k8snetworkplumbingwg / multus-cni / 35137321993

55%

master: 55%

Build Type

Pull #1548

github

Committed by rollandf

Commit Message

daemon: fix nil pointer dereference in the root privilege check

startMultusDaemon() verifies it runs as root via os/user.Current().
When that call fails it returns a nil *User along with the error, but
the guard dereferences user.Uid while building the error message, so
the daemon crashes with SIGSEGV instead of reporting the problem:

  [verbose] multus-daemon started
  panic: runtime error: invalid memory address or nil pointer dereference
  [signal SIGSEGV: segmentation violation]
  main.startMultusDaemon(...)
          /usr/src/multus-cni/cmd/multus-daemon/main.go:160

The daemon is built with CGO_ENABLED=0, so os/user resolves the uid by
parsing /etc/passwd and only falls back to $USER/$HOME when that lookup
misses. Any image whose /etc/passwd lacks an entry for the running uid
therefore hits the nil dereference. This reproduces on the shipped
debian:stable-slim thick image when run as a uid that is not listed in
/etc/passwd.

Use os.Geteuid() instead. It is a syscall with no filesystem
dependency, it reports the effective uid which is what actually matters
for the chroot performed in pkg/server/exec_chroot.go, and it removes
the nil dereference entirely. The failure path now prints the intended
message:

  failed to run multus-daemon with root, now running in uid: 1000

Signed-off-by: Fred Rolland <frolland@nvidia.com>

Pull Request Pull Request #1548: daemon: fix nil pointer dereference in the root privilege check

Coverage Stats

0 of 2 new or added lines in 1 file covered. (0.0%)

1 existing line in 1 file now uncovered.

3006 of 5500 relevant lines covered (54.65%)

7.1 hits per line