image: layer unpack: implement user:group unpacking

Use libcontainer/user to parse the /etc/{passwd,group} files inside the
container rootfs to allow us to handle string versions of user:group
specifications.

This also allows us to fill the AdditionalGids fields.

Signed-off-by: Aleksa Sarai <[email protected]>

Author: cyphar

Makefile

@@ -43,15 +43,15 @@ install-deps:
 EPOCH_COMMIT ?= 97ecdbd53dcb72b7a0d62196df281f131dc9eb2f
 validate:
 	@echo "go-fmt"
-	@test -z "$$(gofmt -s -l . | grep -v '^vendor/' | tee /dev/stderr)"
+	@test -z "$$(gofmt -s -l . | grep -v '^vendor/' | grep -v '^third_party/' | tee /dev/stderr)"
 	@echo "go-lint"
-	@out="$$(golint $(PROJECT)/... | grep -v '/vendor/')"; \
+	@out="$$(golint $(PROJECT)/... | grep -v '/vendor/' | grep -v '/third_party/')"; \
 	if [ -n "$$out" ]; then \
 		echo "$$out"; \
 		exit 1; \
 	fi
 	@echo "go-vet"
-	@go vet $(shell go list $(PROJECT)/... | grep -v /vendor/)
+	@go vet $(shell go list $(PROJECT)/... | grep -v /vendor/ | grep -v /third_party/)
 	#@echo "git-validation"
 	#@git-validation -v -run DCO,short-subject,dangling-whitespace $(EPOCH_COMMIT)..HEAD
 

glide.lock

@@ -67,7 +67,7 @@ clean() {
 	unset IFS
 
 	# Files we don't want to delete from *any* directory.
-	local importantfiles=( -name 'LICENSE*' -or -name 'COPYING*' )
+	local importantfiles=( -name 'LICENSE*' -or -name 'COPYING*' -or -name 'NOTICE*' )
 
 	# Delete all top-level files which are not LICENSE or COPYING related, as
 	# well as deleting the actual directory if it's empty.

hack/vendor.sh

@@ -18,9 +18,10 @@
 package generator
 
 import (
-	"strconv"
-	"strings"
+	"fmt"
+	"path/filepath"
 
+	"github.com/cyphar/umoci/third_party/user"
 	"github.com/opencontainers/image-spec/specs-go/v1"
 	rspec "github.com/opencontainers/runtime-spec/specs-go"
 	rgen "github.com/opencontainers/runtime-tools/generate"
@@ -30,18 +31,20 @@ import (
 // configuration appropriate for use, which is templated on the default
 // configuration specified by the OCI runtime-tools. It is equivalent to
 // MutateRuntimeSpec("runtime-tools/generate".New(), image).Spec().
-func ToRuntimeSpec(image v1.Image) rspec.Spec {
+func ToRuntimeSpec(rootfs string, image v1.Image) (rspec.Spec, error) {
 	g := rgen.New()
-	MutateRuntimeSpec(g, image)
-	return *g.Spec()
+	if err := MutateRuntimeSpec(g, rootfs, image); err != nil {
+		return rspec.Spec{}, err
+	}
+	return *g.Spec(), nil
 }
 
 // MutateRuntimeSpec mutates a given runtime specification generator with the
 // image configuration provided. It returns the original generator, and does
 // not modify any fields directly (to allow for chaining).
-func MutateRuntimeSpec(g rgen.Generator, image v1.Image) rgen.Generator {
+func MutateRuntimeSpec(g rgen.Generator, rootfs string, image v1.Image) error {
 	if image.OS != "linux" {
-		panic("unsupported OS")
+		return fmt.Errorf("unsupported OS: %s", image.OS)
 	}
 
 	// FIXME: We need to figure out if we're modifying an incompatible runtime spec.
@@ -50,7 +53,7 @@ func MutateRuntimeSpec(g rgen.Generator, image v1.Image) rgen.Generator {
 	g.SetPlatformArch(image.Architecture)
 
 	g.SetProcessTerminal(true)
-	g.SetRootPath("rootfs") // XXX: Should be configurable.
+	g.SetRootPath(filepath.Base(rootfs))
 	g.SetRootReadonly(false)
 
 	g.SetProcessCwd("/")
@@ -73,23 +76,27 @@ func MutateRuntimeSpec(g rgen.Generator, image v1.Image) rgen.Generator {
 	}
 	g.SetProcessArgs(args)
 
