diff --git a/.golangci.yml b/.golangci.yml index 9de8d3a65cc4..044df56b2ec0 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -52,8 +52,12 @@ linters-settings: desc: The containerd errdefs package was migrated to a separate module. Use github.com/containerd/errdefs instead. - pkg: "github.com/containerd/containerd/log" desc: The containerd log package was migrated to a separate module. Use github.com/containerd/log instead. + - pkg: "github.com/containerd/containerd/pkg/userns" + desc: Use github.com/moby/sys/user/userns instead. - pkg: "github.com/containerd/containerd/platforms" desc: The containerd platforms package was migrated to a separate module. Use github.com/containerd/platforms instead. + - pkg: "github.com/opencontainers/runc/libcontainer/userns" + desc: Use github.com/moby/sys/user/userns instead. - pkg: "io/ioutil" desc: The io/ioutil package has been deprecated. forbidigo: diff --git a/cache/refs.go b/cache/refs.go index 08a38818a795..714380635d48 100644 --- a/cache/refs.go +++ b/cache/refs.go @@ -15,7 +15,6 @@ import ( "github.com/containerd/containerd/labels" "github.com/containerd/containerd/leases" "github.com/containerd/containerd/mount" - "github.com/containerd/containerd/pkg/userns" "github.com/containerd/containerd/snapshots" cerrdefs "github.com/containerd/errdefs" "github.com/docker/docker/pkg/idtools" @@ -34,6 +33,7 @@ import ( rootlessmountopts "github.com/moby/buildkit/util/rootless/mountopts" "github.com/moby/buildkit/util/winlayers" "github.com/moby/sys/mountinfo" + "github.com/moby/sys/user/userns" digest "github.com/opencontainers/go-digest" ocispecs "github.com/opencontainers/image-spec/specs-go/v1" "github.com/pkg/errors" diff --git a/cmd/buildkitd/main.go b/cmd/buildkitd/main.go index 6e6d2ad17db5..ec79a1db850b 100644 --- a/cmd/buildkitd/main.go +++ b/cmd/buildkitd/main.go @@ -16,7 +16,6 @@ import ( "sync" "github.com/containerd/containerd/defaults" - "github.com/containerd/containerd/pkg/userns" "github.com/containerd/containerd/remotes/docker" "github.com/containerd/containerd/sys" "github.com/containerd/platforms" @@ -58,6 +57,7 @@ import ( "github.com/moby/buildkit/util/tracing/transform" "github.com/moby/buildkit/version" "github.com/moby/buildkit/worker" + "github.com/moby/sys/user/userns" ocispecs "github.com/opencontainers/image-spec/specs-go/v1" "github.com/pkg/errors" "github.com/sirupsen/logrus" diff --git a/cmd/buildkitd/main_containerd_worker.go b/cmd/buildkitd/main_containerd_worker.go index f59b0c9a9e93..124e86d1830c 100644 --- a/cmd/buildkitd/main_containerd_worker.go +++ b/cmd/buildkitd/main_containerd_worker.go @@ -14,7 +14,6 @@ import ( ctd "github.com/containerd/containerd" "github.com/containerd/containerd/defaults" - "github.com/containerd/containerd/pkg/userns" "github.com/moby/buildkit/cmd/buildkitd/config" "github.com/moby/buildkit/util/bklog" "github.com/moby/buildkit/util/network/cniprovider" @@ -22,6 +21,7 @@ import ( "github.com/moby/buildkit/worker" "github.com/moby/buildkit/worker/base" "github.com/moby/buildkit/worker/containerd" + "github.com/moby/sys/user/userns" "github.com/pelletier/go-toml" "github.com/pkg/errors" "github.com/urfave/cli" diff --git a/cmd/buildkitd/main_oci_worker.go b/cmd/buildkitd/main_oci_worker.go index 2445217a868e..984eb220ddf7 100644 --- a/cmd/buildkitd/main_oci_worker.go +++ b/cmd/buildkitd/main_oci_worker.go @@ -16,7 +16,6 @@ import ( snapshotsapi "github.com/containerd/containerd/api/services/snapshots/v1" "github.com/containerd/containerd/defaults" "github.com/containerd/containerd/pkg/dialer" - "github.com/containerd/containerd/pkg/userns" "github.com/containerd/containerd/reference" "github.com/containerd/containerd/remotes/docker" ctdsnapshot "github.com/containerd/containerd/snapshots" @@ -40,6 +39,7 @@ import ( "github.com/moby/buildkit/worker" "github.com/moby/buildkit/worker/base" "github.com/moby/buildkit/worker/runc" + "github.com/moby/sys/user/userns" "github.com/pelletier/go-toml" "github.com/pkg/errors" "github.com/sirupsen/logrus" diff --git a/executor/oci/spec.go b/executor/oci/spec.go index 8164fc9ae7b3..e9ab98796088 100644 --- a/executor/oci/spec.go +++ b/executor/oci/spec.go @@ -13,7 +13,6 @@ import ( "github.com/containerd/containerd/mount" "github.com/containerd/containerd/namespaces" "github.com/containerd/containerd/oci" - "github.com/containerd/containerd/pkg/userns" "github.com/docker/docker/pkg/idtools" "github.com/mitchellh/hashstructure/v2" "github.com/moby/buildkit/executor" @@ -21,6 +20,7 @@ import ( "github.com/moby/buildkit/util/network" rootlessmountopts "github.com/moby/buildkit/util/rootless/mountopts" traceexec "github.com/moby/buildkit/util/tracing/exec" + "github.com/moby/sys/user/userns" specs "github.com/opencontainers/runtime-spec/specs-go" "github.com/opencontainers/selinux/go-selinux" "github.com/pkg/errors" diff --git a/go.mod b/go.mod index 3c28cc8c0b19..b703c8502df2 100644 --- a/go.mod +++ b/go.mod @@ -53,7 +53,7 @@ require ( github.com/moby/patternmatcher v0.6.0 github.com/moby/sys/mountinfo v0.7.1 github.com/moby/sys/signal v0.7.0 - github.com/moby/sys/user v0.1.0 + github.com/moby/sys/user v0.2.0 github.com/morikuni/aec v1.0.0 github.com/opencontainers/go-digest v1.0.0 github.com/opencontainers/image-spec v1.1.0 diff --git a/go.sum b/go.sum index d0cf8dac495d..d34d6565006f 100644 --- a/go.sum +++ b/go.sum @@ -296,8 +296,8 @@ github.com/moby/sys/sequential v0.5.0 h1:OPvI35Lzn9K04PBbCLW0g4LcFAJgHsvXsRyewg5 github.com/moby/sys/sequential v0.5.0/go.mod h1:tH2cOOs5V9MlPiXcQzRC+eEyab644PWKGRYaaV5ZZlo= github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI= github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg= -github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg= -github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU= +github.com/moby/sys/user v0.2.0 h1:OnpapJsRp25vkhw8TFG6OLJODNh/3rEwRWtJ3kakwRM= +github.com/moby/sys/user v0.2.0/go.mod h1:RYstrcWOJpVh+6qzUqp2bU3eaRpdiQeKGlKitaH0PM8= github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0= github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= diff --git a/snapshot/localmounter_linux.go b/snapshot/localmounter_linux.go index 7c7848497490..bbb447ad6256 100644 --- a/snapshot/localmounter_linux.go +++ b/snapshot/localmounter_linux.go @@ -6,8 +6,8 @@ import ( "syscall" "github.com/containerd/containerd/mount" - "github.com/containerd/containerd/pkg/userns" rootlessmountopts "github.com/moby/buildkit/util/rootless/mountopts" + "github.com/moby/sys/user/userns" "github.com/pkg/errors" ) diff --git a/snapshot/merge.go b/snapshot/merge.go index 2d589087c8ec..9f9b8f310579 100644 --- a/snapshot/merge.go +++ b/snapshot/merge.go @@ -5,11 +5,11 @@ import ( "strconv" "github.com/containerd/containerd/leases" - "github.com/containerd/containerd/pkg/userns" "github.com/containerd/containerd/snapshots" "github.com/moby/buildkit/identity" "github.com/moby/buildkit/util/bklog" "github.com/moby/buildkit/util/leaseutil" + "github.com/moby/sys/user/userns" "github.com/pkg/errors" ) diff --git a/snapshot/snapshotter.go b/snapshot/snapshotter.go index 089479991183..830ce4679be2 100644 --- a/snapshot/snapshotter.go +++ b/snapshot/snapshotter.go @@ -7,10 +7,10 @@ import ( "sync" "github.com/containerd/containerd/mount" - "github.com/containerd/containerd/pkg/userns" "github.com/containerd/containerd/snapshots" "github.com/docker/docker/pkg/idtools" "github.com/moby/buildkit/executor" + "github.com/moby/sys/user/userns" "github.com/pkg/errors" ) diff --git a/solver/llbsolver/mounts/mount.go b/solver/llbsolver/mounts/mount.go index 90acbd44bc12..41c8cff019cf 100644 --- a/solver/llbsolver/mounts/mount.go +++ b/solver/llbsolver/mounts/mount.go @@ -11,7 +11,6 @@ import ( "github.com/moby/buildkit/util/bklog" "github.com/containerd/containerd/mount" - "github.com/containerd/containerd/pkg/userns" "github.com/docker/docker/pkg/idtools" "github.com/moby/buildkit/cache" "github.com/moby/buildkit/client" @@ -23,6 +22,7 @@ import ( "github.com/moby/buildkit/solver/pb" "github.com/moby/buildkit/util/grpcerrors" "github.com/moby/locker" + "github.com/moby/sys/user/userns" "github.com/pkg/errors" "google.golang.org/grpc/codes" ) diff --git a/util/entitlements/security/security_linux.go b/util/entitlements/security/security_linux.go index 9ab9398013ab..b4f64ff228f8 100644 --- a/util/entitlements/security/security_linux.go +++ b/util/entitlements/security/security_linux.go @@ -9,8 +9,8 @@ import ( "github.com/containerd/containerd/containers" "github.com/containerd/containerd/oci" "github.com/containerd/containerd/pkg/cap" - "github.com/containerd/containerd/pkg/userns" "github.com/moby/buildkit/util/bklog" + "github.com/moby/sys/user/userns" specs "github.com/opencontainers/runtime-spec/specs-go" "github.com/pkg/errors" "golang.org/x/sys/unix" diff --git a/vendor/github.com/moby/sys/user/user.go b/vendor/github.com/moby/sys/user/user.go index 984466d1ab59..198c49367953 100644 --- a/vendor/github.com/moby/sys/user/user.go +++ b/vendor/github.com/moby/sys/user/user.go @@ -197,7 +197,6 @@ func ParseGroupFilter(r io.Reader, filter func(Group) bool) ([]Group, error) { for { var line []byte line, isPrefix, err = rd.ReadLine() - if err != nil { // We should return no error if EOF is reached // without a match. diff --git a/vendor/github.com/moby/sys/user/userns/userns.go b/vendor/github.com/moby/sys/user/userns/userns.go new file mode 100644 index 000000000000..56b24c44ad0d --- /dev/null +++ b/vendor/github.com/moby/sys/user/userns/userns.go @@ -0,0 +1,16 @@ +// Package userns provides utilities to detect whether we are currently running +// in a Linux user namespace. +// +// This code was migrated from [libcontainer/runc], which based its implementation +// on code from [lcx/incus]. +// +// [libcontainer/runc]: https://github.com/opencontainers/runc/blob/3778ae603c706494fd1e2c2faf83b406e38d687d/libcontainer/userns/userns_linux.go#L12-L49 +// [lcx/incus]: https://github.com/lxc/incus/blob/e45085dd42f826b3c8c3228e9733c0b6f998eafe/shared/util.go#L678-L700 +package