[PATCH 1/1] rootless: always map nobody/nogroup as dedicated block

[PATCH 1/1] rootless: always map nobody/nogroup as dedicated block

['Felix Moessbauer' via isar-users]

The nobody/nogroup ids were mapped as part of the linear id range,
with an extra single-id mapping added only if the range was too small
to contain them. The extra mapping was guarded by "uid_cnt < nobody_id",
but the linear range ends at uid_cnt-2, so it covers nobody only for
uid_cnt >= 65536. For a count of 65534 or 65535 neither the linear range
nor the guard mapped nobody.

Relying on the linear range to cover nobody is unsafe in general. If that
range covers the outer id that --map-root-user maps to, unshare punches a
hole out of the mapping, and per unshare(1) this "may result in the
highest user ID of the mapping not being mapped". That highest id is
exactly nobody. This happens whenever the subid range overlaps the id of
the calling user, e.g. with

  builder:0:65536

where the mapped block 1..65534 contains the builder's own uid. The
resulting namespace then silently lacks a nobody mapping, while a range
like 100000:65536 is unaffected and hides the problem.

Map nobody/nogroup as a separate block at the top of the range and cap
the linear range at nobody_id-1. The separate block does not overlap
--map-root-user, so it survives, and a hole now at most costs id 65533.

Fixes: 4fedb1ae ("add support for fully rootless builds")
Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
---
 meta/classes-global/base.bbclass | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass
index f074eee6..c56b6b1a 100644
--- a/meta/classes-global/base.bbclass
+++ b/meta/classes-global/base.bbclass
@@ -464,15 +464,19 @@ def run_privileged_cmd(d):
         nobody_subid = uid_base + uid_cnt - 1
         gid_base, gid_cnt = get_subid_range('/etc/subgid', d)
         nogroup_subid = gid_base + gid_cnt - 1
+        # nobody/nogroup need a dedicated block at the top of the range. As part
+        # of the linear range they are lost whenever that range covers the outer
+        # id of --map-root-user, because unshare then punches out a hole and
+        # drops the highest id of the range.
+        uid_linear_cnt = min(uid_cnt - 2, nobody_id - 1)
+        gid_linear_cnt = min(gid_cnt - 2, nobody_id - 1)
         cmd = 'unshare --mount --pid --uts --ipc --user' \
               ' --kill-child' \
               ' --setuid 0 --setgid 0 --fork' \
-              f' --map-users  1:{uid_base+1}:{uid_cnt-2}' \
-              f' --map-groups 1:{gid_base+1}:{gid_cnt-2}'
-        if uid_cnt < nobody_id:
-            cmd += f' --map-users  {nobody_id}:{nobody_subid}:1'
-        if gid_cnt < nobody_id:
-            cmd += f' --map-groups {nobody_id}:{nogroup_subid}:1'
+              f' --map-users  1:{uid_base+1}:{uid_linear_cnt}' \
+              f' --map-groups 1:{gid_base+1}:{gid_linear_cnt}' \
+              f' --map-users  {nobody_id}:{nobody_subid}:1' \
+              f' --map-groups {nobody_id}:{nogroup_subid}:1'
         cmd += " --map-root-user"
     else:
         cmd = 'sudo -E'
-- 
2.55.0

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260820151029.802935-1-felix.moessbauer%40siemens.com.