-	if uid, err := strconv.Atoi(image.Config.User); err == nil {
-		g.SetProcessUID(uint32(uid))
-	} else if ug := strings.Split(image.Config.User, ":"); len(ug) == 2 {
-		uid, err := strconv.Atoi(ug[0])
-		if err != nil {
-			panic("config.User: unsupported uid format")
-		}
-
-		gid, err := strconv.Atoi(ug[1])
-		if err != nil {
-			panic("config.User: unsupported gid format")
-		}
+	// Get the *actual* uid and gid of the user. If the image doesn't contain
+	// an /etc/passwd or /etc/group file then GetExecUserPath will just do a
+	// numerical parsing.
+	var passwdPath, groupPath string
+	if rootfs != "" {
+		passwdPath = filepath.Join(rootfs, "/etc/passwd")
+		groupPath = filepath.Join(rootfs, "/etc/group")
+	}
+	execUser, err := user.GetExecUserPath(image.Config.User, nil, passwdPath, groupPath)
+	if err != nil {
+		return fmt.Errorf("cannot parse user spec '%s': %s", image.Config.User, err)
+	}
 
-		g.SetProcessUID(uint32(uid))
-		g.SetProcessGID(uint32(gid))
-	} else if image.Config.User != "" {
-		panic("config.User: unsupported format")
+	g.SetProcessUID(uint32(execUser.Uid))
+	g.SetProcessGID(uint32(execUser.Gid))
+	g.ClearProcessAdditionalGids()
+	for _, gid := range execUser.Sgids {
+		g.AddProcessAdditionalGid(uint32(gid))
+	}
+	if execUser.Home != "" {
+		g.AddProcessEnv("HOME=" + execUser.Home)
 	}
 
 	// TODO: Handle cases where these are unset properly.
@@ -103,5 +110,5 @@ func MutateRuntimeSpec(g rgen.Generator, image v1.Image) rgen.Generator {
 		g.AddBindMount("", vol, []string{"rw", "rbind"})
 	}
 
-	return g
+	return nil
 }

image/generator/runtime.go

@@ -174,9 +174,12 @@ func UnpackManifest(ctx context.Context, engine cas.Engine, bundle string, manif
 		"config": manifest.Config.Digest,
 	}).Infof("unpack manifest: unpacking config")
 
-	g := igen.MutateRuntimeSpec(rgen.New(), *config)
+	g := rgen.New()
+	if err := igen.MutateRuntimeSpec(g, rootfsPath, *config); err != nil {
+		return fmt.Errorf("unpack manifest: generating config.json: %s", err)
+	}
 	if err := g.SaveToFile(configPath, rgen.ExportOptions{}); err != nil {
-		return fmt.Errorf("failed to write new config.json: %q", err)
+		return fmt.Errorf("failed to write new config.json: %s", err)
 	}
 
 	return nil

image/layer/unpack.go

@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2014 Docker, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

third_party/user/LICENSE

@@ -0,0 +1,17 @@
+runc
+
+Copyright 2012-2015 Docker, Inc.
+
+This product includes software developed at Docker, Inc. (http://www.docker.com).
+
+The following is courtesy of our legal counsel:
+
+
+Use and transfer of Docker may be subject to certain restrictions by the
+United States and other governments.
+It is your responsibility to ensure that your use and/or transfer does not
+violate applicable laws.
+
+For more information, please see http://www.bis.doc.gov
+
+See also http://www.apache.org/dev/crypto.html and/or seek legal counsel.

third_party/user/NOTICE

@@ -0,0 +1,7 @@
+## `third_party/user` ##
+![License: Apache 2.0](https://img.shields.io/github/license/opencontainers/runc.svg)
+
+This package is imported from
+`github.com/opencontainers/runc/libcontainer/user`. Currently I can't import
+runC directly because it involves importing `docker` and also causes version
+conflicts. I'm not in the mood to fix that.