From a2dc64cf30831fc78813215e7317a086341856c5 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Mon, 14 Jul 2014 16:46:51 -0700 Subject: [PATCH 1/3] Add initial system pkg to libcontainer Port over console and ptmx code into console package Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- console/console.go | 83 ++++++++++++++++++++++++++++++++++++++----- namespaces/exec.go | 13 +++++-- namespaces/execin.go | 2 +- network/netns.go | 5 ++- system/linux.go | 17 +++++++++ system/proc.go | 27 ++++++++++++++ system/setns_linux.go | 29 +++++++++++++++ 7 files changed, 164 insertions(+), 12 deletions(-) create mode 100644 system/linux.go create mode 100644 system/proc.go create mode 100644 system/setns_linux.go diff --git a/console/console.go b/console/console.go index 519b5644..5355d63d 100644 --- a/console/console.go +++ b/console/console.go @@ -7,22 +7,24 @@ import ( "os" "path/filepath" "syscall" + "unsafe" "github.com/docker/libcontainer/label" - "github.com/dotcloud/docker/pkg/system" ) // Setup initializes the proper /dev/console inside the rootfs path func Setup(rootfs, consolePath, mountLabel string) error { - oldMask := system.Umask(0000) - defer system.Umask(oldMask) + oldMask := syscall.Umask(0000) + defer syscall.Umask(oldMask) if err := os.Chmod(consolePath, 0600); err != nil { return err } + if err := os.Chown(consolePath, 0, 0); err != nil { return err } + if err := label.SetFileLabel(consolePath, mountLabel); err != nil { return fmt.Errorf("set file label %s %s", consolePath, err) } @@ -33,26 +35,91 @@ func Setup(rootfs, consolePath, mountLabel string) error { if err != nil && !os.IsExist(err) { return fmt.Errorf("create %s %s", dest, err) } + if f != nil { f.Close() } - if err := system.Mount(consolePath, dest, "bind", syscall.MS_BIND, ""); err != nil { + if err := syscall.Mount(consolePath, dest, "bind", syscall.MS_BIND, ""); err != nil { return fmt.Errorf("bind %s to %s %s", consolePath, dest, err) } + return nil } func OpenAndDup(consolePath string) error { - slave, err := system.OpenTerminal(consolePath, syscall.O_RDWR) + slave, err := OpenTerminal(consolePath, syscall.O_RDWR) if err != nil { return fmt.Errorf("open terminal %s", err) } - if err := system.Dup2(slave.Fd(), 0); err != nil { + + if err := syscall.Dup2(int(slave.Fd()), 0); err != nil { return err } - if err := system.Dup2(slave.Fd(), 1); err != nil { + + if err := syscall.Dup2(int(slave.Fd()), 1); err != nil { return err } - return system.Dup2(slave.Fd(), 2) + + return syscall.Dup2(int(slave.Fd()), 2) +} + +// Unlockpt unlocks the slave pseudoterminal device corresponding to the master pseudoterminal referred to by f. +// Unlockpt should be called before opening the slave side of a pseudoterminal. +func Unlockpt(f *os.File) error { + var u int + + return Ioctl(f.Fd(), syscall.TIOCSPTLCK, uintptr(unsafe.Pointer(&u))) +} + +// Ptsname retrieves the name of the first available pts for the given master. +func Ptsname(f *os.File) (string, error) { + var n int + + if err := Ioctl(f.Fd(), syscall.TIOCGPTN, uintptr(unsafe.Pointer(&n))); err != nil { + return "", err + } + + return fmt.Sprintf("/dev/pts/%d", n), nil +} + +// CreateMasterAndConsole will open /dev/ptmx on the host and retreive the +// pts name for use as the pty slave inside the container +func CreateMasterAndConsole() (*os.File, string, error) { + master, err := os.OpenFile("/dev/ptmx", syscall.O_RDWR|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0) + if err != nil { + return nil, "", err + } + console, err := Ptsname(master) + if err != nil { + return nil, "", err + } + if err := Unlockpt(master); err != nil { + return nil, "", err + } + return master, console, nil +} + +// OpenPtmx opens /dev/ptmx, i.e. the PTY master. +func OpenPtmx() (*os.File, error) { + // O_NOCTTY and O_CLOEXEC are not present in os package so we use the syscall's one for all. + return os.OpenFile("/dev/ptmx", syscall.O_RDONLY|syscall.O_NOCTTY|syscall.O_CLOEXEC, 0) +} + +// OpenTerminal is a clone of os.OpenFile without the O_CLOEXEC +// used to open the pty slave inside the container namespace +func OpenTerminal(name string, flag int) (*os.File, error) { + r, e := syscall.Open(name, flag, 0) + if e != nil { + return nil, &os.PathError{"open", name, e} + } + return os.NewFile(uintptr(r), name), nil +} + +func Ioctl(fd uintptr, flag, data uintptr) error { + if _, _, err := syscall.Syscall(syscall.SYS_IOCTL, fd, flag, data); err != 0 { + return err + } + + return nil } diff --git a/namespaces/exec.go b/namespaces/exec.go index 9053f632..bf297c08 100644 --- a/namespaces/exec.go +++ b/namespaces/exec.go @@ -11,6 +11,7 @@ import ( "github.com/docker/libcontainer/cgroups" "github.com/docker/libcontainer/cgroups/fs" "github.com/docker/libcontainer/cgroups/systemd" + consolePkg "github.com/docker/libcontainer/console" "github.com/docker/libcontainer/network" "github.com/docker/libcontainer/syncpipe" "github.com/dotcloud/docker/pkg/system" @@ -36,7 +37,7 @@ func Exec(container *libcontainer.Config, term Terminal, rootfs, dataPath string defer syncPipe.Close() if container.Tty { - master, console, err = system.CreateMasterAndConsole() + master, console, err = consolePkg.CreateMasterAndConsole() if err != nil { return -1, err } @@ -110,6 +111,7 @@ func Exec(container *libcontainer.Config, term Terminal, rootfs, dataPath string return -1, err } } + return command.ProcessState.Sys().(syscall.WaitStatus).ExitStatus(), nil } @@ -145,7 +147,11 @@ func DefaultCreateCommand(container *libcontainer.Config, console, rootfs, dataP command.Dir = rootfs command.Env = append(os.Environ(), env...) - system.SetCloneFlags(command, uintptr(GetNamespaceFlags(container.Namespaces))) + if command.SysProcAttr == nil { + command.SysProcAttr = &syscall.SysProcAttr{} + } + command.SysProcAttr.Cloneflags = uintptr(GetNamespaceFlags(container.Namespaces)) + command.SysProcAttr.Pdeathsig = syscall.SIGKILL command.ExtraFiles = []*os.File{pipe} @@ -157,11 +163,14 @@ func DefaultCreateCommand(container *libcontainer.Config, console, rootfs, dataP func SetupCgroups(container *libcontainer.Config, nspid int) (cgroups.ActiveCgroup, error) { if container.Cgroups != nil { c := container.Cgroups + if systemd.UseSystemd() { return systemd.Apply(c, nspid) } + return fs.Apply(c, nspid) } + return nil, nil } diff --git a/namespaces/execin.go b/namespaces/execin.go index 3e79f4cd..5311adf2 100644 --- a/namespaces/execin.go +++ b/namespaces/execin.go @@ -9,7 +9,7 @@ import ( "github.com/docker/libcontainer" "github.com/docker/libcontainer/label" - "github.com/dotcloud/docker/pkg/system" + "github.com/docker/libcontainer/system" ) // ExecIn uses an existing pid and joins the pid's namespaces with the new command. diff --git a/network/netns.go b/network/netns.go index 64544476..1ff75064 100644 --- a/network/netns.go +++ b/network/netns.go @@ -7,7 +7,7 @@ import ( "os" "syscall" - "github.com/dotcloud/docker/pkg/system" + "github.com/docker/libcontainer/system" ) // crosbymichael: could make a network strategy that instead of returning veth pair names it