Add a `bool` argument `config_idmaps` to `pasta_start_ns()` that guards
the logic to configure user and group ID mappings. It is set to `false`
when `netns_only` is `true`. Fixes bug 216.
Link: https://bugs.passt.top/show_bug.cgi?id=216
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Dwayne B. Bent
---
conf.c | 2 +-
pasta.c | 24 ++++++++++++++----------
pasta.h | 3 ++-
3 files changed, 17 insertions(+), 12 deletions(-)
diff --git a/conf.c b/conf.c
index 0fcba5c..2223604 100644
--- a/conf.c
+++ b/conf.c
@@ -1945,7 +1945,7 @@ void conf(struct ctx *c, int argc, char **argv)
if (*netns) {
pasta_open_ns(c, netns);
} else {
- pasta_start_ns(c, uid, gid,
+ pasta_start_ns(c, uid, gid, !netns_only,
argc - optind, argv + optind);
}
}
diff --git a/pasta.c b/pasta.c
index 4e7ee54..5aa56b7 100644
--- a/pasta.c
+++ b/pasta.c
@@ -236,10 +236,11 @@ static int pasta_spawn_cmd(void *arg)
* @c: Execution context
* @uid: UID we're running as in the init namespace
* @gid: GID we're running as in the init namespace
+ * @config_idmaps: Whether to configure user mappings
* @argc: Number of arguments for spawned command
* @argv: Command to spawn and arguments
*/
-void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
+void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps,
int argc, char *argv[])
{
char ns_fn_stack[NS_FN_STACK_SIZE]
@@ -249,7 +250,6 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
.argv = argv,
.c = c,
};
- char uidmap[BUFSIZ], gidmap[BUFSIZ];
char *sh_argv[] = { NULL, NULL };
char sh_arg0[PATH_MAX + 1];
sigset_t set;
@@ -259,16 +259,20 @@ void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
c->quiet = 1;
/* Configure user and group mappings */
- if (snprintf_check(uidmap, BUFSIZ, "0 %u 1", uid))
- die_perror("Can't build uidmap");
+ if (config_idmaps) {
+ char uidmap[BUFSIZ], gidmap[BUFSIZ];
- if (snprintf_check(gidmap, BUFSIZ, "0 %u 1", gid))
- die_perror("Can't build gidmap");
+ if (snprintf_check(uidmap, BUFSIZ, "0 %u 1", uid))
+ die_perror("Can't build uidmap");
- if (write_file("/proc/self/uid_map", uidmap) ||
- write_file("/proc/self/setgroups", "deny") ||
- write_file("/proc/self/gid_map", gidmap)) {
- warn("Couldn't configure user mappings");
+ if (snprintf_check(gidmap, BUFSIZ, "0 %u 1", gid))
+ die_perror("Can't build gidmap");
+
+ if (write_file("/proc/self/uid_map", uidmap) ||
+ write_file("/proc/self/setgroups", "deny") ||
+ write_file("/proc/self/gid_map", gidmap)) {
+ warn("Couldn't configure user mappings");
+ }
}
if (argc == 0) {
diff --git a/pasta.h b/pasta.h
index 07e04b3..edd7747 100644
--- a/pasta.h
+++ b/pasta.h
@@ -6,12 +6,13 @@
#ifndef PASTA_H
#define PASTA_H
+#include
#include
extern int pasta_child_pid;
void pasta_open_ns(struct ctx *c, const char *netns);
-void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid,
+void pasta_start_ns(struct ctx *c, uid_t uid, gid_t gid, bool config_idmaps,
int argc, char *argv[]);
void pasta_ns_conf(struct ctx *c);
void pasta_child_handler(int signal);
--
2.55.0