355 lines
9.7 KiB
Go
355 lines
9.7 KiB
Go
// +build linux
|
|
|
|
package libcontainer
|
|
|
|
import (
|
|
"fmt"
|
|
"io/ioutil"
|
|
"os"
|
|
"path/filepath"
|
|
"syscall"
|
|
"time"
|
|
|
|
"github.com/docker/libcontainer/configs"
|
|
"github.com/docker/libcontainer/label"
|
|
)
|
|
|
|
const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NODEV
|
|
|
|
var baseMounts = []*configs.Mount{
|
|
{
|
|
Source: "proc",
|
|
Destination: "/proc",
|
|
Device: "proc",
|
|
Flags: defaultMountFlags,
|
|
},
|
|
{
|
|
Source: "tmpfs",
|
|
Destination: "/dev",
|
|
Device: "tmpfs",
|
|
Flags: syscall.MS_NOSUID | syscall.MS_STRICTATIME,
|
|
Data: "mode=755",
|
|
},
|
|
{
|
|
Source: "devpts",
|
|
Destination: "/dev/pts",
|
|
Device: "devpts",
|
|
Flags: syscall.MS_NOSUID | syscall.MS_NOEXEC,
|
|
Data: "newinstance,ptmxmode=0666,mode=620,gid=5",
|
|
},
|
|
}
|
|
|
|
// setupRootfs sets up the devices, mount points, and filesystems for use inside a
|
|
// new mount namespace.
|
|
func setupRootfs(config *configs.Config) (err error) {
|
|
if err := prepareRoot(config); err != nil {
|
|
return err
|
|
}
|
|
for _, m := range append(baseMounts, config.Mounts...) {
|
|
if err := mount(m, config.Rootfs, config.MountLabel); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if err := createDevices(config); err != nil {
|
|
return err
|
|
}
|
|
if err := setupPtmx(config); err != nil {
|
|
return err
|
|
}
|
|
// stdin, stdout and stderr could be pointing to /dev/null from parent namespace.
|
|
// Re-open them inside this namespace.
|
|
// FIXME: Need to fix this for user namespaces.
|
|
if !config.Namespaces.Contains(configs.NEWUSER) {
|
|
if err := reOpenDevNull(config.Rootfs); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if err := setupDevSymlinks(config.Rootfs); err != nil {
|
|
return err
|
|
}
|
|
if err := syscall.Chdir(config.Rootfs); err != nil {
|
|
return err
|
|
}
|
|
if config.NoPivotRoot {
|
|
err = msMoveRoot(config.Rootfs)
|
|
} else {
|
|
err = pivotRoot(config.Rootfs, config.PivotDir)
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if config.Readonlyfs {
|
|
if err := setReadonly(); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
syscall.Umask(0022)
|
|
return nil
|
|
}
|
|
|
|
func mount(m *configs.Mount, rootfs, mountLabel string) error {
|
|
var (
|
|
dest = filepath.Join(rootfs, m.Destination)
|
|
data = label.FormatMountLabel(m.Data, mountLabel)
|
|
)
|
|
switch m.Device {
|
|
case "proc":
|
|
if err := os.MkdirAll(dest, 0755); err != nil && !os.IsExist(err) {
|
|
return err
|
|
}
|
|
return syscall.Mount(m.Source, dest, m.Device, uintptr(m.Flags), "")
|
|
case "tmpfs", "mqueue", "devpts", "sysfs":
|
|
if err := os.MkdirAll(dest, 0755); err != nil && !os.IsExist(err) {
|
|
return err
|
|
}
|
|
return syscall.Mount(m.Source, dest, m.Device, uintptr(m.Flags), data)
|
|
case "bind":
|
|
stat, err := os.Stat(m.Source)
|
|
if err != nil {
|
|
// error out if the source of a bind mount does not exist as we will be
|
|
// unable to bind anything to it.
