mirror of
https://github.com/opencontainers/runc.git
synced 2025-04-18 19:44:09 +03:00
ba0b5e2698
With open_tree(OPEN_TREE_CLONE), it is possible to implement both the
id-mapped mounts and bind-mount source file descriptor logic entirely in
Go without requiring any complicated handling from nsexec.
However, implementing it the naive way (do the OPEN_TREE_CLONE in the
host namespace before the rootfs is set up -- which is what the existing
implementation did) exposes issues in how mount ordering (in particular
when handling mount sources from inside the container rootfs, but also
in relation to mount propagation) was handled for idmapped mounts and
bind-mount sources. In order to solve this problem completely, it is
necessary to spawn a thread which joins the container mount namespace
and provides mountfds when requested by the rootfs setup code (ensuring
that the mount order and mount propagation of the source of the
bind-mount are handled correctly). While the need to join the mount
namespace leads to other complicated (such as with the usage of
/proc/self -- fixed in a later patch) the resulting code is still
reasonable and is the only real way to solve the issue.
This allows us to reduce the amount of C code we have in nsexec, as well
as simplifying a whole host of places that were made more complicated
with the addition of id-mapped mounts and the bind sourcefd logic.
Because we join the container namespace, we can continue to use regular
O_PATH file descriptors for non-id-mapped bind-mount sources (which
means we don't have to raise the kernel requirement for that case).
In addition, we can easily add support for id-mappings that don't match
the container's user namespace. The approach taken here is to use Go's
officially supported mechanism for spawning a process in a user
namespace, but (ab)use PTRACE_TRACEME to avoid actually having to exec a
different process. The most efficient way to implement this would be to
do clone() in cgo directly to run a function that just does
kill(getpid(), SIGSTOP) -- we can always switch to that if it turns out
this approach is too slow. It should be noted that the included
micro-benchmark seems to indicate this is Fast Enough(TM):
goos: linux
goarch: amd64
pkg: github.com/opencontainers/runc/libcontainer/userns
cpu: Intel(R) Core(TM) i5-10210U CPU @ 1.60GHz
BenchmarkSpawnProc
BenchmarkSpawnProc-8 1670 770065 ns/op
Fixes: fda12ab1014e ("Support idmap mounts on volumes")
Fixes: 9c444070ec7b ("Open bind mount sources from the host userns")
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
98 lines
2.3 KiB
Go
98 lines
2.3 KiB
Go
package libcontainer
|
|
|
|
import (
|
|
"fmt"
|
|
"math"
|
|
|
|
"github.com/vishvananda/netlink/nl"
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
// list of known message types we want to send to bootstrap program
|
|
// The number is randomly chosen to not conflict with known netlink types
|
|
const (
|
|
InitMsg uint16 = 62000
|
|
CloneFlagsAttr uint16 = 27281
|
|
NsPathsAttr uint16 = 27282
|
|
UidmapAttr uint16 = 27283
|
|
GidmapAttr uint16 = 27284
|
|
SetgroupAttr uint16 = 27285
|
|
OomScoreAdjAttr uint16 = 27286
|
|
RootlessEUIDAttr uint16 = 27287
|
|
UidmapPathAttr uint16 = 27288
|
|
GidmapPathAttr uint16 = 27289
|
|
TimeOffsetsAttr uint16 = 27290
|
|
)
|
|
|
|
type Int32msg struct {
|
|
Type uint16
|
|
Value uint32
|
|
}
|
|
|
|
// Serialize serializes the message.
|
|
// Int32msg has the following representation
|
|
// | nlattr len | nlattr type |
|
|
// | uint32 value |
|
|
func (msg *Int32msg) Serialize() []byte {
|
|
buf := make([]byte, msg.Len())
|
|
native := nl.NativeEndian()
|
|
native.PutUint16(buf[0:2], uint16(msg.Len()))
|
|
native.PutUint16(buf[2:4], msg.Type)
|
|
native.PutUint32(buf[4:8], msg.Value)
|
|
return buf
|
|
}
|
|
|
|
func (msg *Int32msg) Len() int {
|
|
return unix.NLA_HDRLEN + 4
|
|
}
|
|
|
|
// Bytemsg has the following representation
|
|
// | nlattr len | nlattr type |
|
|
// | value | pad |
|
|
type Bytemsg struct {
|
|
Type uint16
|
|
Value []byte
|
|
}
|
|
|
|
func (msg *Bytemsg) Serialize() []byte {
|
|
l := msg.Len()
|
|
if l > math.MaxUint16 {
|
|
// We cannot return nil nor an error here, so we panic with
|
|
// a specific type instead, which is handled via recover in
|
|
// bootstrapData.
|
|
panic(netlinkError{fmt.Errorf("netlink: cannot serialize bytemsg of length %d (larger than UINT16_MAX)", l)})
|
|
}
|
|
buf := make([]byte, (l+unix.NLA_ALIGNTO-1) & ^(unix.NLA_ALIGNTO-1))
|
|
native := nl.NativeEndian()
|
|
native.PutUint16(buf[0:2], uint16(l))
|
|
native.PutUint16(buf[2:4], msg.Type)
|
|
copy(buf[4:], msg.Value)
|
|
return buf
|
|
}
|
|
|
|
func (msg *Bytemsg) Len() int {
|
|
return unix.NLA_HDRLEN + len(msg.Value) + 1 // null-terminated
|
|
}
|
|
|
|
type Boolmsg struct {
|
|
Type uint16
|
|
Value bool
|
|
}
|
|
|
|
func (msg *Boolmsg) Serialize() []byte {
|
|
buf := make([]byte, msg.Len())
|
|
native := nl.NativeEndian()
|
|
native.PutUint16(buf[0:2], uint16(msg.Len()))
|
|
native.PutUint16(buf[2:4], msg.Type)
|
|
if msg.Value {
|
|
native.PutUint32(buf[4:8], uint32(1))
|
|
} else {
|
|
native.PutUint32(buf[4:8], uint32(0))
|
|
}
|
|
return buf
|
|
}
|
|
|
|
func (msg *Boolmsg) Len() int {
|
|
return unix.NLA_HDRLEN + 4 // alignment
|
|
}
|