mirror of
https://github.com/opencontainers/runc.git
synced 2025-12-24 11:50:58 +08:00
8e8b136c49
With the idmap work, we will have a tainted Go thread in our thread-group that has a different mount namespace to the other threads. It seems that (due to some bad luck) the Go scheduler tends to make this thread the thread-group leader in our tests, which results in very baffling failures where /proc/self/mountinfo produces gibberish results. In order to avoid this, switch to using /proc/thread-self for everything that is thread-local. This primarily includes switching all file descriptor paths (CLONE_FS), all of the places that check the current cgroup (technically we never will run a single runc thread in a separate cgroup, but better to be safe than sorry), and the aforementioned mountinfo code. We don't need to do anything for the following because the results we need aren't thread-local: * Checks that certain namespaces are supported by stat(2)ing /proc/self/ns/... * /proc/self/exe and /proc/self/cmdline are not thread-local. * While threads can be in different cgroups, we do not do this for the runc binary (or libcontainer) and thus we do not need to switch to the thread-local version of /proc/self/cgroups. * All of the CLONE_NEWUSER files are not thread-local because you cannot set the usernamespace of a single thread (setns(CLONE_NEWUSER) is blocked for multi-threaded programs). Note that we have to use runtime.LockOSThread when we have an open handle to a tid-specific procfs file that we are operating on multiple times. Go can reschedule us such that we are running on a different thread and then kill the original thread (causing -ENOENT or similarly confusing errors). This is not strictly necessary for most usages of /proc/thread-self (such as using /proc/thread-self/fd/$n directly) since only operating on the actual inodes associated with the tid requires this locking, but because of the pre-3.17 fallback for CentOS, we have to do this in most cases. In addition, CentOS's kernel is too old for /proc/thread-self, which requires us to emulate it -- however in rootfs_linux.go, we are in the container pid namespace but /proc is the host's procfs. This leads to the incredibly frustrating situation where there is no way (on pre-4.1 Linux) to figure out which /proc/self/task/... entry refers to the current tid. We can just use /proc/self in this case. Yes this is all pretty ugly. I also wish it wasn't necessary. Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
134 lines
2.7 KiB
Go
134 lines
2.7 KiB
Go
package configs
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"sync"
|
|
)
|
|
|
|
const (
|
|
NEWNET NamespaceType = "NEWNET"
|
|
NEWPID NamespaceType = "NEWPID"
|
|
NEWNS NamespaceType = "NEWNS"
|
|
NEWUTS NamespaceType = "NEWUTS"
|
|
NEWIPC NamespaceType = "NEWIPC"
|
|
NEWUSER NamespaceType = "NEWUSER"
|
|
NEWCGROUP NamespaceType = "NEWCGROUP"
|
|
NEWTIME NamespaceType = "NEWTIME"
|
|
)
|
|
|
|
var (
|
|
nsLock sync.Mutex
|
|
supportedNamespaces = make(map[NamespaceType]bool)
|
|
)
|
|
|
|
// NsName converts the namespace type to its filename
|
|
func NsName(ns NamespaceType) string {
|
|
switch ns {
|
|
case NEWNET:
|
|
return "net"
|
|
case NEWNS:
|
|
return "mnt"
|
|
case NEWPID:
|
|
return "pid"
|
|
case NEWIPC:
|
|
return "ipc"
|
|
case NEWUSER:
|
|
return "user"
|
|
case NEWUTS:
|
|
return "uts"
|
|
case NEWCGROUP:
|
|
return "cgroup"
|
|
case NEWTIME:
|
|
return "time"
|
|
}
|
|
return ""
|
|
}
|
|
|
|
// IsNamespaceSupported returns whether a namespace is available or
|
|
// not
|
|
func IsNamespaceSupported(ns NamespaceType) bool {
|
|
nsLock.Lock()
|
|
defer nsLock.Unlock()
|
|
supported, ok := supportedNamespaces[ns]
|
|
if ok {
|
|
return supported
|
|
}
|
|
nsFile := NsName(ns)
|
|
// if the namespace type is unknown, just return false
|
|
if nsFile == "" {
|
|
return false
|
|
}
|
|
// We don't need to use /proc/thread-self here because the list of
|
|
// namespace types is unrelated to the thread. This lets us avoid having to
|
|
// do runtime.LockOSThread.
|
|
_, err := os.Stat("/proc/self/ns/" + nsFile)
|
|
// a namespace is supported if it exists and we have permissions to read it
|
|
supported = err == nil
|
|
supportedNamespaces[ns] = supported
|
|
return supported
|
|
}
|
|
|
|
func NamespaceTypes() []NamespaceType {
|
|
return []NamespaceType{
|
|
NEWUSER, // Keep user NS always first, don't move it.
|
|
NEWIPC,
|
|
NEWUTS,
|
|
NEWNET,
|
|
NEWPID,
|
|
NEWNS,
|
|
NEWCGROUP,
|
|
NEWTIME,
|
|
}
|
|
}
|
|
|
|
// Namespace defines configuration for each namespace. It specifies an
|
|
// alternate path that is able to be joined via setns.
|
|
type Namespace struct {
|
|
Type NamespaceType `json:"type"`
|
|
Path string `json:"path"`
|
|
}
|
|
|
|
func (n *Namespace) GetPath(pid int) string {
|
|
return fmt.Sprintf("/proc/%d/ns/%s", pid, NsName(n.Type))
|
|
}
|
|
|
|
func (n *Namespaces) Remove(t NamespaceType) bool {
|
|
i := n.index(t)
|
|
if i == -1 {
|
|
return false
|
|
}
|
|
*n = append((*n)[:i], (*n)[i+1:]...)
|
|
return true
|
|
}
|
|
|
|
func (n *Namespaces) Add(t NamespaceType, path string) {
|
|
i := n.index(t)
|
|
if i == -1 {
|
|
*n = append(*n, Namespace{Type: t, Path: path})
|
|
return
|
|
}
|
|
(*n)[i].Path = path
|
|
}
|
|
|
|
func (n *Namespaces) index(t NamespaceType) int {
|
|
for i, ns := range *n {
|
|
if ns.Type == t {
|
|
return i
|
|
}
|
|
}
|
|
return -1
|
|
}
|
|
|
|
func (n *Namespaces) Contains(t NamespaceType) bool {
|
|
return n.index(t) != -1
|
|
}
|
|
|
|
func (n *Namespaces) PathOf(t NamespaceType) string {
|
|
i := n.index(t)
|
|
if i == -1 {
|
|
return ""
|
|
}
|
|
return (*n)[i].Path
|
|
}
|