Browse Source

Handle the case where the logdir directory has group "users"

In general, if the logdir directory had a group whose gid already
existed in the docker image, then wo_docker_start would fail when
it tried to create the walkingo group with the same gid.

Now we check to see if the gid already exists in the docker, and
just use that group if it does.

Thanks to the USENIX Security Artifact Evaluation Committee reviewers
for pointing this out.
Ian Goldberg 3 years ago
parent
commit
cb1ecf925b
2 changed files with 11 additions and 3 deletions
  1. 1 1
      attach-docker
  2. 10 2
      wo_docker_start.in

+ 1 - 1
attach-docker

@@ -1,3 +1,3 @@
 #!/bin/bash
 
-exec docker exec -u walkingo:walkingo -it walkingo_exp screen -rd
+exec docker exec -u walkingo -it walkingo_exp screen -rd

+ 10 - 2
wo_docker_start.in

@@ -7,8 +7,16 @@ cd /home/walkingo || exit 1
 [ -d logdir ] || exit 1
 wouid=`/usr/bin/stat -c %u logdir`
 wogid=`/usr/bin/stat -c %g logdir`
-/usr/sbin/groupadd -g $wogid walkingo
-/usr/sbin/useradd -g walkingo -u $wouid -s /bin/bash walkingo
+
+# See if the gid already exists in the docker;
+# this usually is because the group of logdir
+# is "users" or something like that
+grpname=`/usr/bin/getent group $wogid | cut -d: -f1`
+if [ "$grpname" == "" ]; then
+    /usr/sbin/groupadd -g $wogid walkingo
+    grpname=walkingo
+fi
+/usr/sbin/useradd -g $grpname -u $wouid -s /bin/bash walkingo
 /bin/cp -a /etc/skel/.bash* /etc/skel/.profile .
 
 # Give the new walkingo user sudo permissions in the docker