From 1771ca7ac77c3d6a2afb1215728fa25301938ca1 Mon Sep 17 00:00:00 2001 From: lifubang Date: Thu, 24 Oct 2024 22:17:54 +0800 Subject: [PATCH] libct/nsenter: become root after joining userns Containerd pre-creates userns and netns before calling runc, which results in the current code not working when SELinux is enabled, resulting in the following error: > runc create failed: unable to start container process: error during container init: error mounting "mqueue" to rootfs at "/dev/mqueue": setxattr /path/to/rootfs/dev/mqueue: operation not permitted The solution is to become root in the user namespace right after we join it. Fixes 4473. Co-authored-by: Wei Fu Co-authored-by: Kir Kolyshkin Signed-off-by: lifubang --- libcontainer/nsenter/nsexec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c index 74e15b96d5f..7c7b9d7526e 100644 --- a/libcontainer/nsenter/nsexec.c +++ b/libcontainer/nsenter/nsexec.c @@ -505,6 +505,12 @@ void join_namespaces(char *nslist) if (setns(ns->fd, flag) < 0) bail("failed to setns into %s namespace", ns->type); + /* See https://github.com/opencontainers/runc/issues/4466. */ + if (flag == CLONE_NEWUSER) { + if (setresuid(0, 0, 0) < 0) + bail("failed to become root in user namespace"); + } + close(ns->fd); }