浏览代码

Handle the case where the logdir directory has group "users"

In general, if the logdir directory had a group whose gid already
existed in the docker image, then wo_docker_start would fail when
it tried to create the walkingo group with the same gid.

Now we check to see if the gid already exists in the docker, and
just use that group if it does.

Thanks to the USENIX Security Artifact Evaluation Committee reviewers
for pointing this out.
Ian Goldberg 4 年之前
父节点
当前提交
cb1ecf925b
共有 2 个文件被更改,包括 11 次插入3 次删除
  1. 1 1
      attach-docker
  2. 10 2
      wo_docker_start.in

+ 1 - 1
attach-docker

@@ -1,3 +1,3 @@
 #!/bin/bash
 
-exec docker exec -u walkingo:walkingo -it walkingo_exp screen -rd
+exec docker exec -u walkingo -it walkingo_exp screen -rd

+ 10 - 2
wo_docker_start.in

@@ -7,8 +7,16 @@ cd /home/walkingo || exit 1
 [ -d logdir ] || exit 1
 wouid=`/usr/bin/stat -c %u logdir`
 wogid=`/usr/bin/stat -c %g logdir`
-/usr/sbin/groupadd -g $wogid walkingo
-/usr/sbin/useradd -g walkingo -u $wouid -s /bin/bash walkingo
+
+# See if the gid already exists in the docker;
+# this usually is because the group of logdir
+# is "users" or something like that
+grpname=`/usr/bin/getent group $wogid | cut -d: -f1`
+if [ "$grpname" == "" ]; then
+    /usr/sbin/groupadd -g $wogid walkingo
+    grpname=walkingo
+fi
+/usr/sbin/useradd -g $grpname -u $wouid -s /bin/bash walkingo
 /bin/cp -a /etc/skel/.bash* /etc/skel/.profile .
 
 # Give the new walkingo user sudo permissions in the docker