From patchwork Wed Sep 26 15:54:56 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: DJ Delorie X-Patchwork-Id: 29553 Received: (qmail 6727 invoked by alias); 26 Sep 2018 15:55:00 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 6704 invoked by uid 89); 26 Sep 2018 15:55:00 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-25.4 required=5.0 tests=BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_LAZY_DOMAIN_SECURITY, KAM_NUMSUBJECT, SPF_HELO_PASS autolearn=ham version=3.3.2 spammy=how's, hows, Hx-languages-length:1957 X-HELO: mx1.redhat.com From: DJ Delorie To: Florian Weimer Cc: libc-alpha@sourceware.org Subject: Re: [patch] add support hints to test-container V2 In-Reply-To: <87wor8fyzn.fsf@oldenburg.str.redhat.com> (message from Florian Weimer on Wed, 26 Sep 2018 10:23:56 +0200) Date: Wed, 26 Sep 2018 11:54:56 -0400 Message-ID: MIME-Version: 1.0 Florian Weimer writes: > No implicit NULL check, please. > errno has been clobbered at this point. You need to save its value > before calling check_for_unshare_hints. How's this then? diff --git a/support/test-container.c b/support/test-container.c index c56b53ed81..8445c0e76d 100644 --- a/support/test-container.c +++ b/support/test-container.c @@ -609,6 +609,47 @@ rsync (char *src, char *dest, int and_delete) } + +/* See if we can detect what the user needs to do to get unshare + support working for us. */ +void +check_for_unshare_hints (void) +{ + FILE *f; + int i; + + /* Default Debian Linux disables user namespaces, but allows a way + to enable them. */ + f = fopen ("/proc/sys/kernel/unprivileged_userns_clone", "r"); + if (f != NULL) + { + i = 99; /* Sentinel. */ + fscanf (f, "%d", &i); + if (i == 0) + { + printf ("To enable test-container, please run this as root:\n"); + printf (" echo 1 > /proc/sys/kernel/unprivileged_userns_clone\n"); + } + fclose (f); + return; + } + + /* ALT Linux has an alternate way of doing the same. */ + f = fopen ("/proc/sys/kernel/userns_restrict", "r"); + if (f != NULL) + { + i = 99; /* Sentinel. */ + fscanf (f, "%d", &i); + if (i == 1) + { + printf ("To enable test-container, please run this as root:\n"); + printf (" echo 0 > /proc/sys/kernel/userns_restrict\n"); + } + fclose (f); + return; + } +} + int main (int argc, char **argv) { @@ -873,7 +914,12 @@ main (int argc, char **argv) /* Older kernels may not support all the options, or security policy may block this call. */ if (errno == EINVAL || errno == EPERM) - FAIL_UNSUPPORTED ("unable to unshare user/fs: %s", strerror (errno)); + { + int saved_errno = errno; + if (errno == EPERM) + check_for_unshare_hints (); + FAIL_UNSUPPORTED ("unable to unshare user/fs: %s", strerror (saved_errno)); + } else FAIL_EXIT1 ("unable to unshare user/fs: %s", strerror (errno)); }