returns a pid to an existing network namespace @@ -23,12 +23,15 @@ func (v *NetNS) Initialize(config *Network, networkState *NetworkState) error { if networkState.NsPath == "" { return fmt.Errorf("nspath does is not specified in NetworkState") } + f, err := os.OpenFile(networkState.NsPath, os.O_RDONLY, 0) if err != nil { return fmt.Errorf("failed get network namespace fd: %v", err) } + if err := system.Setns(f.Fd(), syscall.CLONE_NEWNET); err != nil { return fmt.Errorf("failed to setns current network namespace: %v", err) } + return nil } diff --git a/system/linux.go b/system/linux.go new file mode 100644 index 00000000..511b951a --- /dev/null +++ b/system/linux.go @@ -0,0 +1,17 @@ +// +build linux + +package system + +import ( + "os/exec" + "syscall" +) + +func Execv(cmd string, args []string, env []string) error { + name, err := exec.LookPath(cmd) + if err != nil { + return err + } + + return syscall.Exec(name, args, env) +} diff --git a/system/proc.go b/system/proc.go new file mode 100644 index 00000000..37808a29 --- /dev/null +++ b/system/proc.go @@ -0,0 +1,27 @@ +package system + +import ( + "io/ioutil" + "path/filepath" + "strconv" + "strings" +) + +// look in /proc to find the process start time so that we can verify +// that this pid has started after ourself +func GetProcessStartTime(pid int) (string, error) { + data, err := ioutil.ReadFile(filepath.Join("/proc", strconv.Itoa(pid), "stat")) + if err != nil { + return "", err + } + + parts := strings.Split(string(data), " ") + // the starttime is located at pos 22 + // from the man page + // + // starttime %llu (was %lu before Linux 2.6) + // (22) The time the process started after system boot. In kernels before Linux 2.6, this + // value was expressed in jiffies. Since Linux 2.6, the value is expressed in clock ticks + // (divide by sysconf(_SC_CLK_TCK)). + return parts[22-1], nil // starts at 1 +} diff --git a/system/setns_linux.go b/system/setns_linux.go new file mode 100644 index 00000000..a0a259e1 --- /dev/null +++ b/system/setns_linux.go @@ -0,0 +1,29 @@ +package system + +import ( + "fmt" + "runtime" + "syscall" +) + +// Via http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7b21fddd087678a70ad64afc0f632e0f1071b092 +// +// We need different setns values for the different platforms and arch +// We are declaring the macro here because the SETNS syscall does not exist in th stdlib +var setNsMap = map[string]uintptr{ + "linux/amd64": 308, +} + +func Setns(fd uintptr, flags uintptr) error { + ns, exists := setNsMap[fmt.Sprintf("%s/%s", runtime.GOOS, runtime.GOARCH)] + if !exists { + return fmt.Errorf("unsupported platform %s/%s", runtime.GOOS, runtime.GOARCH) + } + + _, _, err := syscall.RawSyscall(ns, fd, flags, 0) + if err != 0 { + return err + } + + return nil +} From e9ec77ab348f4a69d6fedfe46d9b6440ceb649b3 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Mon, 14 Jul 2014 16:55:49 -0700 Subject: [PATCH 2/3] Migrate selinux system xattr calls and prctl calls Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- mount/init.go | 17 +++++----- mount/msmoveroot.go | 9 +++--- mount/nodes/nodes.go | 7 ++--- namespaces/exec.go | 2 +- namespaces/init.go | 18 ++++++----- security/restrict/restrict.go | 10 +++--- selinux/selinux.go | 13 ++++---- system/linux.go | 43 +++++++++++++++++++++++++ system/xattrs_linux.go | 59 +++++++++++++++++++++++++++++++++++ 9 files changed, 141 insertions(+), 37 deletions(-) create mode 100644 system/xattrs_linux.go diff --git a/mount/init.go b/mount/init.go index 