Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove /etc/passwd and /etc/group parsing on runc run/exec #3999

Draft
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

kolyshkin
Copy link
Contributor

@kolyshkin kolyshkin commented Aug 29, 2023

TODO: describe this (for now, see the last commit).

Fixes: #3998

@kolyshkin kolyshkin force-pushed the uidgid branch 2 times, most recently from 28aadc5 to 4866cd2 Compare August 29, 2023 03:35
@kolyshkin kolyshkin changed the title Uidgid Remove /etc/passwd and /etc/group parsing on runc run/exec Aug 29, 2023
@thaJeztah
Copy link
Member

1. Do not ask for the same option value twice.

2. For tty, we always want false, unless specified, and this is what
   GetBool gets us.

Signed-off-by: Kir Kolyshkin <[email protected]>
An error from strconv.Atoi already contains the text it fails to parse.
Because of that, errors look way too verbose, e.g.:

	[root@kir-rhat runc-tst]# ./runc exec --user 1:1:1 2345 true
	ERRO[0000] exec failed: parsing 1:1 as int for gid failed: strconv.Atoi: parsing "1:1": invalid syntax

With this patch, the error looks like this now:

	[root@kir-rhat runc]# ./runc exec --user 1:1:1 2345 true
	ERRO[0000] exec failed: bad gid: strconv.Atoi: parsing "1:1": invalid syntax

Still not awesome, but better.

Signed-off-by: Kir Kolyshkin <[email protected]>
Switch from github.com/moby/sys/user to Go stdlib os/user
(which has both libc-backed and pure Go implementations).

Signed-off-by: Kir Kolyshkin <[email protected]>
OCI runtime spec states [1] that the UID, primary GID, and additional
GIDs are all specified as numbers, and also adds that symbolic names
resolution "are left to upper levels to derive". Meaning, runc should
not care about user and group names.

Yet, runc tries to be clever than that, always parsing container's
/etc/passwd and /etc/group. It results in a few things:

1. If UID (or GID) specified can't be found inside container's /etc/passwd
   (or /etc/group), runc (run or exec) errors out.

2. Any additional GIDs specified in container's /etc/group are
   automatically prepended to the list for setgroups(2). Meaning, a user
   can either specify additional GIDs in OCI runtime spec, or
   container's /etc/group entry for a given user.

Looks like (1) is questionable (on a normal Linux system, I can run
programs under any UID (GID), not limited to those listed in /etc/passwd
(/etc/group), and (2) is just an extra mechanism of specifying
additional GIDs.

Let's remove those, hopefully increasing runc performance as well as OCI
spec conformance.

The only remaining need to parse /etc/passwd is to set HOME environment
variable for a specified UID, in case $HOME is not yet set. Use
user.LookupUid for this case.

PS Note that the structures being changed (initConfig and Process) are
never saved to disk as JSON by runc, so there is no compatibility issue
for runc users. Still, this is a breaking change in libcontainer, but we
never promised that libcontainer API will be stable.

For 3998.

[1] https://github.com/opencontainers/runtime-spec/blob/v1.0.2/config.md#posix-platform-user

Signed-off-by: Kir Kolyshkin <[email protected]>
@kolyshkin kolyshkin marked this pull request as ready for review September 28, 2023 23:58
@kolyshkin kolyshkin marked this pull request as draft June 13, 2024 03:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

RFC: remove user/group name support from libcontainer
2 participants