From: Karel Zak <kzak@redhat.com>
To: Richard Weinberger <richard@nod.at>
Cc: ebiederm@xmission.com, util-linux@vger.kernel.org,
davidlohr.bueso@hp.com
Subject: Re: [PATCH] nsenter: Allow selecting the uid and gid to be used in the entered userns
Date: Thu, 6 Feb 2014 14:00:11 +0100 [thread overview]
Message-ID: <20140206130011.GA12324@x2.net.home> (raw)
In-Reply-To: <1366917100-10581-1-git-send-email-richard@nod.at>
On Thu, Apr 25, 2013 at 09:11:40PM +0200, Richard Weinberger wrote:
> + if (namespaces & CLONE_NEWUSER) {
> + if (set_uid)
> + if (setuid(uid) < 0)
> + err(EXIT_FAILURE, _("setuid failed"));
> + if (set_gid)
> + if (setgid(gid) < 0)
> + err(EXIT_FAILURE, _("setgid failed"));
Ah.. we make a bug here, it has to be in reverse order (gid and then uid).
The another question is what about supplementary groups? Do we care
about it? If yes, we need initgroups(), otherwise it would be
probably better to drop all by setgroups(0, NULL).
I guess it's over-engineering to try to reimplement su(1) within nsenter,
so drop the supplementary group is the right way.
Karel
--
Karel Zak <kzak@redhat.com>
http://karelzak.blogspot.com
prev parent reply other threads:[~2014-02-06 13:32 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-04-25 19:11 [PATCH] nsenter: Allow selecting the uid and gid to be used in the entered userns Richard Weinberger
2013-04-26 1:01 ` Eric W. Biederman
2013-04-26 5:39 ` Richard Weinberger
2013-05-06 15:39 ` Karel Zak
2013-06-18 8:41 ` Karel Zak
2014-02-06 13:00 ` Karel Zak [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140206130011.GA12324@x2.net.home \
--to=kzak@redhat.com \
--cc=davidlohr.bueso@hp.com \
--cc=ebiederm@xmission.com \
--cc=richard@nod.at \
--cc=util-linux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox