GNU bug report logs - #43673
[PATCH] linux-container: Reset jailed root permissions.

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 43673 in the body.
You can then email your comments to 43673 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Jelle Licht <jlicht <at> fsfe.org>
To: guix-patches <at> gnu.org
Subject: [PATCH] linux-container: Reset jailed root permissions.
Date: Mon, 28 Sep 2020 16:34:33 +0200

* gnu/build/linux-container.scm (mount-file-systems): Add 'chmod' call.
---
 gnu/build/linux-container.scm | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm
index 2d4de788df..4a8bed5a9a 100644
--- a/gnu/build/linux-container.scm
+++ b/gnu/build/linux-container.scm
@@ -170,7 +170,8 @@ for the process."
     (pivot-root root put-old)
     (chdir "/")
     (umount "real-root" MNT_DETACH)
-    (rmdir "real-root")))
+    (rmdir "real-root")
+    (chmod "/" #o755)))
 
 (define* (initialize-user-namespace pid host-uids
                                     #:key (guest-uid 0) (guest-gid 0))
-- 
2.28.0

Message #8 received at 43673 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Jelle Licht <jlicht <at> fsfe.org>
Cc: 43673 <at> debbugs.gnu.org
Subject: Re: [bug#43673] [PATCH] linux-container: Reset jailed root
 permissions.
Date: Tue, 29 Sep 2020 22:28:13 +0200

Hi,

Jelle Licht <jlicht <at> fsfe.org> skribis:

> * gnu/build/linux-container.scm (mount-file-systems): Add 'chmod' call.

Well done!  Could you add a test checking (stat:perms (lstat "/")) in
tests/containers.scm?

Thanks,
Ludo’.

Message #11 received at 43673 <at> debbugs.gnu.org (full text, mbox):

From: Jelle Licht <jlicht <at> fsfe.org>
To: 43673 <at> debbugs.gnu.org
Subject: [PATCH v2] linux-container: Reset jailed root permissions.
Date: Tue, 29 Sep 2020 23:25:13 +0200

* gnu/build/linux-container.scm (mount-file-systems): Add 'chmod' call.
* tests/containers.scm
("call-with-container, mnt namespace, root permissions"): New test.
---
 gnu/build/linux-container.scm | 3 ++-
 tests/containers.scm          | 8 ++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm
index 2d4de788df..4a8bed5a9a 100644
--- a/gnu/build/linux-container.scm
+++ b/gnu/build/linux-container.scm
@@ -170,7 +170,8 @@ for the process."
     (pivot-root root put-old)
     (chdir "/")
     (umount "real-root" MNT_DETACH)
-    (rmdir "real-root")))
+    (rmdir "real-root")
+    (chmod "/" #o755)))
 
 (define* (initialize-user-namespace pid host-uids
                                     #:key (guest-uid 0) (guest-gid 0))
diff --git a/tests/containers.scm b/tests/containers.scm
index 7b63e5c108..608902c41a 100644
--- a/tests/containers.scm
+++ b/tests/containers.scm
@@ -133,6 +133,14 @@
      (lambda ()
        (primitive-exit 0)))))
 
+(skip-if-unsupported)
+(test-assert "call-with-container, mnt namespace, root permissions"
+  (zero?
+   (call-with-container '()
+     (lambda ()
+       (assert-exit (= #o755 (stat:perms (lstat "/")))))
+     #:namespaces '(user mnt))))
+
 (skip-if-unsupported)
 (test-assert "container-excursion"
   (call-with-temporary-directory
-- 
2.28.0

Message #14 received at 43673 <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Jelle Licht <jlicht <at> fsfe.org>
Cc: 43673 <at> debbugs.gnu.org
Subject: Re: [bug#43673] [PATCH v2] linux-container: Reset jailed root
 permissions.
Date: Thu, 01 Oct 2020 11:35:08 +0200

Hi,

Jelle Licht <jlicht <at> fsfe.org> skribis:

> * gnu/build/linux-container.scm (mount-file-systems): Add 'chmod' call.
> * tests/containers.scm
> ("call-with-container, mnt namespace, root permissions"): New test.

LGTM, thanks!

Ludo’.

Message #19 received at 43673-done <at> debbugs.gnu.org (full text, mbox):

From: Jelle Licht <jlicht <at> fsfe.org>
To: Ludovic Courtès <ludo <at> gnu.org>
Cc: 43673-done <at> debbugs.gnu.org
Subject: Re: [bug#43673] [PATCH v2] linux-container: Reset jailed root
 permissions.
Date: Thu, 01 Oct 2020 13:48:29 +0200

Ludovic Courtès <ludo <at> gnu.org> writes:

> Hi,
>
> Jelle Licht <jlicht <at> fsfe.org> skribis:
>
>> * gnu/build/linux-container.scm (mount-file-systems): Add 'chmod' call.
>> * tests/containers.scm
>> ("call-with-container, mnt namespace, root permissions"): New test.
>
> LGTM, thanks!
>
> Ludo’.

Pushed as e7481835 on master, thanks for the fast review!

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.