mirror of
https://github.com/systemd/systemd.git
synced 2026-06-30 19:57:29 +00:00
025439faaa
We want to support the scenario where we bind mount the nsresourced varlink socket into a container to allow nested containers where the outer container runs in its own transient range from nsresourced but can still allocate transient ranges for its own nested containers. To support this use case let's add support for delegation. Delegated ranges are allocated when allocating the primary range and are propagated 1:1 to the user namespace. We track delegated ranges in ".delegate" files in the userns registry so that they can't be used for other range allocations. We make one exception for delegated ranges though, if we get a request from a user namespace that is a child of the user namespace that owns the delegated ranges, we allow allocating from the delegated range. The parent userns already has full ownership over the child userns, so it doesn't matter that the parent userns and the child userns share the same range. This allows making use of delegated ranges without having to run another copy of nsresourced inside the parent userns to hand out from the delegated range. To support recursive delegations, we keep track of the previous owners of the delegated range and restore ownership to the last previous owner when the current owner is freed.
74 lines
2.7 KiB
C
74 lines
2.7 KiB
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
#pragma once
|
|
|
|
#include "basic-forward.h"
|
|
|
|
typedef struct UIDRangeEntry {
|
|
uid_t start, nr;
|
|
} UIDRangeEntry;
|
|
|
|
typedef struct UIDRange {
|
|
UIDRangeEntry *entries;
|
|
size_t n_entries;
|
|
} UIDRange;
|
|
|
|
UIDRange* uid_range_free(UIDRange *range);
|
|
DEFINE_TRIVIAL_CLEANUP_FUNC(UIDRange*, uid_range_free);
|
|
|
|
int uid_range_add_internal(UIDRange **range, uid_t start, uid_t nr, bool coalesce);
|
|
static inline int uid_range_add(UIDRange **range, uid_t start, uid_t nr) {
|
|
return uid_range_add_internal(range, start, nr, true);
|
|
}
|
|
int uid_range_add_str_full(UIDRange **range, const char *s, bool coalesce);
|
|
static inline int uid_range_add_str(UIDRange **range, const char *s) {
|
|
return uid_range_add_str_full(range, s, true);
|
|
}
|
|
|
|
int uid_range_next_lower(const UIDRange *range, uid_t *uid);
|
|
|
|
bool uid_range_covers(const UIDRange *range, uid_t start, uid_t nr);
|
|
static inline bool uid_range_contains(const UIDRange *range, uid_t uid) {
|
|
return uid_range_covers(range, uid, 1);
|
|
}
|
|
|
|
int uid_map_read_one(FILE *f, uid_t *ret_base, uid_t *ret_shift, uid_t *ret_range);
|
|
|
|
static inline size_t uid_range_entries(const UIDRange *range) {
|
|
return range ? range->n_entries : 0;
|
|
}
|
|
|
|
unsigned uid_range_size(const UIDRange *range) _pure_;
|
|
bool uid_range_is_empty(const UIDRange *range) _pure_;
|
|
|
|
bool uid_range_equal(const UIDRange *a, const UIDRange *b);
|
|
|
|
typedef enum UIDRangeUsernsMode {
|
|
UID_RANGE_USERNS_INSIDE,
|
|
UID_RANGE_USERNS_OUTSIDE,
|
|
GID_RANGE_USERNS_INSIDE,
|
|
GID_RANGE_USERNS_OUTSIDE,
|
|
_UID_RANGE_USERNS_MODE_MAX,
|
|
_UID_RANGE_USERNS_MODE_INVALID = -EINVAL,
|
|
} UIDRangeUsernsMode;
|
|
|
|
int uid_range_load_userns_full(const char *path, UIDRangeUsernsMode mode, bool coalesce, UIDRange **ret);
|
|
static inline int uid_range_load_userns(const char *path, UIDRangeUsernsMode mode, UIDRange **ret) {
|
|
return uid_range_load_userns_full(path, mode, true, ret);
|
|
}
|
|
int uid_range_load_userns_by_fd_full(int userns_fd, UIDRangeUsernsMode mode, bool coalesce, UIDRange **ret);
|
|
static inline int uid_range_load_userns_by_fd(int userns_fd, UIDRangeUsernsMode mode, UIDRange **ret) {
|
|
return uid_range_load_userns_by_fd_full(userns_fd, mode, true, ret);
|
|
}
|
|
|
|
bool uid_range_overlaps(const UIDRange *range, uid_t start, uid_t nr);
|
|
|
|
int uid_range_clip(UIDRange *range, uid_t min, uid_t max);
|
|
int uid_range_partition(UIDRange *range, uid_t size);
|
|
int uid_range_copy(const UIDRange *range, UIDRange **ret);
|
|
int uid_range_remove(UIDRange *range, uid_t start, uid_t size);
|
|
int uid_range_translate(const UIDRange *outside, const UIDRange *inside, uid_t uid, uid_t *ret);
|
|
|
|
int uid_map_search_root(pid_t pid, UIDRangeUsernsMode mode, uid_t *ret);
|
|
|
|
uid_t uid_range_base(const UIDRange *range);
|