|
|
return err
|
|
}
|
|
if err := createIfNotExists(dest, stat.IsDir()); err != nil {
|
|
return err
|
|
}
|
|
if err := syscall.Mount(m.Source, dest, m.Device, uintptr(m.Flags), data); err != nil {
|
|
return err
|
|
}
|
|
if m.Flags&syscall.MS_RDONLY != 0 {
|
|
if err := syscall.Mount(m.Source, dest, m.Device, uintptr(m.Flags|syscall.MS_REMOUNT), ""); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if m.Relabel != "" {
|
|
if err := label.Relabel(m.Source, mountLabel, m.Relabel); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
if m.Flags&syscall.MS_PRIVATE != 0 {
|
|
if err := syscall.Mount("", dest, "none", uintptr(syscall.MS_PRIVATE), ""); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
default:
|
|
return fmt.Errorf("unknown mount device %q to %q", m.Device, m.Destination)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func setupDevSymlinks(rootfs string) error {
|
|
var links = [][2]string{
|
|
{"/proc/self/fd", "/dev/fd"},
|
|
{"/proc/self/fd/0", "/dev/stdin"},
|
|
{"/proc/self/fd/1", "/dev/stdout"},
|
|
{"/proc/self/fd/2", "/dev/stderr"},
|
|
}
|
|
// kcore support can be toggled with CONFIG_PROC_KCORE; only create a symlink
|
|
// in /dev if it exists in /proc.
|
|
if _, err := os.Stat("/proc/kcore"); err == nil {
|
|
links = append(links, [2]string{"/proc/kcore", "/dev/kcore"})
|
|
}
|
|
for _, link := range links {
|
|
var (
|
|
src = link[0]
|
|
dst = filepath.Join(rootfs, link[1])
|
|
)
|
|
if err := os.Symlink(src, dst); err != nil && !os.IsExist(err) {
|
|
return fmt.Errorf("symlink %s %s %s", src, dst, err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Is stdin, stdout or stderr were to be pointing to '/dev/null',
|
|
// this method will make them point to '/dev/null' from within this namespace.
|
|
func reOpenDevNull(rootfs string) error {
|
|
var stat, devNullStat syscall.Stat_t
|
|
file, err := os.Open(filepath.Join(rootfs, "/dev/null"))
|
|
if err != nil {
|
|
return fmt.Errorf("Failed to open /dev/null - %s", err)
|
|
}
|
|
defer file.Close()
|
|
if err := syscall.Fstat(int(file.Fd()), &devNullStat); err != nil {
|
|
return err
|
|
}
|
|
for fd := 0; fd < 3; fd++ {
|
|
if err := syscall.Fstat(fd, &stat); err != nil {
|
|
return err
|
|
}
|
|
if stat.Rdev == devNullStat.Rdev {
|
|
// Close and re-open the fd.
|
|
if err := syscall.Dup2(int(file.Fd()), fd); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Create the device nodes in the container.
|
|
func createDevices(config *configs.Config) error {
|
|
oldMask := syscall.Umask(0000)
|
|
for _, node := range config.Devices {
|
|
if err := createDeviceNode(config.Rootfs, node); err != nil {
|
|
syscall.Umask(oldMask)
|
|
return err
|
|
}
|
|
}
|
|
syscall.Umask(oldMask)
|
|
return nil
|
|
}
|
|
|
|
// Creates the device node in the rootfs of the container.
