From 24f5a4c7c69ea6c3f9c292030fad06d1015eb333 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Wed, 13 Jun 2018 23:59:35 +0900 Subject: [PATCH] machine: ignore containers which disable private user namespace in MapToMachine{User,Group} Fixes #9286. --- src/machine/machined-dbus.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c index cb46718696..f45e592062 100644 --- a/src/machine/machined-dbus.c +++ b/src/machine/machined-dbus.c @@ -1010,6 +1010,10 @@ static int method_map_to_machine_user(sd_bus_message *message, void *userdata, s return -EIO; } + /* The private user namespace is disabled, ignoring. */ + if (uid_shift == 0) + continue; + if (uid < uid_shift || uid >= uid_shift + uid_range) continue; @@ -1128,6 +1132,10 @@ static int method_map_to_machine_group(sd_bus_message *message, void *groupdata, return -EIO; } + /* The private user namespace is disabled, ignoring. */ + if (gid_shift == 0) + continue; + if (gid < gid_shift || gid >= gid_shift + gid_range) continue;