shared/idmap/idmapset_linux.go
func DefaultIdmapSet(rootfs string, username string) (*IdmapSet, error) {
	idmapset := new(IdmapSet)

	if username == "" {
		currentUser, err := user.Current()
		if err != nil {
			return nil, err
		}

		username = currentUser.Username
	}

	// Check if shadow's uidmap tools are installed
	subuidPath := path.Join(rootfs, "/etc/subuid")
	subgidPath := path.Join(rootfs, "/etc/subgid")
	if shared.PathExists(subuidPath) && shared.PathExists(subgidPath) {
		// Parse the shadow uidmap
		entries, err := getFromShadow(subuidPath, username)
		if err != nil {
			return nil, err
		}

		for _, entry := range entries {
			// Check that it's big enough to be useful
			if int(entry[1]) < 65536 {
				continue
			}

			e := IdmapEntry{Isuid: true, Nsid: 0, Hostid: entry[0], Maprange: entry[1]}
			idmapset.Idmap = Extend(idmapset.Idmap, e)

			// NOTE: Remove once LXD can deal with multiple shadow maps
			break
		}

		// Parse the shadow gidmap
		entries, err = getFromShadow(subgidPath, username)
		if err != nil {
			return nil, err
		}

		for _, entry := range entries {
			// Check that it's big enough to be useful
			if int(entry[1]) < 65536 {
				continue
			}

			e := IdmapEntry{Isgid: true, Nsid: 0, Hostid: entry[0], Maprange: entry[1]}
			idmapset.Idmap = Extend(idmapset.Idmap, e)

			// NOTE: Remove once LXD can deal with multiple shadow maps
			break
		}

		return idmapset, nil
	}

	// No shadow available, figure out a default map
	kernelMap, err := CurrentIdmapSet()
	if err != nil {
		// Hardcoded fallback map
		e := IdmapEntry{Isuid: true, Isgid: false, Nsid: 0, Hostid: 1000000, Maprange: 1000000000}
		idmapset.Idmap = Extend(idmapset.Idmap, e)

		e = IdmapEntry{Isuid: false, Isgid: true, Nsid: 0, Hostid: 1000000, Maprange: 1000000000}
		idmapset.Idmap = Extend(idmapset.Idmap, e)
		return idmapset, nil
	}

	// Look for mapped ranges
	kernelRanges, err := kernelMap.ValidRanges()
	if err != nil {
		return nil, err
	}

	// Special case for when we have the full kernel range
	fullKernelRanges := []*IdRange{
		{true, false, int64(0), int64(4294967294)},
		{false, true, int64(0), int64(4294967294)}}

	if reflect.DeepEqual(kernelRanges, fullKernelRanges) {
		// Hardcoded fallback map
		e := IdmapEntry{Isuid: true, Isgid: false, Nsid: 0, Hostid: 1000000, Maprange: 1000000000}
		idmapset.Idmap = Extend(idmapset.Idmap, e)

		e = IdmapEntry{Isuid: false, Isgid: true, Nsid: 0, Hostid: 1000000, Maprange: 1000000000}
		idmapset.Idmap = Extend(idmapset.Idmap, e)
		return idmapset, nil
	}

	// Find a suitable uid range
	for _, entry := range kernelRanges {
		// We only care about uids right now
		if !entry.Isuid {
			continue
		}

		// We want a map that's separate from the system's own POSIX allocation
		if entry.Endid < 100000 {
			continue
		}

		// Don't use the first 65536 ids
		if entry.Startid < 100000 {
			entry.Startid = 100000
		}

		// Check if we have enough ids
		if entry.Endid-entry.Startid < 65536 {
			continue
		}

		// Add the map
		e := IdmapEntry{Isuid: true, Isgid: false, Nsid: 0, Hostid: entry.Startid, Maprange: entry.Endid - entry.Startid + 1}
		idmapset.Idmap = Extend(idmapset.Idmap, e)

		// NOTE: Remove once LXD can deal with multiple shadow maps
		break
	}

	// Find a suitable gid range
	for _, entry := range kernelRanges {
		// We only care about gids right now
		if !entry.Isgid {
			continue
		}

		// We want a map that's separate from the system's own POSIX allocation
		if entry.Endid < 100000 {
			continue
		}

		// Don't use the first 65536 ids
		if entry.Startid < 100000 {
			entry.Startid = 100000
		}

		// Check if we have enough ids
		if entry.Endid-entry.Startid < 65536 {
			continue
		}

		// Add the map
		e := IdmapEntry{Isuid: false, Isgid: true, Nsid: 0, Hostid: entry.Startid, Maprange: entry.Endid - entry.Startid + 1}
		idmapset.Idmap = Extend(idmapset.Idmap, e)

