nspawn: optionally, automatically allocate a UID/GID range for userns containers

This adds the new value "pick" to --private-users=. When specified a new
UID/GID range of 65536 users is automatically and randomly allocated from the
host range 0x00080000-0xDFFF0000 and used for the container. The setting
implies --private-users-chown, so that container directory is recursively
chown()ed to the newly allocated UID/GID range, if that's necessary. As an
optimization before picking a randomized UID/GID the UID of the container's
root directory is used as starting point and used if currently not used
otherwise.

To protect against using the same UID/GID range multiple times a few mechanisms
are in place:

- The first and the last UID and GID of the range are checked with getpwuid()
  and getgrgid(). If an entry already exists a different range is picked. Note
  that by "last" UID the user 65534 is used, as 65535 is the 16bit (uid_t) -1.

- A lock file for the range is taken in /run/systemd/nspawn-uid/. Since the
  ranges are taken in a non-overlapping fashion, and always start on 64K
  boundaries this allows us to maintain a single lock file for each range that
  can be randomly picked. This protects nspawn from picking the same range in
  two parallel instances.

- If possible the /etc/passwd lock file is taken while a new range is selected
  until the container is up. This means adduser/addgroup should safely avoid
  the range as long as nss-mymachines is used, since the allocated range will
  then show up in the user database.

The UID/GID range nspawn picks from is compiled in and not configurable at the
moment. That should probably stay that way, since we already provide ways how
users can pick their own ranges manually if they don't like the automatic
logic.

The new --private-users=pick logic makes user namespacing pretty useful now, as
it relieves the user from managing UID/GID ranges.

1 files changed, 189 insertions, 37 deletions

diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
index a3190545fa..c330456ff9 100644
--- a/src/nspawn/nspawn.c
+++ b/src/nspawn/nspawn.c
@@ -22,7 +22,9 @@
 #endif
 #include <errno.h>
 #include <getopt.h>
+#include <grp.h>
 #include <linux/loop.h>
+#include <pwd.h>
 #include <sched.h>
 #ifdef HAVE_SECCOMP
 #include <seccomp.h>
@@ -102,6 +104,11 @@
 #include "user-util.h"
 #include "util.h"
 
+/* Note that devpts's gid= parameter parses GIDs as signed values, hence we stay away from the upper half of the 32bit
+ * UID range here */
+#define UID_SHIFT_PICK_MIN ((uid_t) UINT32_C(0x00080000))
+#define UID_SHIFT_PICK_MAX ((uid_t) UINT32_C(0x6FFF0000))
+
 typedef enum ContainerStatus {
         CONTAINER_TERMINATED,
         CONTAINER_REBOOTED
@@ -174,9 +181,10 @@ static char *arg_image = NULL;
 static VolatileMode arg_volatile_mode = VOLATILE_NO;
 static ExposePort *arg_expose_ports = NULL;
 static char **arg_property = NULL;
-static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
 static bool arg_userns = false;
 static bool arg_userns_chown = false;
+static uid_t arg_uid_shift = UID_INVALID, arg_uid_range = 0x10000U;
+static bool arg_uid_shift_pick = false;
 static int arg_kill_signal = 0;
 static bool arg_unified_cgroup_hierarchy = false;
 static SettingsMask arg_settings_mask = 0;
@@ -275,9 +283,15 @@ static int custom_mounts_prepare(void) {
         for (i = 0; i < arg_n_custom_mounts; i++) {
                 CustomMount *m = &arg_custom_mounts[i];
 
-                if (arg_userns && arg_uid_shift == UID_INVALID && path_equal(m->destination, "/")) {
-                        log_error("--private-users with automatic UID shift may not be combined with custom root mounts.");
-                        return -EINVAL;
+                if (path_equal(m->destination, "/") && arg_userns) {
+
+                        if (arg_userns_chown) {
+                                log_error("--private-users-chown may not be combined with custom root mounts.");
+                                return -EINVAL;
+                        } else if (arg_uid_shift == UID_INVALID) {
+                                log_error("--private-users with automatic UID shift may not be combined with custom root mounts.");
+                                return -EINVAL;
+                        }
                 }
 
                 if (m->type != CUSTOM_MOUNT_OVERLAY)
@@ -806,25 +820,37 @@ static int parse_argv(int argc, char *argv[]) {
                                 _cleanup_free_ char *buffer = NULL;
                                 const char *range, *shift;
 
