picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

nspawn: hash the machine name, when looking for a suitable UID base (#7437)

Browse source 
When "-U" is used we look for a UID range we can use for our container.
We start with the UID the tree is already assigned to, and if that
didn't work we'd pick random ranges so far. With this change we'll first
try to hash a suitable range from the container name, and use that if it
works, in order to make UID assignments more likely to be stable.

This follows a similar logic PID 1 follows when using DynamicUser=1.
This commit is contained in:
Lennart Poettering 2017-11-24 20:57:19 +01:00 committed by Zbigniew Jędrzejewski-Szmek
parent a8027a18f1
commit d381c8a6bf
1 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/nspawn/nspawn.c
View file

@ -2793,6 +2793,7 @@ static int outer_child(
}
static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
bool tried_hashed = false;
unsigned n_tries = 100;
uid_t candidate;
int r;
@ -2841,7 +2842,20 @@ static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
return 0;
next:
random_bytes(&candidate, sizeof(candidate));
if (arg_machine && !tried_hashed) {
/* Try to hash the base from the container name */
static const uint8_t hash_key[] = {
0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf,
0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72
};
candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key);
tried_hashed = true;
} else
random_bytes(&candidate, sizeof(candidate));
candidate = (candidate % (UID_SHIFT_PICK_MAX - UID_SHIFT_PICK_MIN)) + UID_SHIFT_PICK_MIN;
candidate &= (uid_t) UINT32_C(0xFFFF0000);
}