2015-02-07 04:48:57 +08:00
|
|
|
// +build linux
|
|
|
|
|
|
|
|
package libcontainer
|
|
|
|
|
|
|
|
import (
|
2016-02-23 04:36:12 +08:00
|
|
|
"fmt"
|
2015-03-06 06:33:13 +08:00
|
|
|
"os"
|
2018-06-08 01:52:01 +08:00
|
|
|
"runtime"
|
2015-03-06 06:33:13 +08:00
|
|
|
|
2015-06-22 10:29:59 +08:00
|
|
|
"github.com/opencontainers/runc/libcontainer/apparmor"
|
2016-01-21 07:12:25 +08:00
|
|
|
"github.com/opencontainers/runc/libcontainer/keys"
|
2015-06-30 02:12:54 +08:00
|
|
|
"github.com/opencontainers/runc/libcontainer/seccomp"
|
2015-06-22 10:29:59 +08:00
|
|
|
"github.com/opencontainers/runc/libcontainer/system"
|
2017-03-23 08:21:19 +08:00
|
|
|
"github.com/opencontainers/selinux/go-selinux/label"
|
2018-09-17 19:38:30 +08:00
|
|
|
"github.com/pkg/errors"
|
2017-06-07 21:03:15 +08:00
|
|
|
|
|
|
|
"golang.org/x/sys/unix"
|
2015-02-07 04:48:57 +08:00
|
|
|
)
|
|
|
|
|
|
|
|
// linuxSetnsInit performs the container's initialization for running a new process
|
|
|
|
// inside an existing container.
|
|
|
|
type linuxSetnsInit struct {
|
2017-03-03 04:53:06 +08:00
|
|
|
pipe *os.File
|
|
|
|
consoleSocket *os.File
|
|
|
|
config *initConfig
|
2015-02-07 04:48:57 +08:00
|
|
|
}
|
|
|
|
|
2016-02-23 04:36:12 +08:00
|
|
|
func (l *linuxSetnsInit) getSessionRingName() string {
|
|
|
|
return fmt.Sprintf("_ses.%s", l.config.ContainerId)
|
|
|
|
}
|
|
|
|
|
2016-06-07 04:15:18 +08:00
|
|
|
func (l *linuxSetnsInit) Init() error {
|
2018-06-08 01:52:01 +08:00
|
|
|
runtime.LockOSThread()
|
|
|
|
defer runtime.UnlockOSThread()
|
|
|
|
|
2016-06-04 02:53:07 +08:00
|
|
|
if !l.config.Config.NoNewKeyring {
|
2019-03-13 04:54:48 +08:00
|
|
|
if err := label.SetKeyLabel(l.config.ProcessLabel); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
defer label.SetKeyLabel("")
|
2018-09-17 19:38:30 +08:00
|
|
|
// Do not inherit the parent's session keyring.
|
2016-07-25 06:41:57 +08:00
|
|
|
if _, err := keys.JoinSessionKeyring(l.getSessionRingName()); err != nil {
|
2018-09-17 19:38:30 +08:00
|
|
|
// Same justification as in standart_init_linux.go as to why we
|
|
|
|
// don't bail on ENOSYS.
|
|
|
|
//
|
|
|
|
// TODO(cyphar): And we should have logging here too.
|
|
|
|
if errors.Cause(err) != unix.ENOSYS {
|
|
|
|
return errors.Wrap(err, "join session keyring")
|
|
|
|
}
|
2016-06-04 02:53:07 +08:00
|
|
|
}
|
2016-01-21 07:12:25 +08:00
|
|
|
}
|
2016-06-03 23:29:34 +08:00
|
|
|
if l.config.CreateConsole {
|
2017-03-03 04:53:06 +08:00
|
|
|
if err := setupConsole(l.consoleSocket, l.config, false); err != nil {
|
2016-06-03 23:29:34 +08:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := system.Setctty(); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
2016-03-04 02:44:33 +08:00
|
|
|
if l.config.NoNewPrivileges {
|
2017-07-13 21:29:10 +08:00
|
|
|
if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
|
2016-02-16 19:55:26 +08:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
2018-06-08 01:52:01 +08:00
|
|
|
if err := label.SetProcessLabel(l.config.ProcessLabel); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
defer label.SetProcessLabel("")
|
2017-08-24 15:00:50 +08:00
|
|
|
// Without NoNewPrivileges seccomp is a privileged operation, so we need to
|
|
|
|
// do this before dropping capabilities; otherwise do it as late as possible
|
|
|
|
// just before execve so as few syscalls take place after it as possible.
|
|
|
|
if l.config.Config.Seccomp != nil && !l.config.NoNewPrivileges {
|
2015-06-30 02:12:54 +08:00
|
|
|
if err := seccomp.InitSeccomp(l.config.Config.Seccomp); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
}
|
2015-02-07 04:48:57 +08:00
|
|
|
if err := finalizeNamespace(l.config); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
2016-03-04 02:44:33 +08:00
|
|
|
if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
|
2015-02-07 04:48:57 +08:00
|
|
|
return err
|
|
|
|
}
|
2017-08-24 15:00:50 +08:00
|
|
|
// Set seccomp as close to execve as possible, so as few syscalls take
|
|
|
|
// place afterward (reducing the amount of syscalls that users need to
|
|
|
|
// enable in their seccomp profiles).
|
|
|
|
if l.config.Config.Seccomp != nil && l.config.NoNewPrivileges {
|
|
|
|
if err := seccomp.InitSeccomp(l.config.Config.Seccomp); err != nil {
|
|
|
|
return newSystemErrorWithCause(err, "init seccomp")
|
|
|
|
}
|
|
|
|
}
|
2015-03-06 06:33:13 +08:00
|
|
|
return system.Execv(l.config.Args[0], l.config.Args[0:], os.Environ())
|
2015-02-07 04:48:57 +08:00
|
|
|
}
|