ceamac
69df728e09
bwrap --uid/--gid require --unshare-user, which is never requested
when running as root (since last session's fix), and user namespaces
aren't a near-term option anyway -- the actual Android target doesn't
support them.
--user <name-or-uid> / --group <name-or-gid> work around this:
user_spec.cpp resolves them against the *mounted image's own*
/etc/passwd and /etc/group (names like "git" only mean anything inside
that image's user database), and bwrap.cpp bind-mounts a small helper
into the sandbox to do the actual privilege drop before exec'ing the
real command, since bwrap itself can't switch uid/gid without a user
namespace.
The helper has to be a separate, statically-linked binary
(priv_drop_helper.cpp -> slocker-lite-priv-drop, built with -static)
rather than slocker_lite's own binary: bind-mounting a dynamically
linked executable into an arbitrary container image fails ("error
while loading shared libraries") since that image's own /lib won't
have slocker_lite's dependencies. find_priv_drop_helper() locates it
next to slocker_lite's own binary; run_bwrap() fails fast if it's
missing rather than silently running as root.
Only works without a user namespace (root): under --unshare-user the
sandbox's uid map has only one valid entry, so the helper's own
setuid() fails cleanly there instead of doing nothing silently.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
39 lines
1.6 KiB
Meson
39 lines
1.6 KiB
Meson
project('slocker-lite', 'cpp',
|
|
version : '0.0.1',
|
|
default_options : ['warning_level=3', 'cpp_std=c++20'])
|
|
|
|
fmt_dep = dependency('fmt')
|
|
catch2_dep = dependency('catch2', required : get_option('enable_tests'))
|
|
yaml_dep = dependency('yaml-0.1')
|
|
archive_dep = dependency('libarchive')
|
|
json_dep = dependency('nlohmann_json')
|
|
spdlog_dep = dependency('spdlog')
|
|
|
|
conf_data = configuration_data()
|
|
conf_data.set_quoted('PACKAGE', meson.project_name())
|
|
conf_data.set_quoted('VERSION', meson.project_version())
|
|
conf_data.set10('ENABLE_TESTS', get_option('enable_tests'))
|
|
|
|
configure_file(output : 'config.h', configuration : conf_data)
|
|
|
|
slocker_lite = executable('slocker_lite',
|
|
['src/main.cpp', 'src/process.cpp', 'src/oci_image.cpp', 'src/containers_storage.cpp',
|
|
'src/bwrap.cpp', 'src/user_spec.cpp'],
|
|
include_directories : include_directories('.'),
|
|
dependencies : [fmt_dep, catch2_dep, yaml_dep, archive_dep, json_dep, spdlog_dep],
|
|
install : true)
|
|
|
|
# Bind-mounted into the sandbox by -r/--run's --user/--group handling (src/bwrap.cpp),
|
|
# so it must be dependency-free and statically linked to run regardless of what
|
|
# libc/libraries the container image itself has.
|
|
priv_drop_helper = executable('slocker-lite-priv-drop',
|
|
['src/priv_drop_helper.cpp'],
|
|
link_args : ['-static'],
|
|
install : true)
|
|
|
|
fixture_tar = custom_target('oci-fixture',
|
|
output : 'fixture.tar',
|
|
command : [find_program('python3'), files('tests/gen_fixture.py'), '@OUTPUT@'])
|
|
|
|
test('test', find_program('python3'), args : [files('tests/run_test.py'), slocker_lite, fixture_tar])
|