moby / moby/moby

userns: daemon: WithNamespaces lacks validation for joining multiple namespaces

Open
#46,210 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

area/runtime area/security/userns kind/bug
Dominant language
Go
Stars
72.1k
Forks
19.2k
Avg merge
1d 18h
Merged PRs (30d)
164

Description

Description

While working on this code, I noticed that there's currently an issue with userns enabled. When userns is enabled, joining another container's namespace must also join its user-namespace. For example;

https://github.com/moby/moby/blob/a9e8110fe35a50f50b73bb522575a656373fc21b/daemon/oci_linux.go#L295-L299

https://github.com/moby/moby/blob/a9e8110fe35a50f50b73bb522575a656373fc21b/daemon/oci_linux.go#L269-L272

https://github.com/moby/moby/blob/a9e8110fe35a50f50b73bb522575a656373fc21b/daemon/oci_linux.go#L326-L331

However, a container can only be in a single user namespace, so if a container joins namespaces from multiple containers, latter user-namespaces overwrite former ones.
https://github.com/moby/moby/blob/a9e8110fe35a50f50b73bb522575a656373fc21b/daemon/oci_linux.go#L230-L242

We should add validation for this, and handle these cases with a proper error message.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading daemon/oci_linux.go around the linked namespace-joining logic and the WithNamespaces entry point. Trace how multiple container namespaces are processed when userns is enabled. Done means invalid combinations are rejected with a proper error message, with coverage added where the daemon's namespace validation is tested.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.