{"action":"created","issue":{"url":"https://api.github.com/repos/opencontainers/runc/issues/351","labels_url":"https://api.github.com/repos/opencontainers/runc/issues/351/labels{/name}","comments_url":"https://api.github.com/repos/opencontainers/runc/issues/351/comments","events_url":"https://api.github.com/repos/opencontainers/runc/issues/351/events","html_url":"https://github.com/opencontainers/runc/pull/351","id":112513514,"number":351,"title":"Userns container in containers","user":{"login":"ashahab-altiscale","id":5115017,"avatar_url":"https://avatars.githubusercontent.com/u/5115017?v=3","gravatar_id":"","url":"https://api.github.com/users/ashahab-altiscale","html_url":"https://github.com/ashahab-altiscale","followers_url":"https://api.github.com/users/ashahab-altiscale/followers","following_url":"https://api.github.com/users/ashahab-altiscale/following{/other_user}","gists_url":"https://api.github.com/users/ashahab-altiscale/gists{/gist_id}","starred_url":"https://api.github.com/users/ashahab-altiscale/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ashahab-altiscale/subscriptions","organizations_url":"https://api.github.com/users/ashahab-altiscale/orgs","repos_url":"https://api.github.com/users/ashahab-altiscale/repos","events_url":"https://api.github.com/users/ashahab-altiscale/events{/privacy}","received_events_url":"https://api.github.com/users/ashahab-altiscale/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/opencontainers/runc/labels/status/0-triage","name":"status/0-triage","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-10-21T05:04:03Z","updated_at":"2015-10-21T18:24:53Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/opencontainers/runc/pulls/351","html_url":"https://github.com/opencontainers/runc/pull/351","diff_url":"https://github.com/opencontainers/runc/pull/351.diff","patch_url":"https://github.com/opencontainers/runc/pull/351.patch"},"body":"Added a check on devices for hosts that are themselves usernamespaced\r\ncontainers. It is not possible for a non-root host process to set the\r\ndevices.allow and devices.deny, and therefore this patch skips that for\r\nhost processes which have a non-root uid_map.\r\nSigned-off-by: Abin Shahab <ashahab@altiscale.com>"},"comment":{"url":"https://api.github.com/repos/opencontainers/runc/issues/comments/149984939","html_url":"https://github.com/opencontainers/runc/pull/351#issuecomment-149984939","issue_url":"https://api.github.com/repos/opencontainers/runc/issues/351","id":149984939,"user":{"login":"ashahab-altiscale","id":5115017,"avatar_url":"https://avatars.githubusercontent.com/u/5115017?v=3","gravatar_id":"","url":"https://api.github.com/users/ashahab-altiscale","html_url":"https://github.com/ashahab-altiscale","followers_url":"https://api.github.com/users/ashahab-altiscale/followers","following_url":"https://api.github.com/users/ashahab-altiscale/following{/other_user}","gists_url":"https://api.github.com/users/ashahab-altiscale/gists{/gist_id}","starred_url":"https://api.github.com/users/ashahab-altiscale/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ashahab-altiscale/subscriptions","organizations_url":"https://api.github.com/users/ashahab-altiscale/orgs","repos_url":"https://api.github.com/users/ashahab-altiscale/repos","events_url":"https://api.github.com/users/ashahab-altiscale/events{/privacy}","received_events_url":"https://api.github.com/users/ashahab-altiscale/received_events","type":"User","site_admin":false},"created_at":"2015-10-21T18:24:53Z","updated_at":"2015-10-21T18:24:53Z","body":"@avagin Thanks for looking at this. Spoke to @mrunalp and @LK4D4 about this, and I understand that it is possible to \"fool\" the container if you nest 2 levels in usernamespaces, and invalidate my check(map 1000 to 0 in level 1, and map 0 to 0 in level 2, so level 2 uid_map can portray itself as root on the host).\r\n\r\nAn alternative is to indicate in runtime.json that the host has usernamespace limitations, meaning a non root user from the original parent host has been mapped to root user somewhere in the uid_map hierarchy. RunC will use this to behave the way it does when container is usernamespaced(don't mknod, don't write devices.allow)."}}