From ea69a5c87498ba94eb804ab628000ecfc50d6710 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Sat, 18 Nov 2017 16:22:01 +0100 Subject: support_become_root: Don't fail when /proc//setgroups for a given user namespace before being able to write a gid mapping was introduced in Linux 3.19. Before that this requirement including the file did not exist. So don't fail when errno == ENOENT. --- support/support_become_root.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) (limited to 'support/support_become_root.c') diff --git a/support/support_become_root.c b/support/support_become_root.c index 5086570251..e45c939421 100644 --- a/support/support_become_root.c +++ b/support/support_become_root.c @@ -18,6 +18,7 @@ #include +#include #include #include #include @@ -50,11 +51,21 @@ setup_uid_gid_mapping (uid_t original_uid, gid_t original_gid) xwrite (fd, buf, ret); xclose (fd); - /* Disable setgroups before mapping groups, otherwise that would - fail with EPERM. */ - fd = xopen ("/proc/self/setgroups", O_WRONLY, 0); - xwrite (fd, "deny\n", strlen ("deny\n")); - xclose (fd); + /* Linux 3.19 introduced the setgroups file. We need write "deny" to this + * file otherwise writing to gid_map will fail with EPERM. */ + fd = open64 ("/proc/self/setgroups", O_WRONLY, 0); + if (fd < 0) + { + if (errno != ENOENT) + FAIL_EXIT1 ("open64 (\"/proc/self/setgroups\", 0x%x, 0%o): %m", + O_WRONLY, 0); + /* This kernel doesn't expose the setgroups file so simply move on. */ + } + else + { + xwrite (fd, "deny\n", strlen ("deny\n")); + xclose (fd); + } /* Now map our own GID, like we did for the user ID. */ fd = xopen ("/proc/self/gid_map", O_WRONLY, 0); -- cgit 1.4.1