-                                range = strchr(optarg, ':');
-                                if (range) {
-                                        buffer = strndup(optarg, range - optarg);
-                                        if (!buffer)
-                                                return log_oom();
-                                        shift = buffer;
-
-                                        range++;
-                                        if (safe_atou32(range, &arg_uid_range) < 0 || arg_uid_range <= 0) {
-                                                log_error("Failed to parse UID range: %s", range);
+                                if (streq(optarg, "pick")) {
+                                        arg_uid_shift = UID_INVALID;
+                                        arg_uid_range = 0x10000U;
+                                        arg_uid_shift_pick = true;
+                                } else {
+                                        range = strchr(optarg, ':');
+                                        if (range) {
+                                                buffer = strndup(optarg, range - optarg);
+                                                if (!buffer)
+                                                        return log_oom();
+                                                shift = buffer;
+
+                                                range++;
+                                                if (safe_atou32(range, &arg_uid_range) < 0 || arg_uid_range <= 0) {
+                                                        log_error("Failed to parse UID range: %s", range);
+                                                        return -EINVAL;
+                                                }
+                                        } else
+                                                shift = optarg;
+
+                                        if (parse_uid(shift, &arg_uid_shift) < 0) {
+                                                log_error("Failed to parse UID: %s", optarg);
                                                 return -EINVAL;
                                         }
-                                } else
-                                        shift = optarg;
 
-                                if (parse_uid(shift, &arg_uid_shift) < 0) {
-                                        log_error("Failed to parse UID: %s", optarg);
-                                        return -EINVAL;
+                                        arg_uid_shift_pick = false;
                                 }
+                        } else {
+                                arg_uid_shift = UID_INVALID;
+                                arg_uid_range = 0x10000U;
+                                arg_uid_shift_pick = false;
                         }
 
                         arg_userns = true;
@@ -902,6 +928,9 @@ static int parse_argv(int argc, char *argv[]) {
         if (arg_share_system)
                 arg_register = false;
 
+        if (arg_uid_shift_pick)
+                arg_userns_chown = true;
+
         if (arg_start_mode != START_PID1 && arg_share_system) {
                 log_error("--boot and --share-system may not be combined.");
                 return -EINVAL;
@@ -2501,7 +2530,6 @@ static int determine_uid_shift(const char *directory) {
                 return -EINVAL;
         }
 
-        log_info("Using user namespaces with base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
         return 0;
 }
 
@@ -2789,6 +2817,7 @@ static int outer_child(
                 return r;
 
         if (arg_userns) {
+                /* Let the parent know which UID shift we read from the image */
                 l = send(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
                 if (l < 0)
                         return log_error_errno(errno, "Failed to send UID shift: %m");
@@ -2796,6 +2825,22 @@ static int outer_child(
                         log_error("Short write while sending UID shift.");
                         return -EIO;
                 }
+
+                if (arg_uid_shift_pick) {
+                        /* When we are supposed to pick the UID shift, the parent will check now whether the UID shift
+                         * we just read from the image is available. If yes, it will send the UID shift back to us, if
+                         * not it will pick a different one, and send it back to us. */
+
+                        l = recv(uid_shift_socket, &arg_uid_shift, sizeof(arg_uid_shift), 0);
+                        if (l < 0)
+                                return log_error_errno(errno, "Failed to recv UID shift: %m");
+                        if (l != sizeof(arg_uid_shift)) {
+                                log_error("Short read while recieving UID shift.");
+                                return -EIO;
+                        }
+                }
+
+                log_info("Selected user namespace base " UID_FMT " and range " UID_FMT ".", arg_uid_shift, arg_uid_range);
         }
 
