2015-10-17 23:35:36 +08:00
|
|
|
// +build linux
|
|
|
|
|
|
|
|
package libcontainer
|
|
|
|
|
|
|
|
import (
|
|
|
|
"github.com/vishvananda/netlink/nl"
|
2017-06-02 16:38:42 +08:00
|
|
|
"golang.org/x/sys/unix"
|
2015-10-17 23:35:36 +08:00
|
|
|
)
|
|
|
|
|
|
|
|
// list of known message types we want to send to bootstrap program
|
|
|
|
// The number is randomly chosen to not conflict with known netlink types
|
|
|
|
const (
|
Disable rootless mode except RootlessCgMgr when executed as the root in userns
This PR decomposes `libcontainer/configs.Config.Rootless bool` into `RootlessEUID bool` and
`RootlessCgroups bool`, so as to make "runc-in-userns" to be more compatible with "rootful" runc.
`RootlessEUID` denotes that runc is being executed as a non-root user (euid != 0) in
the current user namespace. `RootlessEUID` is almost identical to the former `Rootless`
except cgroups stuff.
`RootlessCgroups` denotes that runc is unlikely to have the full access to cgroups.
`RootlessCgroups` is set to false if runc is executed as the root (euid == 0) in the initial namespace.
Otherwise `RootlessCgroups` is set to true.
(Hint: if `RootlessEUID` is true, `RootlessCgroups` becomes true as well)
When runc is executed as the root (euid == 0) in an user namespace (e.g. by Docker-in-LXD, Podman, Usernetes),
`RootlessEUID` is set to false but `RootlessCgroups` is set to true.
So, "runc-in-userns" behaves almost same as "rootful" runc except that cgroups errors are ignored.
This PR does not have any impact on CLI flags and `state.json`.
Note about CLI:
* Now `runc --rootless=(auto|true|false)` CLI flag is only used for setting `RootlessCgroups`.
* Now `runc spec --rootless` is only required when `RootlessEUID` is set to true.
For runc-in-userns, `runc spec` without `--rootless` should work, when sufficient numbers of
UID/GID are mapped.
Note about `$XDG_RUNTIME_DIR` (e.g. `/run/user/1000`):
* `$XDG_RUNTIME_DIR` is ignored if runc is being executed as the root (euid == 0) in the initial namespace, for backward compatibility.
(`/run/runc` is used)
* If runc is executed as the root (euid == 0) in an user namespace, `$XDG_RUNTIME_DIR` is honored if `$USER != "" && $USER != "root"`.
This allows unprivileged users to allow execute runc as the root in userns, without mounting writable `/run/runc`.
Note about `state.json`:
* `rootless` is set to true when `RootlessEUID == true && RootlessCgroups == true`.
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
2018-07-05 14:28:21 +08:00
|
|
|
InitMsg uint16 = 62000
|
|
|
|
CloneFlagsAttr uint16 = 27281
|
|
|
|
NsPathsAttr uint16 = 27282
|
|
|
|
UidmapAttr uint16 = 27283
|
|
|
|
GidmapAttr uint16 = 27284
|
|
|
|
SetgroupAttr uint16 = 27285
|
|
|
|
OomScoreAdjAttr uint16 = 27286
|
|
|
|
RootlessEUIDAttr uint16 = 27287
|
|
|
|
UidmapPathAttr uint16 = 27288
|
|
|
|
GidmapPathAttr uint16 = 27289
|
2015-10-17 23:35:36 +08:00
|
|
|
)
|
|
|
|
|
|
|
|
type Int32msg struct {
|
|
|
|
Type uint16
|
|
|
|
Value uint32
|
|
|
|
}
|
|
|
|
|
2016-04-12 16:12:23 +08:00
|
|
|
// Serialize serializes the message.
|
|
|
|
// Int32msg has the following representation
|
2015-10-17 23:35:36 +08:00
|
|
|
// | nlattr len | nlattr type |
|
|
|
|
// | uint32 value |
|
|
|
|
func (msg *Int32msg) Serialize() []byte {
|
|
|
|
buf := make([]byte, msg.Len())
|
|
|
|
native := nl.NativeEndian()
|
|
|
|
native.PutUint16(buf[0:2], uint16(msg.Len()))
|
|
|
|
native.PutUint16(buf[2:4], msg.Type)
|
|
|
|
native.PutUint32(buf[4:8], msg.Value)
|
|
|
|
return buf
|
|
|
|
}
|
|
|
|
|
|
|
|
func (msg *Int32msg) Len() int {
|
2017-06-02 16:38:42 +08:00
|
|
|
return unix.NLA_HDRLEN + 4
|
2015-10-17 23:35:36 +08:00
|
|
|
}
|
|
|
|
|
2016-04-12 16:12:23 +08:00
|
|
|
// Bytemsg has the following representation
|
2015-10-17 23:35:36 +08:00
|
|
|
// | nlattr len | nlattr type |
|
|
|
|
// | value | pad |
|
|
|
|
type Bytemsg struct {
|
|
|
|
Type uint16
|
|
|
|
Value []byte
|
|
|
|
}
|
|
|
|
|
|
|
|
func (msg *Bytemsg) Serialize() []byte {
|
|
|
|
l := msg.Len()
|
2017-06-02 16:38:42 +08:00
|
|
|
buf := make([]byte, (l+unix.NLA_ALIGNTO-1) & ^(unix.NLA_ALIGNTO-1))
|
2015-10-17 23:35:36 +08:00
|
|
|
native := nl.NativeEndian()
|
|
|
|
native.PutUint16(buf[0:2], uint16(l))
|
|
|
|
native.PutUint16(buf[2:4], msg.Type)
|
|
|
|
copy(buf[4:], msg.Value)
|
|
|
|
return buf
|
|
|
|
}
|
|
|
|
|
|
|
|
func (msg *Bytemsg) Len() int {
|
2017-06-02 16:38:42 +08:00
|
|
|
return unix.NLA_HDRLEN + len(msg.Value) + 1 // null-terminated
|
2015-10-17 23:35:36 +08:00
|
|
|
}
|
2015-09-14 08:40:43 +08:00
|
|
|
|
|
|
|
type Boolmsg struct {
|
|
|
|
Type uint16
|
|
|
|
Value bool
|
|
|
|
}
|
|
|
|
|
|
|
|
func (msg *Boolmsg) Serialize() []byte {
|
|
|
|
buf := make([]byte, msg.Len())
|
|
|
|
native := nl.NativeEndian()
|
|
|
|
native.PutUint16(buf[0:2], uint16(msg.Len()))
|
|
|
|
native.PutUint16(buf[2:4], msg.Type)
|
|
|
|
if msg.Value {
|
2018-01-15 17:09:08 +08:00
|
|
|
native.PutUint32(buf[4:8], uint32(1))
|
2015-09-14 08:40:43 +08:00
|
|
|
} else {
|
2018-01-15 17:09:08 +08:00
|
|
|
native.PutUint32(buf[4:8], uint32(0))
|
2015-09-14 08:40:43 +08:00
|
|
|
}
|
|
|
|
return buf
|
|
|
|
}
|
|
|
|
|
|
|
|
func (msg *Boolmsg) Len() int {
|
2018-01-15 17:09:08 +08:00
|
|
|
return unix.NLA_HDRLEN + 4 // alignment
|
2015-09-14 08:40:43 +08:00
|
|
|
}
|