mirror of
https://github.com/opencontainers/runc.git
synced 2025-10-16 12:31:51 +08:00
ad22e23aee
Create a new session key ring '_ses' for every container. This avoids sharing the key structure with the process that created the container and the container inherits from. This patch fixes it init and exec. Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>
50 lines
1.3 KiB
Go
50 lines
1.3 KiB
Go
// +build linux
|
|
|
|
package libcontainer
|
|
|
|
import (
|
|
"os"
|
|
|
|
"github.com/opencontainers/runc/libcontainer/apparmor"
|
|
"github.com/opencontainers/runc/libcontainer/keys"
|
|
"github.com/opencontainers/runc/libcontainer/label"
|
|
"github.com/opencontainers/runc/libcontainer/seccomp"
|
|
"github.com/opencontainers/runc/libcontainer/system"
|
|
)
|
|
|
|
// linuxSetnsInit performs the container's initialization for running a new process
|
|
// inside an existing container.
|
|
type linuxSetnsInit struct {
|
|
config *initConfig
|
|
}
|
|
|
|
func (l *linuxSetnsInit) Init() error {
|
|
// do not inherit the parent's session keyring
|
|
if _, err := keyctl.JoinSessionKeyring("_ses"); err != nil {
|
|
return err
|
|
}
|
|
if err := setupRlimits(l.config.Config); err != nil {
|
|
return err
|
|
}
|
|
if err := setOomScoreAdj(l.config.Config.OomScoreAdj); err != nil {
|
|
return err
|
|
}
|
|
if l.config.Config.Seccomp != nil {
|
|
if err := seccomp.InitSeccomp(l.config.Config.Seccomp); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if err := finalizeNamespace(l.config); err != nil {
|
|
return err
|
|
}
|
|
if err := apparmor.ApplyProfile(l.config.Config.AppArmorProfile); err != nil {
|
|
return err
|
|
}
|
|
if l.config.Config.ProcessLabel != "" {
|
|
if err := label.SetProcessLabel(l.config.Config.ProcessLabel); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return system.Execv(l.config.Args[0], l.config.Args[0:], os.Environ())
|
|
}
|