Isolation: allowed the use of credentials with unpriv userns.

The setuid/setgid syscalls requires root capabilities but if the kernel
supports unprivileged user namespace then the child process has the full
set of capabilities in the new namespace, then we can allow setting "user"
and "group" in such cases (this is a common security use case).

Tests were added to ensure user gets meaningful error messages for
uid/gid mapping misconfigurations.

1 files changed, 10 insertions, 8 deletions

diff --git a/src/nxt_process.h b/src/nxt_process.h
index 457d2299..343fffb8 100644
--- a/src/nxt_process.h
+++ b/src/nxt_process.h
@@ -7,18 +7,14 @@
 #ifndef _NXT_PROCESS_H_INCLUDED_
 #define _NXT_PROCESS_H_INCLUDED_
 
-#include <nxt_conf.h>
+#if (NXT_HAVE_CLONE)
+#include <nxt_clone.h>
+#endif
 
 
 typedef pid_t            nxt_pid_t;
 
 
-typedef struct {
-    nxt_int_t            flags;
-    nxt_conf_value_t     *uidmap;
-    nxt_conf_value_t     *gidmap;
-} nxt_process_clone_t;
-
 typedef struct nxt_process_init_s  nxt_process_init_t;
 typedef nxt_int_t (*nxt_process_start_t)(nxt_task_t *task, void *data);
 typedef nxt_int_t (*nxt_process_restart_t)(nxt_task_t *task, nxt_runtime_t *rt,
@@ -39,7 +35,9 @@ struct nxt_process_init_s {
     uint32_t                   stream;
 
     union {
-        nxt_process_clone_t    clone;
+#if (NXT_HAVE_CLONE)
+        nxt_clone_t            clone;
+#endif
     } isolation;
 };
 
@@ -118,6 +116,8 @@ nxt_port_t *nxt_process_connected_port_find(nxt_process_t *process,
 void nxt_worker_process_quit_handler(nxt_task_t *task,
     nxt_port_recv_msg_t *msg);
 
+void nxt_init_destroy(nxt_runtime_t *rt, nxt_process_init_t *init);
+
 
 #if (NXT_HAVE_SETPROCTITLE)
 
@@ -146,6 +146,8 @@ NXT_EXPORT void nxt_process_title(nxt_task_t *task, const char *fmt, ...);
 
 NXT_EXPORT extern nxt_pid_t  nxt_pid;
 NXT_EXPORT extern nxt_pid_t  nxt_ppid;
+NXT_EXPORT extern nxt_uid_t  nxt_euid;
+NXT_EXPORT extern nxt_gid_t  nxt_egid;
 NXT_EXPORT extern char       **nxt_process_argv;
 NXT_EXPORT extern char       ***nxt_process_environ;