jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix STDIO ownership for non-tty processes 

When we are using user namespaces we need to make sure that when we do
not have a TTY we change the ownership of the pipe()'s used for the
process to the root user within the container so that when you call
open() on any of the /proc/self/fd/*'s you do not get an EPERM.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This commit is contained in:
Michael Crosby 2015-09-18 11:35:23 -07:00
parent a0f4c39049
commit 4a91d2c6e7
1 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
tty.go
View File

@ -6,6 +6,7 @@ import (
"fmt" "fmt"
"io" "io"
"os" "os"
"syscall"
"github.com/docker/docker/pkg/term" "github.com/docker/docker/pkg/term"
"github.com/opencontainers/runc/libcontainer" "github.com/opencontainers/runc/libcontainer"
@ -18,34 +19,45 @@ func newTty(create bool, p *libcontainer.Process, rootuid int) (*tty, error) {
if create { if create {
return createTty(p, rootuid) return createTty(p, rootuid)
} }
return createStdioPipes(p) return createStdioPipes(p, rootuid)
} }
// setup standard pipes so that the TTY of the calling runc process // setup standard pipes so that the TTY of the calling runc process
// is not inherited by the container. // is not inherited by the container.
func createStdioPipes(p *libcontainer.Process) (*tty, error) { func createStdioPipes(p *libcontainer.Process, rootuid int) (*tty, error) {
t := &tty{} var (
t = &tty{}
fds []int
)
r, w, err := os.Pipe() r, w, err := os.Pipe()
if err != nil { if err != nil {
return nil, err return nil, err
} }
fds = append(fds, int(r.Fd()), int(w.Fd()))
go io.Copy(w, os.Stdin) go io.Copy(w, os.Stdin)
t.closers = append(t.closers, w) t.closers = append(t.closers, w)
p.Stdin = r p.Stdin = r
if r, w, err = os.Pipe(); err != nil { if r, w, err = os.Pipe(); err != nil {
return nil, err return nil, err
} }
fds = append(fds, int(r.Fd()), int(w.Fd()))
go io.Copy(os.Stdout, r) go io.Copy(os.Stdout, r)
p.Stdout = w p.Stdout = w
t.closers = append(t.closers, r) t.closers = append(t.closers, r)
if r, w, err = os.Pipe(); err != nil { if r, w, err = os.Pipe(); err != nil {
return nil, err return nil, err
} }
fds = append(fds, int(r.Fd()), int(w.Fd()))
go io.Copy(os.Stderr, r) go io.Copy(os.Stderr, r)
p.Stderr = w p.Stderr = w
t.closers = append(t.closers, r) t.closers = append(t.closers, r)
// change the ownership of the pipe fds incase we are in a user namespace.
for _, fd := range fds {
if err := syscall.Fchown(fd, rootuid, rootuid); err != nil {
return nil, err
}
}
return t, nil return t, nil
} }
func createTty(p *libcontainer.Process, rootuid int) (*tty, error) { func createTty(p *libcontainer.Process, rootuid int) (*tty, error) {