public inbox for pve-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Filip Schauer <f.schauer@proxmox.com>
To: pve-devel@lists.proxmox.com
Subject: [PATCH container 5/8] namespaces: refactor run_in_userns
Date: Mon, 23 Feb 2026 14:04:51 +0100	[thread overview]
Message-ID: <20260223130706.90972-6-f.schauer@proxmox.com> (raw)
In-Reply-To: <20260223130706.90972-1-f.schauer@proxmox.com>

Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
---
 src/PVE/LXC/Namespaces.pm | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/src/PVE/LXC/Namespaces.pm b/src/PVE/LXC/Namespaces.pm
index 3b86262..477d0ac 100644
--- a/src/PVE/LXC/Namespaces.pm
+++ b/src/PVE/LXC/Namespaces.pm
@@ -25,6 +25,19 @@ my sub set_id_map($$) {
     PVE::Tools::run_command(['newuidmap', $pid, @uid_args]) if scalar(@uid_args);
 }
 
+my sub sync_send {
+    my ($fh, $msg) = @_;
+
+    syswrite($fh, $msg) == length($msg) or die "sync write failed: $!\n";
+}
+
+my sub sync_recv {
+    my ($fh, $expect) = @_;
+
+    my $received = <$fh>;
+    die "sync read failed\n" if $received ne $expect;
+}
+
 sub run_in_userns($;$) {
     my ($code, $id_map) = @_;
     socketpair(my $sp, my $sc, AF_UNIX, SOCK_STREAM, PF_UNSPEC)
@@ -32,25 +45,23 @@ sub run_in_userns($;$) {
     my $child = sub {
         close($sp);
         PVE::Tools::unshare(CLONE_NEWUSER | CLONE_NEWNS) or die "unshare(NEWUSER|NEWNS): $!\n";
-        syswrite($sc, "1\n") == 2 or die "write: $!\n";
+        sync_send($sc, "1\n");
         shutdown($sc, 1);
-        my $two = <$sc>;
-        die "failed to sync with parent process\n" if $two ne "2\n";
+        sync_recv($sc, "2\n");
         close($sc);
         $! = undef;
         ($(, $)) = (0, 0);
-        die "$!\n" if $!;
+        die "setgid(0): $!\n" if $!;
         ($<, $>) = (0, 0);
-        die "$!\n" if $!;
+        die "setuid(0): $!\n" if $!;
         return $code->();
     };
     my $parent = sub {
         my ($pid) = @_;
         close($sc);
-        my $one = <$sp>;
-        die "failed to sync with userprocess\n" if $one ne "1\n";
+        sync_recv($sp, "1\n");
         set_id_map($pid, $id_map);
-        syswrite($sp, "2\n") == 2 or die "write: $!\n";
+        sync_send($sp, "2\n");
         close($sp);
     };
     PVE::Tools::run_fork($child, { afterfork => $parent });
-- 
2.47.3





  parent reply	other threads:[~2026-02-23 13:09 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-02-23 13:04 [PATCH common/container/manager 0/8] implement per-mountpoint uid/gid mapping Filip Schauer
2026-02-23 13:04 ` [PATCH common 1/8] tools: export O_CLOEXEC constant Filip Schauer
2026-02-23 13:04 ` [PATCH common 2/8] syscall: add missing mount attribute constants Filip Schauer
2026-02-23 13:04 ` [PATCH common 3/8] tools: add mount_setattr syscall Filip Schauer
2026-02-23 13:04 ` [PATCH container 4/8] namespaces: relax prototype of run_in_userns Filip Schauer
2026-02-23 13:04 ` Filip Schauer [this message]
2026-02-23 13:04 ` [PATCH container 6/8] namespaces: add helper to create user namespace from idmap Filip Schauer
2026-02-23 13:04 ` [PATCH container 7/8] implement per-mountpoint uid/gid mapping Filip Schauer
2026-02-23 13:04 ` [PATCH manager 8/8] ui: lxc/MPEdit: add "idmap" option Filip Schauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260223130706.90972-6-f.schauer@proxmox.com \
    --to=f.schauer@proxmox.com \
    --cc=pve-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal