[libvirt] [PATCH] lxc: Set max uid/gid mappings for user namespace

Radostin Stoyanov posted 1 patch 5 years, 3 months ago
Test syntax-check passed
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/libvirt tags/patchew/20181215100234.4637-1-rstoyanov1@gmail.com
src/lxc/lxc_controller.c | 7 +++++++
1 file changed, 7 insertions(+)
[libvirt] [PATCH] lxc: Set max uid/gid mappings for user namespace
Posted by Radostin Stoyanov 5 years, 3 months ago
There is a limit on the number of lines in the /proc/<pid>/{g,u}id_map
files. In Linux 4.14 and earlier, this limit was (arbitrarily) set at
5 lines. Since Linux 4.15, which was released on 28 Jan 2018, the limit
is 340 lines.

This change is documented in user_namespaces(7).

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6397fac4915ab3002dc15aae751455da1a852f25

Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
---
 src/lxc/lxc_controller.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c
index 99360397a7..2bec8846aa 100644
--- a/src/lxc/lxc_controller.c
+++ b/src/lxc/lxc_controller.c
@@ -1390,6 +1390,13 @@ virLXCControllerSetupUsernsMap(virDomainIdMapEntryPtr map,
     size_t i;
     int ret = -1;

+    /* The kernel supports up to 340 lines in /proc/<pid>/{g,u}id_map */
+    if (num > 340) {
+        virReportError(VIR_ERR_INVALID_ARG, "%s",
+                       _("Too many id mappings defined."));
+        goto cleanup;
+    }
+
     for (i = 0; i < num; i++)
         virBufferAsprintf(&map_value, "%u %u %u\n",
                           map[i].start, map[i].target, map[i].count);
--
2.19.2

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list
Re: [libvirt] [PATCH] lxc: Set max uid/gid mappings for user namespace
Posted by Daniel P. Berrangé 5 years, 3 months ago
On Sat, Dec 15, 2018 at 10:02:34AM +0000, Radostin Stoyanov wrote:
> There is a limit on the number of lines in the /proc/<pid>/{g,u}id_map
> files. In Linux 4.14 and earlier, this limit was (arbitrarily) set at
> 5 lines. Since Linux 4.15, which was released on 28 Jan 2018, the limit
> is 340 lines.
> 
> This change is documented in user_namespaces(7).
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6397fac4915ab3002dc15aae751455da1a852f25
> 
> Signed-off-by: Radostin Stoyanov <rstoyanov1@gmail.com>
> ---
>  src/lxc/lxc_controller.c | 7 +++++++
>  1 file changed, 7 insertions(+)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


> 
> diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c
> index 99360397a7..2bec8846aa 100644
> --- a/src/lxc/lxc_controller.c
> +++ b/src/lxc/lxc_controller.c
> @@ -1390,6 +1390,13 @@ virLXCControllerSetupUsernsMap(virDomainIdMapEntryPtr map,
>      size_t i;
>      int ret = -1;
> 
> +    /* The kernel supports up to 340 lines in /proc/<pid>/{g,u}id_map */
> +    if (num > 340) {
> +        virReportError(VIR_ERR_INVALID_ARG, "%s",
> +                       _("Too many id mappings defined."));
> +        goto cleanup;
> +    }
> +
>      for (i = 0; i < num; i++)
>          virBufferAsprintf(&map_value, "%u %u %u\n",
>                            map[i].start, map[i].target, map[i].count);
> --
> 2.19.2
> 
> --
> libvir-list mailing list
> libvir-list@redhat.com
> https://www.redhat.com/mailman/listinfo/libvir-list

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list