1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
// Copyright 2018 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
#include "test/util/capability_util.h"
#include <linux/capability.h>
#include <sched.h>
#include <sys/mman.h>
#include <sys/wait.h>
#include <iostream>
#include "absl/strings/str_cat.h"
#include "test/util/memory_util.h"
#include "test/util/posix_error.h"
#include "test/util/save_util.h"
#include "test/util/test_util.h"
namespace gvisor {
namespace testing {
PosixErrorOr<bool> CanCreateUserNamespace() {
// The most reliable way to determine if userns creation is possible is by
// trying to create one; see below.
ASSIGN_OR_RETURN_ERRNO(
auto child_stack,
MmapAnon(kPageSize, PROT_READ | PROT_WRITE, MAP_PRIVATE));
int const child_pid = clone(
+[](void*) { return 0; },
reinterpret_cast<void*>(child_stack.addr() + kPageSize),
CLONE_NEWUSER | SIGCHLD, /* arg = */ nullptr);
if (child_pid > 0) {
int status;
int const ret = waitpid(child_pid, &status, /* options = */ 0);
MaybeSave();
if (ret < 0) {
return PosixError(errno, "waitpid");
}
if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
return PosixError(
ESRCH, absl::StrCat("child process exited with status ", status));
}
return true;
} else if (errno == EPERM) {
// Per clone(2), EPERM can be returned if:
//
// - "CLONE_NEWUSER was specified in flags, but either the effective user ID
// or the effective group ID of the caller does not have a mapping in the
// parent namespace (see user_namespaces(7))."
//
// - "(since Linux 3.9) CLONE_NEWUSER was specified in flags and the caller
// is in a chroot environment (i.e., the caller's root directory does
// not match the root directory of the mount namespace in which it
// resides)."
std::cerr << "clone(CLONE_NEWUSER) failed with EPERM" << std::endl;
return false;
} else if (errno == EUSERS) {
// "(since Linux 3.11) CLONE_NEWUSER was specified in flags, and the call
// would cause the limit on the number of nested user namespaces to be
// exceeded. See user_namespaces(7)."
std::cerr << "clone(CLONE_NEWUSER) failed with EUSERS" << std::endl;
return false;
} else {
// Unexpected error code; indicate an actual error.
return PosixError(errno, "clone(CLONE_NEWUSER)");
}
}
} // namespace testing
} // namespace gvisor
|