         /* Turn directory into bind mount */
@@ -2925,6 +2970,61 @@ static int outer_child(
         return 0;
 }
 
+static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) {
+        unsigned n_tries = 100;
+        uid_t candidate;
+        int r;
+
+        assert(shift);
+        assert(ret_lock_file);
+        assert(arg_uid_shift_pick);
+        assert(arg_uid_range == 0x10000U);
+
+        candidate = *shift;
+
+        (void) mkdir("/run/systemd/nspawn-uid", 0755);
+
+        for (;;) {
+                char lock_path[strlen("/run/systemd/nspawn-uid/") + DECIMAL_STR_MAX(uid_t) + 1];
+                _cleanup_release_lock_file_ LockFile lf = LOCK_FILE_INIT;
+
+                if (--n_tries <= 0)
+                        return -EBUSY;
+
+                if (candidate < UID_SHIFT_PICK_MIN || candidate > UID_SHIFT_PICK_MAX)
+                        goto next;
+                if ((candidate & UINT32_C(0xFFFF)) != 0)
+                        goto next;
+
+                xsprintf(lock_path, "/run/systemd/nspawn-uid/" UID_FMT, candidate);
+                r = make_lock_file(lock_path, LOCK_EX|LOCK_NB, &lf);
+                if (r == -EBUSY) /* Range already taken by another nspawn instance */
+                        goto next;
+                if (r < 0)
+                        return r;
+
+                /* Make some superficial checks whether the range is currently known in the user database */
+                if (getpwuid(candidate))
+                        goto next;
+                if (getpwuid(candidate + UINT32_C(0xFFFE)))
+                        goto next;
+                if (getgrgid(candidate))
+                        goto next;
+                if (getgrgid(candidate + UINT32_C(0xFFFE)))
+                        goto next;
+
+                *ret_lock_file = lf;
+                lf = (struct LockFile) LOCK_FILE_INIT;
+                *shift = candidate;
+                return 0;
+
+        next:
+                random_bytes(&candidate, sizeof(candidate));
+                candidate = (candidate % (UID_SHIFT_PICK_MAX - UID_SHIFT_PICK_MIN)) + UID_SHIFT_PICK_MIN;
+                candidate &= (uid_t) UINT32_C(0xFFFF0000);
+        }
+}
+
 static int setup_uid_map(pid_t pid) {
         char uid_map[strlen("/proc//uid_map") + DECIMAL_STR_MAX(uid_t) + 1], line[DECIMAL_STR_MAX(uid_t)*3+3+1];
         int r;
@@ -3394,20 +3494,42 @@ int main(int argc, char *argv[]) {
         }
 
         for (;;) {
-                _cleanup_close_pair_ int kmsg_socket_pair[2] = { -1, -1 }, rtnl_socket_pair[2] = { -1, -1 },
-                        pid_socket_pair[2] = { -1, -1 }, uuid_socket_pair[2] = { -1, -1 }, uid_shift_socket_pair[2] = { -1, -1 };
-                ContainerStatus container_status;
-                _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
                 static const struct sigaction sa = {
                         .sa_handler = nop_signal_handler,
                         .sa_flags = SA_NOCLDSTOP,
                 };
-                int ifi = 0;
-                ssize_t l;
+
+                _cleanup_release_lock_file_ LockFile uid_shift_lock = LOCK_FILE_INIT;
+                _cleanup_close_ int etc_passwd_lock = -1;
+                _cleanup_close_pair_ int
+                        kmsg_socket_pair[2] = { -1, -1 },
+                        rtnl_socket_pair[2] = { -1, -1 },
+                        pid_socket_pair[2] = { -1, -1 },
+                        uuid_socket_pair[2] = { -1, -1 },
+                        uid_shift_socket_pair[2] = { -1, -1 };
+                _cleanup_(barrier_destroy) Barrier barrier = BARRIER_NULL;
                 _cleanup_(sd_event_unrefp) sd_event *event = NULL;
                 _cleanup_(pty_forward_freep) PTYForward *forward = NULL;
                 _cleanup_(sd_netlink_unrefp) sd_netlink *rtnl = NULL;
+                ContainerStatus container_status;
                 char last_char = 0;
+                int ifi = 0;
+                ssize_t l;
+
+                if (arg_uid_shift_pick) {
+                        /* When we shall pick the UID/GID range, let's first lock /etc/passwd, so that we can safely
+                         * check with getpwuid() if the specific user already exists. Note that /etc might be
+                         * read-only, in which case this will fail with EROFS. But that's really OK, as in that case we
+                         * can be reasonably sure that no users are going to be added. Note that getpwuid() checks are
+                         * really just an extra safety net. We kinda assume that the UID range we allocate from is
+                         * really ours. */
+
+                        etc_passwd_lock = take_etc_passwd_lock(NULL);
+                        if (etc_passwd_lock < 0 && etc_passwd_lock != -EROFS) {
+                                log_error_errno(r, "Failed to take /etc/passwd lock: %m");
+                                goto finish;
+                        }
+                }
 
