Kaynağa Gözat

Handle the case where the logdir directory has group "users"

In general, if the logdir directory had a group whose gid already
existed in the docker image, then wo_docker_start would fail when
it tried to create the walkingo group with the same gid.

Now we check to see if the gid already exists in the docker, and
just use that group if it does.

Thanks to the USENIX Security Artifact Evaluation Committee reviewers
for pointing this out.
Ian Goldberg 4 yıl önce
ebeveyn
işleme
cb1ecf925b
2 değiştirilmiş dosya ile 11 ekleme ve 3 silme
  1. 1 1
      attach-docker
  2. 10 2
      wo_docker_start.in

+ 1 - 1
attach-docker

@@ -1,3 +1,3 @@
 #!/bin/bash
 
-exec docker exec -u walkingo:walkingo -it walkingo_exp screen -rd
+exec docker exec -u walkingo -it walkingo_exp screen -rd

+ 10 - 2
wo_docker_start.in

@@ -7,8 +7,16 @@ cd /home/walkingo || exit 1
 [ -d logdir ] || exit 1
 wouid=`/usr/bin/stat -c %u logdir`
 wogid=`/usr/bin/stat -c %g logdir`
-/usr/sbin/groupadd -g $wogid walkingo
-/usr/sbin/useradd -g walkingo -u $wouid -s /bin/bash walkingo
+
+# See if the gid already exists in the docker;
+# this usually is because the group of logdir
+# is "users" or something like that
+grpname=`/usr/bin/getent group $wogid | cut -d: -f1`
+if [ "$grpname" == "" ]; then
+    /usr/sbin/groupadd -g $wogid walkingo
+    grpname=walkingo
+fi
+/usr/sbin/useradd -g $grpname -u $wouid -s /bin/bash walkingo
 /bin/cp -a /etc/skel/.bash* /etc/skel/.profile .
 
 # Give the new walkingo user sudo permissions in the docker