diff options
Diffstat (limited to 'container/init.go')
| -rw-r--r-- | container/init.go | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/container/init.go b/container/init.go index 78c95439..3b850073 100644 --- a/container/init.go +++ b/container/init.go @@ -182,13 +182,18 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) { cancel() } + uid, gid := param.Uid, param.Gid + if param.InitAsRoot { + uid, gid = 0, 0 + } + // write uid/gid map here so parent does not need to set dumpable if err := k.setDumpable(ext.SUID_DUMP_USER); err != nil { k.fatalf(msg, "cannot set SUID_DUMP_USER: %v", err) } if err := k.writeFile( fhs.Proc+"self/uid_map", - []byte(strconv.Itoa(param.Uid)+" "+strconv.Itoa(param.HostUid)+" 1\n"), + []byte(strconv.Itoa(uid)+" "+strconv.Itoa(param.HostUid)+" 1\n"), 0, ); err != nil { k.fatalf(msg, "%v", err) @@ -201,7 +206,7 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) { k.fatalf(msg, "%v", err) } if err := k.writeFile(fhs.Proc+"self/gid_map", - []byte(strconv.Itoa(param.Gid)+" "+strconv.Itoa(param.HostGid)+" 1\n"), + []byte(strconv.Itoa(gid)+" "+strconv.Itoa(param.HostGid)+" 1\n"), 0, ); err != nil { k.fatalf(msg, "%v", err) @@ -332,6 +337,9 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) { if param.Privileged { keepCaps = append(keepCaps, CAP_SYS_ADMIN, CAP_SETPCAP) } + if param.InitAsRoot { + keepCaps = append(keepCaps, CAP_SETFCAP) + } if err := k.capAmbientClearAll(); err != nil { k.fatalf(msg, "cannot clear the ambient capability set: %v", err) @@ -487,6 +495,14 @@ func initEntrypoint(k syscallDispatcher, msg message.Msg) { cmd.ExtraFiles = extraFiles cmd.Dir = param.Dir.String() + if param.InitAsRoot { + cmd.SysProcAttr = &SysProcAttr{ + Cloneflags: CLONE_NEWUSER, + UidMappings: []SysProcIDMap{{ContainerID: param.Uid, HostID: 0, Size: 1}}, + GidMappings: []SysProcIDMap{{ContainerID: param.Gid, HostID: 0, Size: 1}}, + } + } + msg.Verbosef("starting initial process %s", param.Path) if err := k.start(cmd); err != nil { k.fatalf(msg, "%v", err) |