                 r = barrier_create(&barrier);
                 if (r < 0) {
@@ -3511,6 +3633,43 @@ int main(int argc, char *argv[]) {
                 uuid_socket_pair[1] = safe_close(uuid_socket_pair[1]);
                 uid_shift_socket_pair[1] = safe_close(uid_shift_socket_pair[1]);
 
+                if (arg_userns) {
+                        /* The child just let us know the UID shift it might have read from the image. */
+                        l = recv(uid_shift_socket_pair[0], &arg_uid_shift, sizeof(arg_uid_shift), 0);
+                        if (l < 0) {
+                                r = log_error_errno(errno, "Failed to read UID shift: %m");
+                                goto finish;
+                        }
+                        if (l != sizeof(arg_uid_shift)) {
+                                log_error("Short read while reading UID shift.");
+                                r = EIO;
+                                goto finish;
+                        }
+
+                        if (arg_uid_shift_pick) {
+                                /* If we are supposed to pick the UID shift, let's try to use the shift read from the
+                                 * image, but if that's already in use, pick a new one, and report back to the child,
+                                 * which one we now picked. */
+
+                                r = uid_shift_pick(&arg_uid_shift, &uid_shift_lock);
+                                if (r < 0) {
+                                        log_error_errno(r, "Failed to pick suitable UID/GID range: %m");
+                                        goto finish;
+                                }
+
+                                l = send(uid_shift_socket_pair[0], &arg_uid_shift, sizeof(arg_uid_shift), MSG_NOSIGNAL);
+                                if (l < 0) {
+                                        r = log_error_errno(errno, "Failed to send UID shift: %m");
+                                        goto finish;
+                                }
+                                if (l != sizeof(arg_uid_shift)) {
+                                        log_error("Short write while writing UID shift.");
+                                        r = -EIO;
+                                        goto finish;
+                                }
+                        }
+                }
+
                 /* Wait for the outer child. */
                 r = wait_for_terminate_and_warn("namespace helper", pid, NULL);
                 if (r < 0)
@@ -3554,17 +3713,6 @@ int main(int argc, char *argv[]) {
                                 goto finish;
                         }
 
-                        l = recv(uid_shift_socket_pair[0], &arg_uid_shift, sizeof(arg_uid_shift), 0);
-                        if (l < 0) {
-                                r = log_error_errno(errno, "Failed to read UID shift: %m");
-                                goto finish;
-                        }
-                        if (l != sizeof(arg_uid_shift)) {
-                                log_error("Short read while reading UID shift.");
-                                r = EIO;
-                                goto finish;
-                        }
-
                         r = setup_uid_map(pid);
                         if (r < 0)
                                 goto finish;
@@ -3662,6 +3810,10 @@ int main(int argc, char *argv[]) {
                         goto finish;
                 }
 
+                /* At this point we have made use of the UID we picked, and thus nss-mymachines will make them appear
+                 * in getpwuid(), thus we can release the /etc/passwd lock. */
+                etc_passwd_lock = safe_close(etc_passwd_lock);
+
                 sd_notifyf(false,
                            "READY=1\n"
                            "STATUS=Container running.\n"