diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-14 17:41:08 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-14 17:42:22 +0900 |
| commit | f41fd946284aa30e7529bd92193632b20d77a2dd (patch) | |
| tree | 4979f7c0790d0a88d7dbecd13fb5833ea87d9dd4 /internal/sandbox/container.go | |
| parent | 94895bbacb42b82673b07142e786855a8ac756dc (diff) | |
sandbox: write uid/gid map as init
This avoids PR_SET_DUMPABLE in the parent process.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/sandbox/container.go')
| -rw-r--r-- | internal/sandbox/container.go | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/internal/sandbox/container.go b/internal/sandbox/container.go index de71f372..76389358 100644 --- a/internal/sandbox/container.go +++ b/internal/sandbox/container.go @@ -58,10 +58,6 @@ type ( InitParams // Custom [exec.Cmd] initialisation function. CommandContext func(ctx context.Context) (cmd *exec.Cmd) - // mapped uid in user namespace - Uid int - // mapped gid in user namespace - Gid int // param encoder for shim and init setup *gob.Encoder @@ -86,6 +82,10 @@ type ( // Initial process argv. Args []string + // Mapped Uid in user namespace. + Uid int + // Mapped Gid in user namespace. + Gid int // Hostname value in UTS namespace. Hostname string // Sequential container setup ops. @@ -140,8 +140,6 @@ func (p *Container) Start() error { syscall.CLONE_NEWPID | syscall.CLONE_NEWNS, - UidMappings: []syscall.SysProcIDMap{{p.Uid, syscall.Getuid(), 1}}, - GidMappings: []syscall.SysProcIDMap{{p.Gid, syscall.Getgid(), 1}}, // remain privileged for setup AmbientCaps: []uintptr{CAP_SYS_ADMIN}, @@ -200,6 +198,8 @@ func (p *Container) Serve() error { return setup.Encode( &initParams{ p.InitParams, + syscall.Getuid(), + syscall.Getgid(), len(p.ExtraFiles), fmsg.Load(), }, |