Fix fifo usage with userns and not root users

[crosbymichael]

Signed-off-by: Michael Crosby [email protected]

[cyphar]

Doesn't this mean that any user can start a container created by root? This doesn't make sense to me IMO -- what's the usecase? With the rootless container setup, my hope was that each user's containers could only be controlled by them (with root being a special case) -- this means that any user will be able to start any other users' containers. Why is this necessary? That's why I liked the signal setup, because it retained that access control.

Sure, at the moment the only access control is "starting a container if it's been set up already". But I can imagine cases where people might not want an unprivileged user to start a container before they've run all of their hooks.

My plan with the rootless container setup is for everything to be per-user, rather than a global free-for-all.

[crosbymichael]

I'll change this to 0622 so that only root can read and unblock the container's process

[cyphar]

Since we chowning the FIFO, surely we can just make it 0600? Why do other users need to be able to write to the FIFO?

[mlaventure]

Isn't the uid at that point basically 0,0 ?

Meaning that, in a userns context, the user at the time of writing to the fifo would be matched against "other".

[cyphar]

No, because we chown the FIFO when creating the container (it's the next line after this). If we didn't chown it, then we wouldn't have any guarantee that the UID would be mapped (and thus nobody in the container could read from the socket).

[crosbymichael]

@LK4D4 @mrunalp can you please look at this PR. It fixes permissions errors with the fifo under userns and non root users in regular containers on some machines with umask issues

[mrunalp]

@crosbymichael Yeah, will review it shortly.

[mrunalp]

LGTM

[LK4D4]

LGTM

[cyphar]

@crosbymichael I still had some open concerns about the permissions:

Since we chowning the FIFO, surely we can just make it 0600? Why do other users need to be able to write to the FIFO?

No [ we don't need to allow other users to write ], because we chown the FIFO when creating the container (it's the next line after this). If we didn't chown it, then we wouldn't have any guarantee that the UID would be mapped (and thus nobody in the container could read from the socket).