[1.2] libct/nsenter: become root after joining userns #4477
Merged
lifubang merged 2 commits intoopencontainers:release-1.2from Oct 26, 2024
Merged
[1.2] libct/nsenter: become root after joining userns #4477lifubang merged 2 commits intoopencontainers:release-1.2from
lifubang merged 2 commits intoopencontainers:release-1.2from
Conversation
Containerd pre-creates userns and netns before calling runc, which results in the current code not working when SELinux is enabled, resulting in the following error: > runc create failed: unable to start container process: error during container init: error mounting "mqueue" to rootfs at "/dev/mqueue": setxattr /path/to/rootfs/dev/mqueue: operation not permitted The solution is to become root in the user namespace right after we join it. Fixes opencontainers#4466. Co-authored-by: Wei Fu <fuweid89@gmail.com> Co-authored-by: Kir Kolyshkin <kolyshkin@gmail.com> Co-authored-by: Aleksa Sarai <cyphar@cyphar.com> Signed-off-by: lifubang <lifubang@acmcoder.com> (cherry picked from commit c78f3f2) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Signed-off-by: lifubang <lifubang@acmcoder.com> (cherry picked from commit 34a9285) Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
cyphar
approved these changes
Oct 26, 2024
lifubang
approved these changes
Oct 26, 2024
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #4473 to release1.2. Original description follows.
PS I checked the added test case in #4476.
Containerd pre-creates userns and netns before calling runc, which
results in the current code not working when SELinux is enabled,
resulting in the following error:
runc create failed: unable to start container process: error during
container init: error mounting "mqueue" to rootfs at "/dev/mqueue":
setxattr /path/to/rootfs/dev/mqueue: operation not permitted
The solution is to become root in the user namespace right after
we join it.
Fixes #4466.
Co-authored-by: Wei Fu fuweid89@gmail.com
Co-authored-by: Kir Kolyshkin kolyshkin@gmail.com
Co-authored-by: Aleksa Sarai cyphar@cyphar.com
Signed-off-by: lifubang lifubang@acmcoder.com