3c488585bd
According to PEP 394, the python command is meant to be Python 2 until at least 2020, so in practice this script will be run with Python 2 for now (except on Arch Linux); but it seems good to be more future-proof. In Python 3, os.write() takes a bytestring (bytes object), not a text string (str/unicode object). In Python 2 ≥ 2.6, the b'' syntax is supported and gives a str object, because that was a bytestring in Python 2; either way, b'1' is an acceptable argument to os.write(). In Python ≥ 3.4, the result of os.pipe() is close-on-exec (non-inheritable) by default, so undo that where needed. Signed-off-by: Simon McVittie <smcv@collabora.com> Closes: #246 Approved by: giuseppe
41 lines
1011 B
Python
Executable File
41 lines
1011 B
Python
Executable File
#!/usr/bin/env python
|
|
|
|
import os, select, subprocess, sys, json
|
|
|
|
pipe_info = os.pipe()
|
|
userns_block = os.pipe()
|
|
|
|
pid = os.fork()
|
|
|
|
if pid != 0:
|
|
os.close(pipe_info[1])
|
|
os.close(userns_block[0])
|
|
|
|
select.select([pipe_info[0]], [], [])
|
|
|
|
data = json.load(os.fdopen(pipe_info[0]))
|
|
child_pid = str(data['child-pid'])
|
|
|
|
subprocess.call(["newuidmap", child_pid, "0", str(os.getuid()), "1"])
|
|
subprocess.call(["newgidmap", child_pid, "0", str(os.getgid()), "1"])
|
|
|
|
os.write(userns_block[1], b'1')
|
|
else:
|
|
os.close(pipe_info[0])
|
|
os.close(userns_block[1])
|
|
|
|
if sys.version_info >= (3, 4):
|
|
os.set_inheritable(pipe_info[1], True)
|
|
os.set_inheritable(userns_block[0], True)
|
|
|
|
args = ["bwrap",
|
|
"bwrap",
|
|
"--unshare-all",
|
|
"--unshare-user",
|
|
"--userns-block-fd", "%i" % userns_block[0],
|
|
"--info-fd", "%i" % pipe_info[1],
|
|
"--bind", "/", "/",
|
|
"cat", "/proc/self/uid_map"]
|
|
|
|
os.execlp(*args)
|