检查如果在无私人容器内运行 我正在试图检查我的程序是否在无私人的容器环境中运行。我正在使用4种不同的启发式方法来确定这一点 - 即。检查/proc/proc/self/uid_map中的uid/gid，gid_m ...

Question

内部的某些功能，因为大多数无私人的容器不允许安装主机为RW.

此方法正确吗？

#include <stdio.h>
#include <stdbool.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <sys/capability.h>

int likely_unpriv_container(void) {
    FILE *fp;
    char buffer[1024];
    unsigned long in_id, out_id, range;
    bool uid_unpriv = false, gid_unpriv = false, has_caps = false, can_write = false;
    int l = 0;
    cap_t caps;
    cap_flag_value_t value;
    int fd;

    fp = fopen("/proc/self/uid_map", "r");
    if (!fp) {
        return -1;
    }

    while (fgets(buffer, sizeof(buffer), fp)) {
        l++;
        if (sscanf(buffer, "%lu %lu %lu", &in_id, &out_id, &range) == 3) {
            if (out_id != 0 || !(in_id == 0 && range == 4294967295)) {
                uid_unpriv = true;
            }
        }
    }
    if (l > 1) {
        uid_unpriv = true;
    }
    fclose(fp);

    fp = fopen("/proc/self/gid_map", "r");
    if (!fp) {
        return -1;
    }

    l = 0;
    while (fgets(buffer, sizeof(buffer), fp)) {
        l++;
        if (sscanf(buffer, "%lu %lu %lu", &in_id, &out_id, &range) == 3) {
            if (out_id != 0 || !(in_id == 0 && range == 4294967295)) {
                gid_unpriv = true;
            }
        }
    }
    if (l > 1) {
        gid_unpriv = true;
    }
    fclose(fp);

    caps = cap_get_proc();
    if (caps) {
        if (cap_get_flag(caps, CAP_SYS_ADMIN, CAP_EFFECTIVE, &value) != -1 && value == CAP_SET) {
            has_caps = true;
        }
        if (cap_get_flag(caps, CAP_CHOWN, CAP_EFFECTIVE, &value) != -1 && value == CAP_SET) {
            has_caps = true;
        }
        if (cap_get_flag(caps, CAP_DAC_OVERRIDE, CAP_EFFECTIVE, &value) != -1 && value == CAP_SET) {
            has_caps = true;
        }
        if (cap_get_flag(caps, CAP_SETFCAP, CAP_EFFECTIVE, &value) != -1 && value == CAP_SET) {
            has_caps = true;
        }
        if (cap_get_flag(caps, CAP_SETPCAP, CAP_EFFECTIVE, &value) != -1 && value == CAP_SET) {
            has_caps = true;
        }
        cap_free(caps);
    }

    fd = open("/proc/sys/user/max_user_namespaces", O_WRONLY);
    if (fd >= 0) {
        can_write = true;
        close(fd);
    }

    if (uid_unpriv && gid_unpriv && !has_caps && !can_write) {
        return 0;
    } else {
        return -1;
    }
}

您提供的方法是有效的，有效且正确实施的。