		// NOTE: Remove once LXD can deal with multiple shadow maps
		break
	}

	return idmapset, nil
}
func DefaultIdmapSet(rootfs string, username string) (*IdmapSet, error) {
	idmapset := new(IdmapSet)

	if username == "" {
		currentUser, err := user.Current()
		if err != nil {
			return nil, err
		}

		username = currentUser.Username
	}

	// Check if shadow's uidmap tools are installed
	subuidPath := path.Join(rootfs, "/etc/subuid")
	subgidPath := path.Join(rootfs, "/etc/subgid")
	if shared.PathExists(subuidPath) && shared.PathExists(subgidPath) {
		// Parse the shadow uidmap
		entries, err := getFromShadow(subuidPath, username)
		if err != nil {
			return nil, err
		}

		for _, entry := range entries {
			// Check that it's big enough to be useful
			if int(entry[1]) < 65536 {
				continue
			}

			e := IdmapEntry{Isuid: true, Nsid: 0, Hostid: entry[0], Maprange: entry[1]}
			idmapset.Idmap = Extend(idmapset.Idmap, e)

			// NOTE: Remove once LXD can deal with multiple shadow maps
			break
		}

		// Parse the shadow gidmap
		entries, err = getFromShadow(subgidPath, username)
		if err != nil {
			return nil, err
		}

		for _, entry := range entries {
			// Check that it's big enough to be useful
			if int(entry[1]) < 65536 {
				continue
			}

			e := IdmapEntry{Isgid: true, Nsid: 0, Hostid: entry[0], Maprange: entry[1]}
			idmapset.Idmap = Extend(idmapset.Idmap, e)

			// NOTE: Remove once LXD can deal with multiple shadow maps
			break
		}

		return idmapset, nil
	}

	// No shadow available, figure out a default map
	kernelMap, err := CurrentIdmapSet()
	if err != nil {
		// Hardcoded fallback map
		e := IdmapEntry{Isuid: true, Isgid: false, Nsid: 0, Hostid: 1000000, Maprange: 1000000000}
		idmapset.Idmap = Extend(idmapset.Idmap, e)

		e = IdmapEntry{Isuid: false, Isgid: true, Nsid: 0, Hostid: 1000000, Maprange: 1000000000}
		idmapset.Idmap = Extend(idmapset.Idmap, e)
		return idmapset, nil
	}

	// Look for mapped ranges
	kernelRanges, err := kernelMap.ValidRanges()
	if err != nil {
		return nil, err
	}

	// Special case for when we have the full kernel range
	fullKernelRanges := []*IdRange{
		{true, false, int64(0), int64(4294967294)},
		{false, true, int64(0), int64(4294967294)}}

	if reflect.DeepEqual(kernelRanges, fullKernelRanges) {
		// Hardcoded fallback map
		e := IdmapEntry{Isuid: true, Isgid: false, Nsid: 0, Hostid: 1000000, Maprange: 1000000000}
		idmapset.Idmap = Extend(idmapset.Idmap, e)

		e = IdmapEntry{Isuid: false, Isgid: true, Nsid: 0, Hostid: 1000000, Maprange: 1000000000}
		idmapset.Idmap = Extend(idmapset.Idmap, e)
		return idmapset, nil
	}

	// Find a suitable uid range
	for _, entry := range kernelRanges {
		// We only care about uids right now
		if !entry.Isuid {
			continue
		}

		// We want a map that's separate from the system's own POSIX allocation
		if entry.Endid < 100000 {
			continue
		}

		// Don't use the first 65536 ids
		if entry.Startid < 100000 {
			entry.Startid = 100000
		}

		// Check if we have enough ids
		if entry.Endid-entry.Startid < 65536 {
			continue
		}

		// Add the map
		e := IdmapEntry{Isuid: true, Isgid: false, Nsid: 0, Hostid: entry.Startid, Maprange: entry.Endid - entry.Startid + 1}
		idmapset.Idmap = Extend(idmapset.Idmap, e)

		// NOTE: Remove once LXD can deal with multiple shadow maps
		break
	}

	// Find a suitable gid range
	for _, entry := range kernelRanges {
		// We only care about gids right now
		if !entry.Isgid {
			continue
		}

		// We want a map that's separate from the system's own POSIX allocation
		if entry.Endid < 100000 {
			continue
		}

		// Don't use the first 65536 ids
		if entry.Startid < 100000 {
			entry.Startid = 100000
		}

		// Check if we have enough ids
		if entry.Endid-entry.Startid < 65536 {
			continue
		}

		// Add the map
		e := IdmapEntry{Isuid: false, Isgid: true, Nsid: 0, Hostid: entry.Startid, Maprange: entry.Endid - entry.Startid + 1}
		idmapset.Idmap = Extend(idmapset.Idmap, e)

