Re: [PATCH] nsenter: Allow selecting the uid and gid to be used in the entered userns

[Karel Zak <kzak@redhat.com>]

On Thu, Apr 25, 2013 at 06:01:02PM -0700, Eric W. Biederman wrote:
> Richard Weinberger <richard@nod.at> writes:
> 
> > Using -S (--setuid) and -G (--setgid) one can select
> > the uid/gid which will be used in the entered user namespace.
> 
> There is definitely utility here.  I don't have a strong preference but
> I am inclined to suggest that you remove the set_uid and set_gid
> variables, and unconditionally call setuid and setgid when entering
> a user namespace.

 I agree.

> > --- a/sys-utils/nsenter.c
> > +++ b/sys-utils/nsenter.c
> > @@ -72,6 +72,8 @@ static void usage(int status)
> >  	fputs(_(" -n, --net   [=<file>]  enter network namespace\n"), out);
> >  	fputs(_(" -p, --pid   [=<file>]  enter pid namespace\n"), out);
> >  	fputs(_(" -U, --user  [=<file>]  enter user namespace\n"), out);
> > +	fputs(_(" -S, --setuid <uid>     set uid in user namespace\n"), out);
> > +	fputs(_(" -G, --setgid <gid>     set gid in user namespace\n"), out);

 Richard, update man page too. Please.

> > @@ -319,5 +335,15 @@ int main(int argc, char *argv[])
> >  		execvp(argv[optind], argv + optind);
> >  		err(EXIT_FAILURE, _("failed to execute %s"), argv[optind]);
> >  	}
> > +
> > +	if (namespaces & CLONE_NEWUSER) {
> > +		if (set_uid)
> > +			if (setuid(uid) < 0)
> > +				err(EXIT_FAILURE, _("setuid failed"));
> > +		if (set_gid)
> > +			if (setgid(gid) < 0)
> > +				err(EXIT_FAILURE, _("setgid failed"));
> > +	}
> > +
> >  	exec_shell();

 Why do call setuid/gid() only for shell? Would be better to move all
 this code before the block with execvp() to call setuid/gid() for
 all execvp() as well as for exec_shell()?

    Karel

-- 
 Karel Zak  <kzak@redhat.com>
 http://karelzak.blogspot.com