userns_spawn.c

#define _GNU_SOURCE
#define _POSIX_C_SOURCE 200809L
#include <sched.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <errno.h>

static int write_file(const char *path, const char *s)
{
    int fd = open(path, O_WRONLY);
    if (fd < 0) return -1;
    ssize_t n = write(fd, s, strlen(s));
    close(fd);
    return n == (ssize_t)strlen(s) ? 0 : -1;
}

static int child_fn(void *arg)
{
    char buf[64];
    snprintf(buf, sizeof buf, "0 %d 1", getuid());
    if (write_file("/proc/self/uid_map", buf) < 0) {
        perror("uid_map");
        return 1;
    }
    if (write_file("/proc/self/setgroups", "deny") < 0) {
    }
    snprintf(buf, sizeof buf, "0 %d 1", getgid());
    if (write_file("/proc/self/gid_map", buf) < 0) {
        perror("gid_map");
        return 1;
    }
    char **argv = arg;
    execvp(argv[0], argv);
    perror("execvp");
    return 1;
}

int main(int argc, char **argv)
{
#if !defined(__linux__)
    fprintf(stderr, "userns_spawn is Linux-only");
    return 1;
#else
    if (argc < 2) {
        fprintf(stderr, "usage: %s command [args...]", argv[0]);
        return 1;
    }
    size_t stack_size = 1024 * 1024;
    void *stack = malloc(stack_size);
    if (!stack) return 1;
    void *stack_top = (char *)stack + stack_size;
    int flags = CLONE_NEWUSER | SIGCHLD;
    char **child_argv = &argv[1];
    pid_t pid = clone(child_fn, stack_top, flags, child_argv);
    if (pid < 0) {
        perror("clone");
        return 1;
    }
    int status;
    waitpid(pid, &status, 0);
    free(stack);
    return 0;
#endif
}