mirror of
https://github.com/lxc/incus
synced 2026-08-02 05:26:46 +00:00
5ae0eb29b6
The current uid_map heuristic treats a private user namespace with an identity uid_map as the initial user namespace. systemd 260 can create that shape with PrivateUsers=full, causing callers to believe they can perform initial-namespace-only operations. Use /proc/self/ns/user's inode instead and compare it with the kernel's PROC_USER_INIT_INO value. This detects the initial user namespace directly instead of inferring it from the uid_map layout. Related: https://github.com/containers/crun/issues/2150 Signed-off-by: Alvaro Leiva Geisse <aleivag@gmail.com>
21 lines
395 B
Go
21 lines
395 B
Go
package linux
|
|
|
|
import (
|
|
"syscall"
|
|
)
|
|
|
|
// See PROC_USER_INIT_INO in include/uapi/linux/nsfs.h.
|
|
const procUserInitIno = 0xEFFFFFFD
|
|
|
|
// RunningInUserNS returns true if the current process is running inside a user namespace.
|
|
func RunningInUserNS() bool {
|
|
var st syscall.Stat_t
|
|
|
|
err := syscall.Stat("/proc/self/ns/user", &st)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
|
|
return st.Ino != procUserInitIno
|
|
}
|
