From d381c8a6bf850f4d349de515e56b561d41bdd528 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Fri, 24 Nov 2017 20:57:19 +0100 Subject: [PATCH] nspawn: hash the machine name, when looking for a suitable UID base (#7437) When "-U" is used we look for a UID range we can use for our container. We start with the UID the tree is already assigned to, and if that didn't work we'd pick random ranges so far. With this change we'll first try to hash a suitable range from the container name, and use that if it works, in order to make UID assignments more likely to be stable. This follows a similar logic PID 1 follows when using DynamicUser=1. --- src/nspawn/nspawn.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 8fc39dd2ba..d6e4ec2e3c 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -2793,6 +2793,7 @@ static int outer_child( } static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) { + bool tried_hashed = false; unsigned n_tries = 100; uid_t candidate; int r; @@ -2841,7 +2842,20 @@ static int uid_shift_pick(uid_t *shift, LockFile *ret_lock_file) { return 0; next: - random_bytes(&candidate, sizeof(candidate)); + if (arg_machine && !tried_hashed) { + /* Try to hash the base from the container name */ + + static const uint8_t hash_key[] = { + 0xe1, 0x56, 0xe0, 0xf0, 0x4a, 0xf0, 0x41, 0xaf, + 0x96, 0x41, 0xcf, 0x41, 0x33, 0x94, 0xff, 0x72 + }; + + candidate = (uid_t) siphash24(arg_machine, strlen(arg_machine), hash_key); + + tried_hashed = true; + } else + random_bytes(&candidate, sizeof(candidate)); + candidate = (candidate % (UID_SHIFT_PICK_MAX - UID_SHIFT_PICK_MIN)) + UID_SHIFT_PICK_MIN; candidate &= (uid_t) UINT32_C(0xFFFF0000); }