.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,10 +60,6 @@ type jsonMountPoint struct {
}

func mountCmd(c *cliconfig.MountValues) error {
if os.Geteuid() != 0 {
rootless.SetSkipStorageSetup(true)
}

runtime, err := libpodruntime.GetRuntime(&c.PodmanCommand)
if err != nil {
return errors.Wrapf(err, "could not get runtime")
Expand Down
47 changes: 0 additions & 47 deletions cmd/podman/pod.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,7 @@
package main

import (
"os"

"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/pkg/adapter"
"github.com/containers/libpod/pkg/rootless"
"github.com/pkg/errors"
"github.com/spf13/cobra"
)

Expand Down Expand Up @@ -39,48 +34,6 @@ var podSubCommands = []*cobra.Command{
_podUnpauseCommand,
}

func joinPodNS(runtime *adapter.LocalRuntime, all, latest bool, inputArgs []string) ([]string, bool, bool, error) {
if rootless.IsRootless() {
if os.Geteuid() == 0 {
return []string{rootless.Argument()}, false, false, nil
} else {
var err error
var pods []*adapter.Pod
if all {
pods, err = runtime.GetAllPods()
if err != nil {
return nil, false, false, errors.Wrapf(err, "unable to get pods")
}
} else if latest {
pod, err := runtime.GetLatestPod()
if err != nil {
return nil, false, false, errors.Wrapf(err, "unable to get latest pod")
}
pods = append(pods, pod)
} else {
for _, i := range inputArgs {
pod, err := runtime.LookupPod(i)
if err != nil {
return nil, false, false, errors.Wrapf(err, "unable to lookup pod %s", i)
}
pods = append(pods, pod)
}
}
for _, p := range pods {
_, ret, err := runtime.JoinOrCreateRootlessPod(p)
if err != nil {
return nil, false, false, err
}
if ret != 0 {
os.Exit(ret)
}
}
os.Exit(0)
}
}
return inputArgs, all, latest, nil
}

func init() {
podCommand.AddCommand(podSubCommands...)
podCommand.SetHelpTemplate(HelpTemplate())
Expand Down
2 changes: 0 additions & 2 deletions cmd/podman/pod_kill.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ import (

"github.com/containers/libpod/cmd/podman/cliconfig"
"github.com/containers/libpod/pkg/adapter"
"github.com/containers/libpod/pkg/rootless"
"github.com/docker/docker/pkg/signal"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
Expand Down Expand Up @@ -49,7 +48,6 @@ func init() {

// podKillCmd kills one or more pods with a signal
func podKillCmd(c *cliconfig.PodKillValues) error {
rootless.SetSkipStorageSetup(true)
runtime, err := adapter.GetRuntime(&c.PodmanCommand)
if err != nil {
return errors.Wrapf(err, "could not get runtime")
Expand Down
Loading