Skip to content

Commit 42d0004

Browse files
committed
reduce the chance of parsing /etc/passwd & /etc/group
Signed-off-by: lifubang <[email protected]>
1 parent 4d948b1 commit 42d0004

File tree

3 files changed

+49
-23
lines changed

3 files changed

+49
-23
lines changed

libcontainer/init_linux.go

Lines changed: 39 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -440,35 +440,61 @@ func syncParentSeccomp(pipe *os.File, seccompFd *os.File) error {
440440
return readSync(pipe, procSeccompDone)
441441
}
442442

443-
// setupUser changes the groups, gid, and uid for the user inside the container
444-
func setupUser(config *initConfig) error {
443+
func getExecUser(userAndGroup string) (*user.ExecUser, error) {
445444
// Set up defaults.
446445
defaultExecUser := user.ExecUser{
447446
Uid: 0,
448447
Gid: 0,
449448
Home: "/",
450449
}
451450

452-
passwdPath, err := user.GetPasswdPath()
453-
if err != nil {
454-
return err
455-
}
451+
u := strings.SplitN(userAndGroup, ":", 2)
456452

457-
groupPath, err := user.GetGroupPath()
458-
if err != nil {
459-
return err
453+
// len(u) == 1 means there is no group id, we should try to get the supplementary group IDs.
454+
if len(u) == 1 || u[0] == "" || os.Getenv("HOME") == "" {
455+
passwdPath, err := user.GetPasswdPath()
456+
if err != nil {
457+
return nil, err
458+
}
459+
460+
groupPath, err := user.GetGroupPath()
461+
if err != nil {
462+
return nil, err
463+
}
464+
465+
return user.GetExecUserPath(userAndGroup, &defaultExecUser, passwdPath, groupPath)
466+
} else {
467+
uid, err := strconv.Atoi(u[0])
468+
if err != nil {
469+
return nil, err
470+
}
471+
gid, err := strconv.Atoi(u[1])
472+
if err != nil {
473+
return nil, err
474+
}
475+
return &user.ExecUser{
476+
Uid: uid,
477+
Gid: gid,
478+
Home: os.Getenv("HOME"),
479+
}, nil
460480
}
481+
}
461482

462-
execUser, err := user.GetExecUserPath(config.User, &defaultExecUser, passwdPath, groupPath)
483+
// setupUser changes the groups, gid, and uid for the user inside the container
484+
func setupUser(config *initConfig) error {
485+
execUser, err := getExecUser(config.User)
463486
if err != nil {
464487
return err
465488
}
466489

467490
var addGroups []int
468491
if len(config.AdditionalGroups) > 0 {
469-
addGroups, err = user.GetAdditionalGroupsPath(config.AdditionalGroups, groupPath)
470-
if err != nil {
471-
return err
492+
for _, group := range config.AdditionalGroups {
493+
gid, err := strconv.Atoi(group)
494+
if err != nil {
495+
return err
496+
}
497+
addGroups = append(addGroups, gid)
472498
}
473499
}
474500

libcontainer/integration/exec_test.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -395,7 +395,7 @@ func TestAdditionalGroups(t *testing.T) {
395395
Env: standardEnvironment,
396396
Stdin: nil,
397397
Stdout: &stdout,
398-
AdditionalGroups: []string{"plugdev", "audio"},
398+
AdditionalGroups: []string{"1", "2"},
399399
Init: true,
400400
}
401401
err = container.Run(&pconfig)
@@ -407,12 +407,12 @@ func TestAdditionalGroups(t *testing.T) {
407407
outputGroups := stdout.String()
408408

409409
// Check that the groups output has the groups that we specified
410-
if !strings.Contains(outputGroups, "audio") {
411-
t.Fatalf("Listed groups do not contain the audio group as expected: %v", outputGroups)
410+
if !strings.Contains(outputGroups, "1") {
411+
t.Fatalf("Listed groups do not contain the group as expected: %v", outputGroups)
412412
}
413413

414-
if !strings.Contains(outputGroups, "plugdev") {
415-
t.Fatalf("Listed groups do not contain the plugdev group as expected: %v", outputGroups)
414+
if !strings.Contains(outputGroups, "2") {
415+
t.Fatalf("Listed groups do not contain the group as expected: %v", outputGroups)
416416
}
417417
}
418418

libcontainer/integration/execin_test.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -162,7 +162,7 @@ func TestExecInAdditionalGroups(t *testing.T) {
162162
Env: standardEnvironment,
163163
Stdin: nil,
164164
Stdout: &stdout,
165-
AdditionalGroups: []string{"plugdev", "audio"},
165+
AdditionalGroups: []string{"1", "2"},
166166
}
167167
err = container.Run(&pconfig)
168168
ok(t, err)
@@ -176,12 +176,12 @@ func TestExecInAdditionalGroups(t *testing.T) {
176176
outputGroups := stdout.String()
177177

178178
// Check that the groups output has the groups that we specified
179-
if !strings.Contains(outputGroups, "audio") {
180-
t.Fatalf("Listed groups do not contain the audio group as expected: %v", outputGroups)
179+
if !strings.Contains(outputGroups, "1") {
180+
t.Fatalf("Listed groups do not contain the group as expected: %v", outputGroups)
181181
}
182182

183-
if !strings.Contains(outputGroups, "plugdev") {
184-
t.Fatalf("Listed groups do not contain the plugdev group as expected: %v", outputGroups)
183+
if !strings.Contains(outputGroups, "2") {
184+
t.Fatalf("Listed groups do not contain the group as expected: %v", outputGroups)
185185
}
186186
}
187187

0 commit comments

Comments
 (0)