Function startProcessWithUsernsLocked

pkg/sys/unshare_linux.go:159–210

startProcessWithUsernsLocked expects the os thread to be locked already. It does 1. setresuid() to the targetHostUID user to attribute further user namespace creations to it 2. sets the thread's effective capabilities back to the original user's to allow writing to /proc/uid_map as well as to create

(targetHostUID int, unshareFlags uintptr, uidMaps, gidMaps []syscall.SysProcIDMap)

// killed, and the thread is *not* setresuid()'ed back to the original user. In this case the
// thread should be killed off by the caller to avoid using a thread in a bad state
func startProcessWithUsernsLocked(targetHostUID int, unshareFlags uintptr, uidMaps, gidMaps []syscall.SysProcIDMap) (int, int, error) {
	originalEUID := os.Geteuid()

	originalCaps, err := getCurrentCaps()
	if err != nil {
		return -1, -1, fmt.Errorf("failed to read current capabilities: %w", err)
	}

	if _, _, errno := syscall.RawSyscall(unix.SYS_SETRESUID, ^uintptr(0), uintptr(targetHostUID), ^uintptr(0)); errno != 0 {
		return -1, -1, fmt.Errorf("failed to set effective UID: %w", errno)
	}

	err = setCurrentCaps(originalCaps)
	if err != nil {
		return -1, -1, fmt.Errorf("failed to restore capabilities: %w", err)
	}

	var pidfd int
	proc, err := os.StartProcess("/proc/self/exe", []string{"UnshareAfterEnterUserns"}, &os.ProcAttr{
		Sys: &syscall.SysProcAttr{
			// clone new user namespace first and then unshare
			Cloneflags:                 unix.CLONE_NEWUSER,
			Unshareflags:               unshareFlags,
			UidMappings:                uidMaps,
			GidMappings:                gidMaps,
			GidMappingsEnableSetgroups: true,
			// NOTE: It's reexec but it's not heavy because subprocess
			// be in PTRACE_TRACEME mode before performing execve.
			Ptrace:    true,
			Pdeathsig: syscall.SIGKILL,
			PidFD:     &pidfd,
		},
	})
	if err != nil {
		return -1, -1, fmt.Errorf("failed to start noop process for unshare: %w", err)
	}

	if pidfd == -1 {
		proc.Kill()
		proc.Wait()
		return -1, -1, fmt.Errorf("kernel doesn't support CLONE_PIDFD")
	}

	if _, _, errno := syscall.RawSyscall(unix.SYS_SETRESUID, ^uintptr(0), uintptr(originalEUID), ^uintptr(0)); errno != 0 {
		proc.Kill()
		proc.Wait()
		unix.Close(pidfd)
		return -1, -1, fmt.Errorf("failed to restore UID: %w", errno)
	}

	return proc.Pid, pidfd, nil
}

func pidfdWaitid(pidfd int) error {
	return IgnoringEINTR(func() error {