mirror of
https://github.com/containerd/containerd.git
synced 2026-08-09 09:33:06 +00:00
59cc4cc49d
By restoring the effective capabilities of the thread after setresuid()
we can both:
1. Use the go runtime to setup the uid_map now that we have the
capabilities to do so in the thread again
2. Enable this on distro's which have restrictions around
unprivileged user namespace creation and usage (since the thread
is now privileged)
Let's do it. See [0] for more details on this topic. Unlike
unix::Setresuid()[1], which mimics the glibc implementation and acts on all
threads in the process, unix::Cap{s,g}et() are thread local[2] only as we
want, so we can use that directly.
[0]: https://github.com/containerd/containerd/pull/12317#discussion_r2686960671
[1]: e2fef50def/src/syscall/syscall_linux.go (L1217)
[2]: 6fb913b30f/unix/zsyscall_linux.go (L524)
Signed-off-by: Andrew Halaney <ahalaney@netflix.com>