vfs: Make switch_userns set PR_SET_DUMPABLE

We need PR_SET_DUMPABLE in order to write the mapping files when
creating a userns. From prctl(2) PR_SET_DUMPABLE is reset when the
process's effective user or group ID is changed.

As we are changing the EUID here, we also reset it to allow creating
nested userns with subsequent switch_users() calls.

This was not causing any issues because we weren't using switch_users()
to create nested userns. Nested userns were created with
userns_fd_cb()/create_userns_hierarchy() that set PR_SET_DUMPABLE.

Future patches will rely on switch_users() to create nested userns. So
this patch fixes that.

Signed-off-by: Rodrigo Campos <rodrigo@sdfg.com.ar>
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Zorro Lang <zlang@kernel.org>

diff --git a/src/vfs/utils.c b/src/vfs/utils.c
index 2331a3b7cbcad3ba16be6bdd9494d475c68f5bf1..9e67ac3724207c757073d1462af1949c5f3129c2 100644 (file)
--- a/src/vfs/utils.c
+++ b/src/vfs/utils.c
@@ -286,6 +286,10 @@ bool switch_ids(uid_t uid, gid_t gid)
        if (setresuid(uid, uid, uid))
                return syserror("failure: setresuid");
 
+       /* Ensure we can access proc files from processes we can ptrace. */
+       if (prctl(PR_SET_DUMPABLE, 1, 0, 0, 0))
+               return syserror("failure: make dumpable");
+
        return true;
 }
 
@@ -303,11 +307,6 @@ static int userns_fd_cb(void *data)
        if (c == '1') {
                if (!switch_ids(0, 0))
                        return syserror("failure: switch ids to 0");
-
-               /* Ensure we can access proc files from processes we can ptrace. */
-               ret = prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
-               if (ret < 0)
-                       return syserror("failure: make dumpable");
        }
 
        ret = write_nointr(h->fd_event, "1", 1);