Isolation: allowed the use of credentials with unpriv userns.

The setuid/setgid syscalls requires root capabilities but if the kernel
supports unprivileged user namespace then the child process has the full
set of capabilities in the new namespace, then we can allow setting "user"
and "group" in such cases (this is a common security use case).

Tests were added to ensure user gets meaningful error messages for
uid/gid mapping misconfigurations.

1 files changed, 38 insertions, 2 deletions

diff --git a/src/nxt_clone.h b/src/nxt_clone.h
index 50dec0b4..dcccf1db 100644
--- a/src/nxt_clone.h
+++ b/src/nxt_clone.h
@@ -7,11 +7,47 @@
 #define _NXT_CLONE_INCLUDED_
 
 
+#if (NXT_HAVE_CLONE_NEWUSER)
+
+typedef struct {
+    nxt_int_t                   container;
+    nxt_int_t                   host;
+    nxt_int_t                   size;
+} nxt_clone_map_entry_t;
+
+typedef struct {
+    nxt_uint_t                  size;
+    nxt_clone_map_entry_t       *map;
+} nxt_clone_credential_map_t;
+
+#endif
+
+typedef struct {
+    nxt_int_t                   flags;
+
+#if (NXT_HAVE_CLONE_NEWUSER)
+    nxt_clone_credential_map_t  uidmap;
+    nxt_clone_credential_map_t  gidmap;
+#endif
+
+} nxt_clone_t;
+
+
 pid_t nxt_clone(nxt_int_t flags);
 
+
 #if (NXT_HAVE_CLONE_NEWUSER)
-nxt_int_t nxt_clone_proc_map(nxt_task_t *task, pid_t pid,
-        nxt_process_clone_t *clone);
+
+#define NXT_CLONE_USER(flags)                                                 \
+    ((flags & CLONE_NEWUSER) == CLONE_NEWUSER)
+
+NXT_EXPORT nxt_int_t nxt_clone_credential_map(nxt_task_t *task, pid_t pid,
+    nxt_credential_t *creds, nxt_clone_t *clone);
+NXT_EXPORT nxt_int_t nxt_clone_vldt_credential_uidmap(nxt_task_t *task,
+    nxt_clone_credential_map_t *map, nxt_credential_t *creds);
+NXT_EXPORT nxt_int_t nxt_clone_vldt_credential_gidmap(nxt_task_t *task,
+    nxt_clone_credential_map_t *map, nxt_credential_t *creds);
+
 #endif
 
 #endif /* _NXT_CLONE_INCLUDED_ */