-
Notifications
You must be signed in to change notification settings - Fork 276
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* containerlab: Add sudoless operation. This change introduces sudoless operations to containerlab, leveraging the SUID bit set on the binary. The SUID-granted root privileges can optionally be gated behind a membership of the group 'clab_admins', which is set up automatically on version upgrade, adding the current Containerlab user to it. * containerlab: Add sudoless changes to packaging+install script * containerlab: Add missing root privilege gain to disable-tx-offload command * containerlab: clab_admins should be added as as system group * containerlab: Change not in user group hint to user usermod instead of gpasswd * containerlab: Add shorthands for root UID and no-modify flags for readability * upgrade: Fix sudoless upgrade * containerlab: Only create clab_admins group during first upgrade/install * docs: Add documentation about sudoless operation * cmd: Fix broken rebase * docs: Fix minimum version for sudoless operations support in install docs * cmd: Allow unprivileged users to exec if they are part of the docker group * cmd/netem: Add root requirement for show link impairments command * format * docs polish * remove href from the embedded code block * cicd, tests: Make tests run sudoless * cmd/generate: Get root privileges for deploy action * utils/file: Create files as running user instead of effective user * cmd: Only run sudoless if Docker runtime is used * runtimes: Add connectivity check for runtimes * cmd: Don't allow non-Docker runtimes to run as root without membership check * docs: Add note about non-privileged operations only being supported w/ Docker * mocks: Update container runtime mock --------- Co-authored-by: Roman Dodin <[email protected]>
- Loading branch information
Showing
68 changed files
with
516 additions
and
235 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,16 +1,100 @@ | ||
| package common | ||
|
|
||
| import ( | ||
| "errors" | ||
| "fmt" | ||
| "os" | ||
| "os/user" | ||
| "slices" | ||
|
|
||
| "github.com/spf13/cobra" | ||
| "golang.org/x/sys/unix" | ||
|
|
||
| log "github.com/sirupsen/logrus" | ||
| ) | ||
|
|
||
| const ( | ||
| CLAB_AUTHORISED_GROUP = "clab_admins" | ||
| ROOT_UID = 0 | ||
| NOMODIFY = -1 | ||
| ) | ||
|
|
||
| func SudoCheck(_ *cobra.Command, _ []string) error { | ||
| id := os.Geteuid() | ||
| if id != 0 { | ||
| return errors.New("containerlab requires sudo privileges to run") | ||
| func CheckAndGetRootPrivs(_ *cobra.Command, _ []string) error { | ||
| _, euid, suid := unix.Getresuid() | ||
| if euid != 0 && suid != 0 { | ||
| return fmt.Errorf("this containerlab command requires root privileges or root via SUID to run, effective UID: %v SUID: %v", euid, suid) | ||
| } | ||
|
|
||
| if euid != 0 && suid == 0 { | ||
| clabGroupExists := true | ||
| clabGroup, err := user.LookupGroup(CLAB_AUTHORISED_GROUP) | ||
| if err != nil { | ||
| if _, ok := err.(user.UnknownGroupError); ok { | ||
| log.Debug("Containerlab admin group does not exist, skipping group membership check") | ||
| clabGroupExists = false | ||
| } else { | ||
| return fmt.Errorf("failed to lookup containerlab admin group: %v", err) | ||
| } | ||
| } | ||
|
|
||
| if clabGroupExists { | ||
| currentEffUser, err := user.Current() | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| effUserGroupIDs, err := currentEffUser.GroupIds() | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| if !slices.Contains(effUserGroupIDs, clabGroup.Gid) { | ||
| return fmt.Errorf("user '%v' is not part of containerlab admin group 'clab_admins' (GID %v), which is required to execute this command.\nTo add yourself to this group, run the following command:\n\t$ sudo gpasswd -a %v clab_admins", | ||
| currentEffUser.Username, clabGroup.Gid, currentEffUser.Username) | ||
| } | ||
|
|
||
| log.Debug("Group membership check passed") | ||
| } | ||
|
|
||
| err = obtainRootPrivs() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func obtainRootPrivs() error { | ||
| // Escalate to root privileges, changing saved UIDs to root/current group to be able to retain privilege escalation | ||
| err := changePrivileges(0, os.Getgid(), 0, os.Getgid()) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| log.Debug("Obtained root privileges") | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func DropRootPrivs() error { | ||
| // Drop privileges to the running user, retaining current saved IDs | ||
| err := changePrivileges(os.Getuid(), os.Getgid(), -1, -1) | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| log.Debug("Dropped root privileges") | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func changePrivileges(new_uid, new_gid, saved_uid, saved_gid int) error { | ||
| if err := unix.Setresuid(-1, new_uid, saved_uid); err != nil { | ||
| return fmt.Errorf("failed to set UID: %v", err) | ||
| } | ||
| if err := unix.Setresgid(-1, new_gid, saved_gid); err != nil { | ||
| return fmt.Errorf("failed to set GID: %v", err) | ||
| } | ||
| log.Debugf("Changed running UIDs to UID: %d GID: %d", new_uid, new_gid) | ||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.