		// NOTE: Remove once LXD can deal with multiple shadow maps
		break
	}

	return idmapset, nil
}
func DefaultIdmapSet ( rootfs string , username string ) ( * IdmapSet , error ) { idmapset := new ( IdmapSet ) if username == " " { currentUser , err := user . Current ( ) if err != nil { return nil , err } username = currentUser . Username } // Check if shadow's uidmap tools are installed subuidPath := path . Join ( rootfs , " " ) subgidPath := path . Join ( rootfs , " " ) if shared . PathExists ( subuidPath ) && shared . PathExists ( subgidPath ) { // Parse the shadow uidmap entries , err := getFromShadow ( subuidPath , username ) if err != nil { return nil , err } for _ , entry := range entries { // Check that it's big enough to be useful if int ( entry [ 1 ] ) < 65536 { continue } e := IdmapEntry { Isuid : true , Nsid : 0 , Hostid : entry [ 0 ] , Maprange : entry [ 1 ] } idmapset . Idmap = Extend ( idmapset . Idmap , e ) // NOTE: Remove once LXD can deal with multiple shadow maps break } // Parse the shadow gidmap entries , err = getFromShadow ( subgidPath , username ) if err != nil { return nil , err } for _ , entry := range entries { // Check that it's big enough to be useful if int ( entry [ 1 ] ) < 65536 { continue } e := IdmapEntry { Isgid : true , Nsid : 0 , Hostid : entry [ 0 ] , Maprange : entry [ 1 ] } idmapset . Idmap = Extend ( idmapset . Idmap , e ) // NOTE: Remove once LXD can deal with multiple shadow maps break } return idmapset , nil } // No shadow available, figure out a default map kernelMap , err := CurrentIdmapSet ( ) if err != nil { // Hardcoded fallback map e := IdmapEntry { Isuid : true , Isgid : false , Nsid : 0 , Hostid : 1000000 , Maprange : 1000000000 } idmapset . Idmap = Extend ( idmapset . Idmap , e ) e = IdmapEntry { Isuid : false , Isgid : true , Nsid : 0 , Hostid : 1000000 , Maprange : 1000000000 } idmapset . Idmap = Extend ( idmapset . Idmap , e ) return idmapset , nil } // Look for mapped ranges kernelRanges , err := kernelMap . ValidRanges ( ) if err != nil { return nil , err } // Special case for when we have the full kernel range fullKernelRanges := [ ] * IdRange { { true , false , int64 ( 0 ) , int64 ( 4294967294 ) } , { false , true , int64 ( 0 ) , int64 ( 4294967294 ) } } if reflect . DeepEqual ( kernelRanges , fullKernelRanges ) { // Hardcoded fallback map e := IdmapEntry { Isuid : true , Isgid : false , Nsid : 0 , Hostid : 1000000 , Maprange : 1000000000 } idmapset . Idmap = Extend ( idmapset . Idmap , e ) e = IdmapEntry { Isuid : false , Isgid : true , Nsid : 0 , Hostid : 1000000 , Maprange : 1000000000 } idmapset . Idmap = Extend ( idmapset . Idmap , e ) return idmapset , nil } // Find a suitable uid range for _ , entry := range kernelRanges { // We only care about uids right now if ! entry . Isuid { continue } // We want a map that's separate from the system's own POSIX allocation if entry . Endid < 100000 { continue } // Don't use the first 65536 ids if entry . Startid < 100000 { entry . Startid = 100000 } // Check if we have enough ids if entry . Endid - entry . Startid < 65536 { continue } // Add the map e := IdmapEntry { Isuid : true , Isgid : false , Nsid : 0 , Hostid : entry . Startid , Maprange : entry . Endid - entry . Startid + 1 } idmapset . Idmap = Extend ( idmapset . Idmap , e ) // NOTE: Remove once LXD can deal with multiple shadow maps break } // Find a suitable gid range for _ , entry := range kernelRanges { // We only care about gids right now if ! entry . Isgid { continue } // We want a map that's separate from the system's own POSIX allocation if entry . Endid < 100000 { continue } // Don't use the first 65536 ids if entry . Startid < 100000 { entry . Startid = 100000 } // Check if we have enough ids if entry . Endid - entry . Startid < 65536 { continue } // Add the map e := IdmapEntry { Isuid : false , Isgid : true , Nsid : 0 , Hostid : entry . Startid , Maprange : entry . Endid - entry . Startid + 1 } idmapset . Idmap = Extend ( idmapset . Idmap , e ) // NOTE: Remove once LXD can deal with multiple shadow maps break } return idmapset , nil }
/*
 * Create a new default idmap
 */
/ * Create a new default idmap