syscall: CLONE_NEWUSER from unprivileged user

[LK4D4]

It should be possible to use CLONE_NEWUSER from unprivileged user, but somehow it isn't. Code:

package main

import (
        "log"
        "os"
        "os/exec"
        "syscall"
)

func main() {
        cmd := exec.Command(os.Args[1], os.Args[2:]...)
        cmd.Stdout = os.Stdout
        cmd.Stderr = os.Stderr
        cmd.Stdin = os.Stdin
        cmd.SysProcAttr = &syscall.SysProcAttr{}
        cmd.SysProcAttr.Cloneflags = syscall.CLONE_NEWUSER
        cmd.SysProcAttr.UidMappings = []syscall.SysProcIDMap{
                {ContainerID: 0, HostID: 1000, Size: 1},
        }
        cmd.SysProcAttr.GidMappings = []syscall.SysProcIDMap{
                {ContainerID: 0, HostID: 1000, Size: 1},
        }
        if err := cmd.Run(); err != nil {
                log.Fatal(err)
        }
}

On ./unshare /bin/zsh returns

2015/04/29 20:14:55 fork/exec /bin/zsh: operation not permitted

Strace shows:

[pid 27482] open("/proc/27481/uid_map", O_RDWR <unfinished ...>
[pid 27480] <... select resumed> )      = 0 (Timeout)
[pid 27482] <... open resumed> )        = 5
[pid 27480] select(0, NULL, NULL, NULL, {0, 20} <unfinished ...>
[pid 27482] write(5, "0 1000 1\n\0", 10) = 10
[pid 27482] close(5)                    = 0
[pid 27480] <... select resumed> )      = 0 (Timeout)
[pid 27482] open("/proc/27481/gid_map", O_RDWR <unfinished ...>
[pid 27480] select(0, NULL, NULL, NULL, {0, 20} <unfinished ...>
[pid 27482] <... open resumed> )        = 5
[pid 27482] write(5, "0 1000 1\n\0", 10) = -1 EPERM (Operation not permitted)

Code similar to forkAndExecInChild from syscall/exec_linux.go is in man user_namespaces: https://gist.github.com/31920b19eb18cf4b507d
I compiled it with clang clone.c -o clone and run as ./clone -Uz /bin/zsh. It works from unprivileged user and mapping uids/gids inside namespace.
It is pretty cool feature, because it allows unprivileged users to create own namespaces.
ping @mrunalp as author of UidMappings.

For reproducing I used go from tag go1.4.2 on x86_64 Gentoo linux with 4.0.0 kernel.

[minux]

Are you sure your uid/gid are both 1000?

$ cat issue10626.go
package main

import (
"log"
"os"
"os/exec"
"syscall"
)

func main() {
cmd := exec.Command(os.Args[1], os.Args[2:]...)
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
cmd.Stdin = os.Stdin
cmd.SysProcAttr = &syscall.SysProcAttr{}
cmd.SysProcAttr.Cloneflags = syscall.CLONE_NEWUSER
cmd.SysProcAttr.UidMappings = []syscall.SysProcIDMap{
{ContainerID: 0, HostID: syscall.Getuid(), Size: 1},
}
cmd.SysProcAttr.GidMappings = []syscall.SysProcIDMap{
{ContainerID: 0, HostID: syscall.Getgid(), Size: 1},
}
if err := cmd.Run(); err != nil {
log.Fatal(err)
}
}
$ go build issue10626.go
$ ./issue10626 /bin/bash

id

uid=0(root) gid=0(root) groups=0(root),65534(nobody)

[LK4D4]

@minux Yeah, I'm changed code as you suggested(Getuid/Getgid), result is same. What kernel do you use?

[minux]

3.17.4-gentoo

[LK4D4]

Actually, since 3.19 kernel code from forkAndExecInChild can't work with writing map_gid because of /proc/self/setgroups. You can find reference in newest man user_namespace. But I can't reach even that point :(

[mrunalp]

I am seeing the same issue as @LK4D4 (on 3.19.4) and I am thinking that this might be probably related to the setgroups code torvalds/linux@9cc4651

[mrunalp]

@LK4D4 yes, at minimum the go code has to add to check for the presence of setgroups and write deny into it.

[LK4D4]

@mrunalp Actually I tried to insert setgroups code to syscall/exec_linux.go and get permission denied on writing there. Also, C code without setgroups failing on gid_map, not uid_map.
But still very possible that related, because seems like it broken since 3.19.

[LK4D4]

Also I tried to reimplement this with unshare. I used unshare hack from #10051 (comment) and /proc/self/setgroups was writable! But uid_map still wasn't.

[ianlancetaylor]

It would be nice to fix this problem, but I don't understand what is causing it. Can somebody running kernel 3.19 or later figure this out? For example, if somebody can demonstrate a working C program, we may be able to modify the syscall package in the same way.

[LK4D4]

@ianlancetaylor There is working C program in http://man7.org/linux/man-pages/man7/user_namespaces.7.html
But as I see we doing exactly the same apart from setgroups. I'll try to bisect kernel to find which commit brought this problem.

[ianlancetaylor]

Thanks. It seems clear from the man page that we must write "deny" to /proc/PID/setgroups before writing to /proc/PID/gid_map. That seems consistent with the problem in the initial issue report. But I see your earlier comment that when you tried that, it failed. Can you share the patch that you tried?

[LK4D4]

@ianlancetaylor Yup, in 30 minutes.

[LK4D4]

@ianlancetaylor Hmm, sorry for confusion. It works for me now, maybe I did something wrong first time or maybe I updated kernel(now I use 4.0.4 and there was a lot of changes in 4.0.2).
Will it be ok to send this patch https://gist.github.com/anonymous/4a12b43dbce0007bfbef to golang now?