From: Fiona Ebner <f.ebner@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [pve-devel] [PATCH container v9 21/29] add LXC::Namespaces module
Date: Fri, 4 Apr 2025 15:31:56 +0200 [thread overview]
Message-ID: <20250404133204.239783-22-f.ebner@proxmox.com> (raw)
In-Reply-To: <20250404133204.239783-1-f.ebner@proxmox.com>
The module includes a run_in_userns() helper to run a Perl subroutine
in a user namespace.
The first use case is running the container backup subroutine for
external providers inside a user namespace. That allows them to see
the filesystem to back-up from the containers perspective and also
improves security because of isolation.
Heavily adapted from code by Wolfgang from the pve-buildpkg
repository.
[FE: add $idmap parameter, drop $aux_groups parameter
use different fork helper
use newuidmap and newgidmap binaries]
Originally-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/LXC/Makefile | 1 +
src/PVE/LXC/Namespaces.pm | 57 +++++++++++++++++++++++++++++++++++++++
2 files changed, 58 insertions(+)
create mode 100644 src/PVE/LXC/Namespaces.pm
diff --git a/src/PVE/LXC/Makefile b/src/PVE/LXC/Makefile
index a190260..4b05e98 100644
--- a/src/PVE/LXC/Makefile
+++ b/src/PVE/LXC/Makefile
@@ -5,6 +5,7 @@ SOURCES= \
Create.pm \
Migrate.pm \
Monitor.pm \
+ Namespaces.pm \
Setup.pm \
Tools.pm
diff --git a/src/PVE/LXC/Namespaces.pm b/src/PVE/LXC/Namespaces.pm
new file mode 100644
index 0000000..bd39c07
--- /dev/null
+++ b/src/PVE/LXC/Namespaces.pm
@@ -0,0 +1,57 @@
+package PVE::LXC::Namespaces;
+
+use strict;
+use warnings;
+
+use Fcntl qw(O_WRONLY);
+use Socket;
+
+use PVE::Tools qw(CLONE_NEWNS CLONE_NEWUSER);
+
+my sub set_id_map($$) {
+ my ($pid, $id_map) = @_;
+
+ my @gid_args = ();
+ my @uid_args = ();
+
+ for my $map ($id_map->@*) {
+ my ($type, $ct, $host, $length) = $map->@*;
+
+ push @gid_args, $ct, $host, $length if $type eq 'g';
+ push @uid_args, $ct, $host, $length if $type eq 'u';
+ }
+
+ PVE::Tools::run_command(['newgidmap', $pid, @gid_args]) if scalar(@gid_args);
+ PVE::Tools::run_command(['newuidmap', $pid, @uid_args]) if scalar(@uid_args);
+}
+
+sub run_in_userns(&;$) {
+ my ($code, $id_map) = @_;
+ socketpair(my $sp, my $sc, AF_UNIX, SOCK_STREAM, PF_UNSPEC)
+ or die "socketpair: $!\n";
+ my $child = sub {
+ close($sp);
+ PVE::Tools::unshare(CLONE_NEWUSER|CLONE_NEWNS) or die "unshare(NEWUSER|NEWNS): $!\n";
+ syswrite($sc, "1\n") == 2 or die "write: $!\n";
+ shutdown($sc, 1);
+ my $two = <$sc>;
+ die "failed to sync with parent process\n" if $two ne "2\n";
+ close($sc);
+ $! = undef;
+ ($(, $)) = (0, 0); die "$!\n" if $!;
+ ($<, $>) = (0, 0); die "$!\n" if $!;
+ return $code->();
+ };
+ my $parent = sub {
+ my ($pid) = @_;
+ close($sc);
+ my $one = <$sp>;
+ die "failed to sync with userprocess\n" if $one ne "1\n";
+ set_id_map($pid, $id_map);
+ syswrite($sp, "2\n") == 2 or die "write: $!\n";
+ close($sp);
+ };
+ PVE::Tools::run_fork($child, { afterfork => $parent });
+}
+
+1;
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
next prev parent reply other threads:[~2025-04-04 13:33 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-04-04 13:31 [pve-devel] [PATCH qemu/storage/qemu-server/container/manager v9 00/29] backup provider API Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu v9 01/29] PVE backup: backup-access api: simplify bitmap logic Fiona Ebner
2025-04-06 18:02 ` [pve-devel] applied: " Thomas Lamprecht
2025-04-04 13:31 ` [pve-devel] [PATCH storage v9 02/29] add storage_has_feature() helper function Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH storage v9 03/29] common: add deallocate " Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH storage v9 04/29] plugin: introduce new_backup_provider() method Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH storage v9 05/29] config api/plugins: let plugins define sensitive properties themselves Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH storage v9 06/29] plugin api: bump api version and age Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH storage v9 07/29] extract backup config: delegate to backup provider for storages that support it Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [POC storage v9 08/29] add backup provider example Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [POC storage v9 09/29] Borg example plugin Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 10/29] backup: keep track of block-node size for fleecing Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 11/29] backup: fleecing: use exact size when allocating non-raw fleecing images Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 12/29] backup: allow adding fleecing images also for EFI and TPM Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 13/29] backup: implement backup for external providers Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 14/29] test: qemu img convert: add test cases for snapshots Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 15/29] image convert: collect options in hash argument Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 16/29] image convert: allow caller to specify the format of the source path Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 17/29] backup: implement restore for external providers Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 18/29] backup: future-proof checks for QEMU feature support Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 19/29] backup: support 'missing-recreated' bitmap action Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH qemu-server v9 20/29] backup: bitmap action to human: lie about TPM state Fiona Ebner
2025-04-04 13:31 ` Fiona Ebner [this message]
2025-04-04 13:31 ` [pve-devel] [PATCH container v9 22/29] backup: implement backup for external providers Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH container v9 23/29] backup: implement restore " Fiona Ebner
2025-04-04 13:31 ` [pve-devel] [PATCH container v9 24/29] external restore: don't use 'one-file-system' tar flag when restoring from a directory Fiona Ebner
2025-04-04 13:32 ` [pve-devel] [PATCH container v9 25/29] create: factor out compression option helper Fiona Ebner
2025-04-04 13:32 ` [pve-devel] [PATCH container v9 26/29] restore tar archive: check potentially untrusted archive Fiona Ebner
2025-04-04 13:32 ` [pve-devel] [PATCH container v9 27/29] api: add early check against restoring privileged container from external source Fiona Ebner
2025-04-04 13:32 ` [pve-devel] [PATCH manager v9 28/29] ui: backup: also check for backup subtype to classify archive Fiona Ebner
2025-04-04 13:32 ` [pve-devel] [PATCH manager v9 29/29] backup: implement backup for external providers Fiona Ebner
2025-04-04 14:08 ` [pve-devel] [PATCH qemu/storage/qemu-server/container/manager v9 00/29] backup provider API Wolfgang Bumiller
2025-04-06 19:49 ` [pve-devel] applied-series: " Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250404133204.239783-22-f.ebner@proxmox.com \
--to=f.ebner@proxmox.com \
--cc=pve-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal