From 119d04f017c39307280bb88fcdeaaf6f31ee9c9d Mon Sep 17 00:00:00 2001 From: Helmut Grohne Date: Fri, 19 Jan 2024 13:08:41 +0100 Subject: add convenience function unshare_user_idmap_nohelper --- linuxnamespaces/__init__.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'linuxnamespaces') diff --git a/linuxnamespaces/__init__.py b/linuxnamespaces/__init__.py index 29d41f6..5d810b0 100644 --- a/linuxnamespaces/__init__.py +++ b/linuxnamespaces/__init__.py @@ -331,3 +331,16 @@ def unshare_user_idmap( newidmaps(pid, uidmap, gidmap) unshare(flags) setup_idmaps() + +def unshare_user_idmap_nohelper( + uid: int, gid: int, flags: CloneFlags = CloneFlags.NEWUSER +) -> None: + """Unshare the given namespaces (must include user) and + map the current user and group to the given uid and gid + without using the setuid helpers. + """ + uidmap = IDMapping(uid, os.getuid(), 1) + gidmap = IDMapping(gid, os.getgid(), 1) + unshare(flags) + pathlib.Path("/proc/self/setgroups").write_bytes(b"deny") + newidmaps(-1, [uidmap], [gidmap], False) -- cgit v1.2.3