10f07389..daec6ac8 100644 --- a/mount/init.go +++ b/mount/init.go @@ -11,7 +11,6 @@ import ( "github.com/docker/libcontainer/label" "github.com/docker/libcontainer/mount/nodes" "github.com/dotcloud/docker/pkg/symlink" - "github.com/dotcloud/docker/pkg/system" ) // default mount point flags @@ -35,10 +34,10 @@ func InitializeMountNamespace(rootfs, console string, mountConfig *MountConfig) if mountConfig.NoPivotRoot { flag = syscall.MS_SLAVE } - if err := system.Mount("", "/", "", uintptr(flag|syscall.MS_REC), ""); err != nil { + if err := syscall.Mount("", "/", "", uintptr(flag|syscall.MS_REC), ""); err != nil { return fmt.Errorf("mounting / with flags %X %s", (flag | syscall.MS_REC), err) } - if err := system.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil { + if err := syscall.Mount(rootfs, rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, ""); err != nil { return fmt.Errorf("mouting %s as bind %s", rootfs, err) } if err := mountSystem(rootfs, mountConfig); err != nil { @@ -56,7 +55,7 @@ func InitializeMountNamespace(rootfs, console string, mountConfig *MountConfig) if err := setupDevSymlinks(rootfs); err != nil { return fmt.Errorf("dev symlinks %s", err) } - if err := system.Chdir(rootfs); err != nil { + if err := syscall.Chdir(rootfs); err != nil { return fmt.Errorf("chdir into %s %s", rootfs, err) } @@ -75,7 +74,7 @@ func InitializeMountNamespace(rootfs, console string, mountConfig *MountConfig) } } - system.Umask(0022) + syscall.Umask(0022) return nil } @@ -87,7 +86,7 @@ func mountSystem(rootfs string, mountConfig *MountConfig) error { if err := os.MkdirAll(m.path, 0755); err != nil && !os.IsExist(err) { return fmt.Errorf("mkdirall %s %s", m.path, err) } - if err := system.Mount(m.source, m.path, m.device, uintptr(m.flags), m.data); err != nil { + if err := syscall.Mount(m.source, m.path, m.device, uintptr(m.flags), m.data); err != nil { return fmt.Errorf("mounting %s into %s %s", m.source, m.path, err) } } @@ -169,11 +168,11 @@ func setupBindmounts(rootfs string, mountConfig *MountConfig) error { return fmt.Errorf("Creating new bind-mount target, %s", err) } - if err := system.Mount(m.Source, dest, "bind", uintptr(flags), ""); err != nil { + if err := syscall.Mount(m.Source, dest, "bind", uintptr(flags), ""); err != nil { return fmt.Errorf("mounting %s into %s %s", m.Source, dest, err) } if !m.Writable { - if err := system.Mount(m.Source, dest, "bind", uintptr(flags|syscall.MS_REMOUNT), ""); err != nil { + if err := syscall.Mount(m.Source, dest, "bind", uintptr(flags|syscall.MS_REMOUNT), ""); err != nil { return fmt.Errorf("remounting %s into %s %s", m.Source, dest, err) } } @@ -183,7 +182,7 @@ func setupBindmounts(rootfs string, mountConfig *MountConfig) error { } } if m.Private { - if err := system.Mount("", dest, "none", uintptr(syscall.MS_PRIVATE), ""); err != nil { + if err := syscall.Mount("", dest, "none", uintptr(syscall.MS_PRIVATE), ""); err != nil { return fmt.Errorf("mounting %s private %s", dest, err) } } diff --git a/mount/msmoveroot.go b/mount/msmoveroot.go index b336c864..94afd3a9 100644 --- a/mount/msmoveroot.go +++ b/mount/msmoveroot.go @@ -4,16 +4,17 @@ package mount import ( "fmt" - "github.com/dotcloud/docker/pkg/system" "syscall" ) func MsMoveRoot(rootfs string) error { - if err := system.Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil { + if err := syscall.Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil { return fmt.Errorf("mount move %s into / %s", rootfs, err) } - if err := system.Chroot("."); err != nil { + + if err := syscall.Chroot("."); err != nil { return fmt.Errorf("chroot . %s", err) } - return system.Chdir("/") + + return syscall.Chdir("/") } diff --git a/mount/nodes/nodes.go b/mount/nodes/nodes.go index e3420b48..6a984e33 100644 --- a/mount/nodes/nodes.go +++ b/mount/nodes/nodes.go @@ -9,13 +9,12 @@ import ( "syscall" "github.com/docker/libcontainer/devices" - "github.com/dotcloud/docker/pkg/system" ) // Create the device nodes in the container. func CreateDeviceNodes(rootfs string, nodesToCreate []*devices.Device) error { - oldMask := system.Umask(0000) - defer system.Umask(oldMask) + oldMask := syscall.Umask(0000) + defer syscall.Umask(oldMask) for _, node := range nodesToCreate { if err := CreateDeviceNode(rootfs, node); err != nil { @@ -46,7 +45,7 @@ func CreateDeviceNode(rootfs string, node *devices.Device) error { return fmt.Errorf("%c is not a valid device type for device %s", node.Type, node.Path) } - if err := system.Mknod(dest, uint32(fileMode), devices.Mkdev(node.MajorNumber, node.MinorNumber)); err != nil && !os.IsExist(err) { + if err := syscall.Mknod(dest, uint32(fileMode), devices.Mkdev(node.MajorNumber, node.MinorNumber)); err != nil && !os.IsExist(err) { return fmt.Errorf("mknod %s %s", node.Path, err) } return nil diff --git a/namespaces/exec.go b/namespaces/exec.go index bf297c08..ee87250e 100644 --- a/namespaces/exec.go +++ b/namespaces/exec.go @@ -14,7 +14,7 @@ import ( consolePkg "github.com/docker/libcontainer/console" "github.com/docker/libcontainer/network" "github.com/docker/libcontainer/syncpipe" - "github.com/dotcloud/docker/pkg/system" + "github.com/docker/libcontainer/system" ) // TODO(vishh): This is part of the libcontainer API and it does much more than just namespaces related work. diff --git a/namespaces/init.go b/namespaces/init.go index 4674944c..7c917c01 100644 --- a/namespaces/init.go +++ b/namespaces/init.go @@ -19,8 +19,8 @@ import ( "github.com/docker/libcontainer/security/capabilities" "github.com/docker/libcontainer/security/restrict" "github.com/docker/libcontainer/syncpipe" + "github.com/docker/libcontainer/system" "github.com/docker/libcontainer/utils" - "github.com/dotcloud/docker/pkg/system" "github.com/dotcloud/docker/pkg/user" ) @@ -57,7 +57,7 @@ func Init(container *libcontainer.Config, uncleanRootfs, consolePath string, syn return err } } - if _, err := system.Setsid(); err != nil { + if _, err := syscall.Setsid(); err != nil { return fmt.Errorf("setsid %s", err) } if consolePath != "" { @@ -81,7 +81,7 @@ func Init(container *libcontainer.Config, uncleanRootfs, consolePath string, syn } if container.Hostname != "" { - if err := system.Sethostname(container.Hostname); err != nil { + if err := syscall.Sethostname([]byte(container.Hostname)); err != nil { return fmt.Errorf("sethostname %s", err) } } @@ -155,15 +155,19 @@ func SetupUser(u string) error { if err != nil { return fmt.Errorf("get supplementary groups %s", err) } - if err := system.Setgroups(suppGids); err != nil { + + if err := syscall.Setgroups(suppGids); err != nil { return fmt.Errorf("setgroups %s", err) } - if err := system.Setgid(gid); err != nil { + + if err := syscall.Setgid(gid); err != nil { return fmt.Errorf("setgid %s", err) } - if err := system.Setuid(uid); err != nil { + + if err := syscall.Setuid(uid); err != nil { return fmt.Errorf("setuid %s", err) } + return nil } @@ -229,7 +233,7 @@ func FinalizeNamespace(container *libcontainer.Config) error { } if container.WorkingDir != "" { - if err := system.Chdir(container.WorkingDir); err != nil { + if err := syscall.Chdir(container.WorkingDir); err != nil { return fmt.Errorf("chdir to %s %s", container.WorkingDir, err) } } diff --git a/security/restrict/restrict.go b/security/restrict/restrict.go index ff7ae2fe..dd765b1f 100644 --- a/security/restrict/restrict.go +++ b/security/restrict/restrict.go @@ -7,23 +7,21 @@ import ( "os" "syscall" "time" - - "github.com/dotcloud/docker/pkg/system" ) const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV func mountReadonly(path string) error { for i := 0; i < 5; i++ { - if err := system.Mount("", path, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil && !os.IsNotExist(err) { + if err := syscall.Mount("", path, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil && !os.IsNotExist(err) { switch err { case syscall.EINVAL: // Probably not a mountpoint, use bind-mount - if err := system.Mount(path, path, "", syscall.MS_BIND, ""); err != nil { + if err := syscall.Mount(path, path, "", syscall.MS_BIND, ""); err != nil { return err } - return system.Mount(path, path, "", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC|defaultMountFlags, "") + return syscall.Mount(path, path, "", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC|defaultMountFlags, "") case syscall.EBUSY: time.Sleep(100 * time.Millisecond) continue @@ -47,7 +45,7 @@ func Restrict(mounts ...string) error { } } - if err := system.Mount("/dev/null", "/proc/kcore", "", syscall.MS_BIND, ""); err != nil && !os.IsNotExist(err) { + if err := syscall.Mount("/dev/null", "/proc/kcore", "", syscall.MS_BIND, ""); err != nil && !os.IsNotExist(err) { return fmt.Errorf("unable to bind-mount /dev/null over /proc/kcore: %s", err) } diff --git a/selinux/selinux.go b/selinux/selinux.go index 709eb9d8..8dbdbdbc 100644 --- a/selinux/selinux.go +++ b/selinux/selinux.go @@ -5,8 +5,6 @@ import ( "crypto/rand" "encoding/binary" "fmt" - "github.com/dotcloud/docker/pkg/mount" - "github.com/dotcloud/docker/pkg/system" "io" "os" "path/filepath" @@ -14,6 +12,9 @@ import ( "strconv" "strings" "syscall" + + "github.com/docker/libcontainer/system" + "github.com/dotcloud/docker/pkg/mount" ) const ( @@ -153,16 +154,16 @@ func Getfilecon(path string) (string, error) { } func Setfscreatecon(scon string) error { - return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", system.Gettid()), scon) + return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", syscall.Gettid()), scon) } func Getfscreatecon() (string, error) { - return readCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", system.Gettid())) + return readCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", syscall.Gettid())) } // Return the SELinux label of the current process thread. func Getcon() (string, error) { - return readCon(fmt.Sprintf("/proc/self/task/%d/attr/current", system.Gettid())) + return readCon(fmt.Sprintf("/proc/self/task/%d/attr/current", syscall.Gettid())) } func Getpidcon(pid int) (string, error) { @@ -192,7 +193,7 @@ func writeCon(name string, val string) error { } func Setexeccon(scon string) error { - return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/exec", system.Gettid()), scon) + return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/exec", syscall.Gettid()), scon) } func (c SELinuxContext) Get() string { diff --git a/system/linux.go b/system/linux.go index 511b951a..c07ef153 100644 --- a/system/linux.go +++ b/system/linux.go @@ -5,6 +5,7 @@ package system import ( "os/exec" "syscall" + "unsafe" ) func Execv(cmd string, args []string, env []string) error { @@ -15,3 +16,45 @@ func Execv(cmd string, args []string, env []string) error { return syscall.Exec(name, args, env) } + +func ParentDeathSignal(sig uintptr) error { + if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, sig, 0); err != 0 { + return err + } + return nil +} + +func GetParentDeathSignal() (int, error) { + var sig int + + _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_GET_PDEATHSIG, uintptr(unsafe.Pointer(&sig)), 0) + + if err != 0 { + return -1, err + } + + return sig, nil +} + +func SetKeepCaps() error { + if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_KEEPCAPS, 1, 0); err != 0 { + return err + } + + return nil +} + +func ClearKeepCaps() error { + if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_KEEPCAPS, 0, 0); err != 0 { + return err + } + + return nil +} + +func Setctty() error { + if _, _, err := syscall.RawSyscall(syscall.SYS_IOCTL, 0, uintptr(syscall.TIOCSCTTY), 0); err != 0 { + return err + } + return nil +} diff --git a/system/xattrs_linux.go b/system/xattrs_linux.go new file mode 100644 index 00000000..00edb201 --- /dev/null +++ b/system/xattrs_linux.go @@ -0,0 +1,59 @@ +package system + +import ( + "syscall" + "unsafe" +) + +// Returns a nil slice and nil error if the xattr is not set +func Lgetxattr(path string, attr string) ([]byte, error) { + pathBytes, err := syscall.BytePtrFromString(path) + if err != nil { + return nil, err + } + attrBytes, err := syscall.BytePtrFromString(attr) + if err != nil { + return nil, err + } + + dest := make([]byte, 128) + destBytes := unsafe.Pointer(&dest[0]) + sz, _, errno := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0) + if errno == syscall.ENODATA { + return nil, nil + } + if errno == syscall.ERANGE { + dest = make([]byte, sz) + destBytes := unsafe.Pointer(&dest[0]) + sz, _, errno = syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0) + } + if errno != 0 { + return nil, errno + } + + return dest[:sz], nil +} + +var _zero uintptr + +func Lsetxattr(path string, attr string, data []byte, flags int) error { + pathBytes, err := syscall.BytePtrFromString(path) + if err != nil { + return err + } + attrBytes, err := syscall.BytePtrFromString(attr) + if err != nil { + return err + } + var dataBytes unsafe.Pointer + if len(data) > 0 { + dataBytes = unsafe.Pointer(&data[0]) + } else { + dataBytes = unsafe.Pointer(&_zero) + } + _, _, errno := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(dataBytes), uintptr(len(data)), uintptr(flags), 0) + if errno != 0 { + return errno + } + return nil +} From 8947d07576e75d835452405477ca780a20c46fe5 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Mon, 14 Jul 2014 17:00:05 -0700 Subject: [PATCH 3/3] Finish removing the dependency on docker/pkg/system Fixes #92 Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- cgroups/fs/cpuacct.go | 2 +- mount/pivotroot.go | 12 +++++++----- mount/ptmx.go | 6 +++++- mount/readonly.go | 3 +-- mount/remount.go | 16 ++++++++-------- system/sysconfig.go | 13 +++++++++++++ 6 files changed, 35 insertions(+), 17 deletions(-) create mode 100644 system/sysconfig.go diff --git a/cgroups/fs/cpuacct.go b/cgroups/fs/cpuacct.go index be180520..7979009c 100644 --- a/cgroups/fs/cpuacct.go +++ b/cgroups/fs/cpuacct.go @@ -12,7 +12,7 @@ import ( "time" "github.com/docker/libcontainer/cgroups" - "github.com/dotcloud/docker/pkg/system" + "github.com/docker/libcontainer/system" ) var ( diff --git a/mount/pivotroot.go b/mount/pivotroot.go index ffd60513..a88ed4a8 100644 --- a/mount/pivotroot.go +++ b/mount/pivotroot.go @@ -8,8 +8,6 @@ import ( "os" "path/filepath" "syscall" - - "github.com/dotcloud/docker/pkg/system" ) func PivotRoot(rootfs string) error { @@ -17,16 +15,20 @@ func PivotRoot(rootfs string) error { if err != nil { return fmt.Errorf("can't create pivot_root dir %s, error %v", pivotDir, err) } - if err := system.Pivotroot(rootfs, pivotDir); err != nil { + + if err := syscall.PivotRoot(rootfs, pivotDir); err != nil { return fmt.Errorf("pivot_root %s", err) } - if err := system.Chdir("/"); err != nil { + + if err := syscall.Chdir("/"); err != nil { return fmt.Errorf("chdir / %s", err) } + // path to pivot dir now changed, update pivotDir = filepath.Join("/", filepath.Base(pivotDir)) - if err := system.Unmount(pivotDir, syscall.MNT_DETACH); err != nil { + if err := syscall.Unmount(pivotDir, syscall.MNT_DETACH); err != nil { return fmt.Errorf("unmount pivot_root dir %s", err) } + return os.Remove(pivotDir) } diff --git a/mount/ptmx.go b/mount/ptmx.go index 32c02520..c316481a 100644 --- a/mount/ptmx.go +++ b/mount/ptmx.go @@ -4,9 +4,10 @@ package mount import ( "fmt" - "github.com/docker/libcontainer/console" "os" "path/filepath" + + "github.com/docker/libcontainer/console" ) func SetupPtmx(rootfs, consolePath, mountLabel string) error { @@ -14,13 +15,16 @@ func SetupPtmx(rootfs, consolePath, mountLabel string) error { if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) { return err } + if err := os.Symlink("pts/ptmx", ptmx); err != nil { return fmt.Errorf("symlink dev ptmx %s", err) } + if consolePath != "" { if err := console.Setup(rootfs, consolePath, mountLabel); err != nil { return err } } + return nil } diff --git a/mount/readonly.go b/mount/readonly.go index 0658358a..9b4a6f70 100644 --- a/mount/readonly.go +++ b/mount/readonly.go @@ -3,10 +3,9 @@ package mount import ( - "github.com/dotcloud/docker/pkg/system" "syscall" ) func SetReadonly() error { - return system.Mount("/", "/", "bind", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC, "") + return syscall.Mount("/", "/", "bind", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC, "") } diff --git a/mount/remount.go b/mount/remount.go index 3e00509a..99a01209 100644 --- a/mount/remount.go +++ b/mount/remount.go @@ -2,30 +2,30 @@ package mount -import ( - "github.com/dotcloud/docker/pkg/system" - "syscall" -) +import "syscall" func RemountProc() error { - if err := system.Unmount("/proc", syscall.MNT_DETACH); err != nil { + if err := syscall.Unmount("/proc", syscall.MNT_DETACH); err != nil { return err } - if err := system.Mount("proc", "/proc", "proc", uintptr(defaultMountFlags), ""); err != nil { + + if err := syscall.Mount("proc", "/proc", "proc", uintptr(defaultMountFlags), ""); err != nil { return err } + return nil } func RemountSys() error { - if err := system.Unmount("/sys", syscall.MNT_DETACH); err != nil { + if err := syscall.Unmount("/sys", syscall.MNT_DETACH); err != nil { if err != syscall.EINVAL { return err } } else { - if err := system.Mount("sysfs", "/sys", "sysfs", uintptr(defaultMountFlags), ""); err != nil { + if err := syscall.Mount("sysfs", "/sys", "sysfs", uintptr(defaultMountFlags), ""); err != nil { return err } } + return nil } diff --git a/system/sysconfig.go b/system/sysconfig.go new file mode 100644 index 00000000..dcbe6c9c --- /dev/null +++ b/system/sysconfig.go @@ -0,0 +1,13 @@ +// +build linux,cgo + +package system + +/* +#include +int get_hz(void) { return sysconf(_SC_CLK_TCK); } +*/ +import "C" + +func GetClockTicks() int { + return int(C.get_hz()) +}