diff options
| author | Andrei Vagin <avagin@google.com> | 2019-01-18 16:07:28 -0800 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2019-01-18 16:08:39 -0800 |
| commit | c0a981629cf44688687548490c5e665d851afe06 (patch) | |
| tree | f9813b9ff4d0429d8b10d80c52081988d5124e0a /runsc/sandbox/sandbox.go | |
| parent | c063a1350f4ac6249fb26e6125c9cc99db14263b (diff) | |
Start a sandbox process in a new userns only if CAP_SETUID is set
In addition, it fixes a race condition in TestMultiContainerGoferStop.
There are two scripts copy the same set of files into the same directory
and sometime one of this command fails with EXIST.
PiperOrigin-RevId: 230011247
Change-Id: I9289f72e65dc407cdcd0e6cd632a509e01f43e9c
Diffstat (limited to 'runsc/sandbox/sandbox.go')
| -rw-r--r-- | runsc/sandbox/sandbox.go | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/runsc/sandbox/sandbox.go b/runsc/sandbox/sandbox.go index d28d93b0a..df4c3c787 100644 --- a/runsc/sandbox/sandbox.go +++ b/runsc/sandbox/sandbox.go @@ -500,15 +500,15 @@ func (s *Sandbox) createSandboxProcess(spec *specs.Spec, conf *boot.Config, bund return fmt.Errorf("can't run sandbox process in minimal chroot since we don't have CAP_SYS_ADMIN") } } else { - log.Infof("Sandbox will be started in new user namespace") - nss = append(nss, specs.LinuxNamespace{Type: specs.UserNamespace}) - // If we have CAP_SETUID and CAP_SETGID, then we can also run // as user nobody. if conf.TestOnlyAllowRunAsCurrentUserWithoutChroot { log.Warningf("Running sandbox in test mode as current user (uid=%d gid=%d). This is only safe in tests!", os.Getuid(), os.Getgid()) log.Warningf("Running sandbox in test mode without chroot. This is only safe in tests!") } else if specutils.HasCapabilities(capability.CAP_SETUID, capability.CAP_SETGID) { + log.Infof("Sandbox will be started in new user namespace") + nss = append(nss, specs.LinuxNamespace{Type: specs.UserNamespace}) + // Map nobody in the new namespace to nobody in the parent namespace. // // A sandbox process will construct an empty |