2

Building off of this issue

I have modified a golang program whose intention is to start a new root process and execute a command using /bin/sudo to be the following:

        if rootless.IsRootless() && scpOpts.Root {
            syscall.Setuid(0)
            syscall.Setgid(0)
            var out bytes.Buffer
            var stderr bytes.Buffer
            cred := &syscall.Credential{0, 0, []uint32{}, false}
            sys := &syscall.SysProcAttr{Credential: cred, Setpgid: true, GidMappingsEnableSetgroups: true,
                Cloneflags: syscall.CLONE_NEWNS |
                    syscall.CLONE_NEWUTS |
                    syscall.CLONE_NEWIPC |
                    syscall.CLONE_NEWPID |
                    syscall.CLONE_NEWNET |
                    syscall.CLONE_NEWUSER,
                UidMappings: []syscall.SysProcIDMap{
                    {
                        ContainerID: 0,
                        HostID:      syscall.Getuid(),
                        Size:        1,
                    },
                    {
                        ContainerID: 1,
                        HostID:      0,
                        Size:        1,
                    },
                },
                GidMappings: []syscall.SysProcIDMap{
                    {
                        ContainerID: 0,
                        HostID:      syscall.Getgid(),
                        Size:        1,
                    },
                    {
                        ContainerID: 1,
                        HostID:      0,
                        Size:        1,
                    },
                },
            }
            cmd := exec.Command("/usr/bin/sudo", "podman", "image", "load", "--input="+scpOpts.Save.Output)
            fmt.Println(cmd.Args)
            cmd.SysProcAttr = sys
            cmd.Stdout = &out
            cmd.Env = os.Environ()
            cmd.Stderr = &stderr
            err = cmd.Run()
            if err != nil {
                fmt.Println(fmt.Sprint(err) + ": " + stderr.String())
                return
            }
            fmt.Println("Result: " + out.String())

        }

/bin/sudo is accepted and I am allowed to execute it, but I am getting an error that says fork/exec /usr/bin/sudo: invalid argument: which I have realized means that the syscall.CLONE_NEWUSER flag is causing some issues. IS there any way to make this work or am I doing something wrong with my mappings?

cbd123
  • 41
  • 3

0 Answers0