Take static sub UID/GID ranges for now

This commit is contained in:
Simon Fels 2016-06-20 08:27:18 +02:00
commit d12b91ecbe
2 changed files with 3 additions and 29 deletions

View file

@ -57,27 +57,15 @@ Container::~Container() {
stop(); stop();
} }
std::vector<Container::IdMapping> Container::read_id_mappings() {
std::vector<Container::IdMapping> mappings;
static const std::string subuid_path = "/etc/subuid";
static const std::string subgid_path = "/etc/subgid";
std::ifstream subuid_file(subuid_path);
return mappings;
}
void Container::start() { void Container::start() {
DEBUG("uid %d gid %d", getuid(), getgid());
std::vector<std::string> args = { std::vector<std::string> args = {
// We need to setup user mapping here as lxc-usernsexec will not // We need to setup user mapping here as lxc-usernsexec will not
// map our current user to root which we need to allow our container // map our current user to root which we need to allow our container
// to access files we've created. // to access files we've created and mapped into it
"-m", utils::string_format("u:0:%d:1", getuid()), "-m", utils::string_format("u:0:%d:1", getuid()),
"-m", utils::string_format("g:0:%d:1", getgid()), "-m", utils::string_format("g:0:%d:1", getgid()),
// FIXME(morphis): We need to determine those things dynamically and // For all other users inside the container we're using a subuid/
// error out if not subui range is set for our current user. // subgid range which is defined on the host.
"-m", "u:1:100000:100000", "-m", "u:1:100000:100000",
"-m", "g:1:100000:100000", "-m", "g:1:100000:100000",
"--", "--",

View file

@ -56,20 +56,6 @@ public:
private: private:
Container(const Container::Spec &spec); Container(const Container::Spec &spec);
struct IdMapping {
enum class Type {
UID,
GID
};
Type type;
int hostid;
int nsid;
int range;
};
std::vector<IdMapping> read_id_mappings();
Spec spec_; Spec spec_;
core::posix::ChildProcess child_; core::posix::ChildProcess child_;
core::posix::ProcessGroup child_group_; core::posix::ProcessGroup child_group_;