userns + +// RunningInUserNS detects whether we are currently running in a Linux +// user namespace and memoizes the result. It returns false on non-Linux +// platforms. +func RunningInUserNS() bool { + return inUserNS() +} diff --git a/vendor/github.com/moby/sys/user/userns/userns_linux.go b/vendor/github.com/moby/sys/user/userns/userns_linux.go new file mode 100644 index 000000000000..87c1c38eec27 --- /dev/null +++ b/vendor/github.com/moby/sys/user/userns/userns_linux.go @@ -0,0 +1,53 @@ +package userns + +import ( + "bufio" + "fmt" + "os" + "sync" +) + +var inUserNS = sync.OnceValue(runningInUserNS) + +// runningInUserNS detects whether we are currently running in a user namespace. +// +// This code was migrated from [libcontainer/runc] and based on an implementation +// from [lcx/incus]. +// +// [libcontainer/runc]: https://github.com/opencontainers/runc/blob/3778ae603c706494fd1e2c2faf83b406e38d687d/libcontainer/userns/userns_linux.go#L12-L49 +// [lcx/incus]: https://github.com/lxc/incus/blob/e45085dd42f826b3c8c3228e9733c0b6f998eafe/shared/util.go#L678-L700 +func runningInUserNS() bool { + file, err := os.Open("/proc/self/uid_map") + if err != nil { + // This kernel-provided file only exists if user namespaces are supported. + return false + } + defer file.Close() + + buf := bufio.NewReader(file) + l, _, err := buf.ReadLine() + if err != nil { + return false + } + + return uidMapInUserNS(string(l)) +} + +func uidMapInUserNS(uidMap string) bool { + if uidMap == "" { + // File exist but empty (the initial state when userns is created, + // see user_namespaces(7)). + return true + } + + var a, b, c int64 + if _, err := fmt.Sscanf(uidMap, "%d %d %d", &a, &b, &c); err != nil { + // Assume we are in a regular, non user namespace. + return false + } + + // As per user_namespaces(7), /proc/self/uid_map of + // the initial user namespace shows 0 0 4294967295. + initNS := a == 0 && b == 0 && c == 4294967295 + return !initNS +} diff --git a/vendor/github.com/moby/sys/user/userns/userns_linux_fuzzer.go b/vendor/github.com/moby/sys/user/userns/userns_linux_fuzzer.go new file mode 100644 index 000000000000..26ba2e16ec4e --- /dev/null +++ b/vendor/github.com/moby/sys/user/userns/userns_linux_fuzzer.go @@ -0,0 +1,8 @@ +//go:build linux && gofuzz + +package userns + +func FuzzUIDMap(uidmap []byte) int { + _ = uidMapInUserNS(string(uidmap)) + return 1 +} diff --git a/vendor/github.com/moby/sys/user/userns/userns_unsupported.go b/vendor/github.com/moby/sys/user/userns/userns_unsupported.go new file mode 100644 index 000000000000..8ed83072c233 --- /dev/null +++ b/vendor/github.com/moby/sys/user/userns/userns_unsupported.go @@ -0,0 +1,6 @@ +//go:build !linux + +package userns + +// inUserNS is a stub for non-Linux systems. Always returns false. +func inUserNS() bool { return false } diff --git a/vendor/modules.txt b/vendor/modules.txt index f83f14e9ebe5..6147af75ce65 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -673,9 +673,10 @@ github.com/moby/sys/sequential # github.com/moby/sys/signal v0.7.0 ## explicit; go 1.16 github.com/moby/sys/signal -# github.com/moby/sys/user v0.1.0 -## explicit; go 1.17 +# github.com/moby/sys/user v0.2.0 +## explicit; go 1.21 github.com/moby/sys/user +github.com/moby/sys/user/userns # github.com/moby/term v0.5.0 ## explicit; go 1.18 # github.com/morikuni/aec v1.0.0