ignore missing /proc/<pid>/setgroups files
When running on older kernels that lack setgroups, the write failure
causes minijail to abort. Short of having every caller detect the
kernel support and selectively calling disable_setgroups, ignore the
write failure directly when it's ENOENT.
Bug: None
Test: running on newer kernels works, as does older kernels
Change-Id: I424cb749fec0f76cc4278a8a7581b168fbe50485
diff --git a/libminijail.c b/libminijail.c
index 7f41b33..ecd078b 100644
--- a/libminijail.c
+++ b/libminijail.c
@@ -1293,9 +1293,17 @@
{
if (j->uidmap && write_proc_file(j->initpid, j->uidmap, "uid_map") != 0)
kill_child_and_die(j, "failed to write uid_map");
- if (j->gidmap && j->flags.disable_setgroups &&
- write_proc_file(j->initpid, "deny", "setgroups") != 0)
- kill_child_and_die(j, "failed to disable setgroups(2)");
+ if (j->gidmap && j->flags.disable_setgroups) {
+ /* Older kernels might not have the /proc/<pid>/setgroups files. */
+ int ret = write_proc_file(j->initpid, "deny", "setgroups");
+ if (ret < 0) {
+ if (ret == -ENOENT) {
+ /* See http://man7.org/linux/man-pages/man7/user_namespaces.7.html. */
+ warn("could not disable setgroups(2)");
+ } else
+ kill_child_and_die(j, "failed to disable setgroups(2)");
+ }
+ }
if (j->gidmap && write_proc_file(j->initpid, j->gidmap, "gid_map") != 0)
kill_child_and_die(j, "failed to write gid_map");
}