|
|
func createDeviceNode(rootfs string, node *configs.Device) error {
|
|
var (
|
|
dest = filepath.Join(rootfs, node.Path)
|
|
parent = filepath.Dir(dest)
|
|
)
|
|
if err := os.MkdirAll(parent, 0755); err != nil {
|
|
return err
|
|
}
|
|
fileMode := node.FileMode
|
|
switch node.Type {
|
|
case 'c':
|
|
fileMode |= syscall.S_IFCHR
|
|
case 'b':
|
|
fileMode |= syscall.S_IFBLK
|
|
default:
|
|
return fmt.Errorf("%c is not a valid device type for device %s", node.Type, node.Path)
|
|
}
|
|
if err := syscall.Mknod(dest, uint32(fileMode), node.Mkdev()); err != nil && !os.IsExist(err) {
|
|
return fmt.Errorf("mknod %s %s", node.Path, err)
|
|
}
|
|
if err := syscall.Chown(dest, int(node.Uid), int(node.Gid)); err != nil {
|
|
return fmt.Errorf("chown %s to %d:%d", node.Path, node.Uid, node.Gid)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func prepareRoot(config *configs.Config) error {
|
|
flag := syscall.MS_PRIVATE | syscall.MS_REC
|
|
if config.NoPivotRoot {
|
|
flag = syscall.MS_SLAVE | syscall.MS_REC
|
|
}
|
|
if err := syscall.Mount("", "/", "", uintptr(flag), ""); err != nil {
|
|
return err
|
|
}
|
|
return syscall.Mount(config.Rootfs, config.Rootfs, "bind", syscall.MS_BIND|syscall.MS_REC, "")
|
|
}
|
|
|
|
func setReadonly() error {
|
|
return syscall.Mount("/", "/", "bind", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC, "")
|
|
}
|
|
|
|
func setupPtmx(config *configs.Config) error {
|
|
ptmx := filepath.Join(config.Rootfs, "dev/ptmx")
|
|
if err := os.Remove(ptmx); err != nil && !os.IsNotExist(err) {
|
|
return err
|
|
}
|
|
if err := os.Symlink("pts/ptmx", ptmx); err != nil {
|
|
return fmt.Errorf("symlink dev ptmx %s", err)
|
|
}
|
|
if config.Console != "" {
|
|
uid, err := config.HostUID()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
gid, err := config.HostGID()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
console := newConsoleFromPath(config.Console)
|
|
return console.mount(config.Rootfs, config.MountLabel, uid, gid)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func pivotRoot(rootfs, pivotBaseDir string) error {
|
|
if pivotBaseDir == "" {
|
|
pivotBaseDir = "/"
|
|
}
|
|
tmpDir := filepath.Join(rootfs, pivotBaseDir)
|
|
if err := os.MkdirAll(tmpDir, 0755); err != nil {
|
|
return fmt.Errorf("can't create tmp dir %s, error %v", tmpDir, err)
|
|
}
|
|
pivotDir, err := ioutil.TempDir(tmpDir, ".pivot_root")
|
|
if err != nil {
|
|
return fmt.Errorf("can't create pivot_root dir %s, error %v", pivotDir, err)
|
|
}
|
|
if err := syscall.PivotRoot(rootfs, pivotDir); err != nil {
|
|
return fmt.Errorf("pivot_root %s", err)
|
|
}
|
|
if err := syscall.Chdir("/"); err != nil {
|
|
return fmt.Errorf("chdir / %s", err)
|
|
}
|
|
// path to pivot dir now changed, update
|
|
pivotDir = filepath.Join(pivotBaseDir, filepath.Base(pivotDir))
|
|
if err := syscall.Unmount(pivotDir, syscall.MNT_DETACH); err != nil {
|
|
return fmt.Errorf("unmount pivot_root dir %s", err)
|
|
}
|
|
return os.Remove(pivotDir)
|
|
}
|
|
|
|
func msMoveRoot(rootfs string) error {
|
|
if err := syscall.Mount(rootfs, "/", "", syscall.MS_MOVE, ""); err != nil {
|
|
return err
|
|
}
|
|
if err := syscall.Chroot("."); err != nil {
|
|
return err
|
|
}
|
|
return syscall.Chdir("/")
|
|
}
|
|
|
|
// createIfNotExists creates a file or a directory only if it does not already exist.
|
|
func createIfNotExists(path string, isDir bool) error {
|
|
if _, err := os.Stat(path); err != nil {
|
|
if os.IsNotExist(err) {
|
|
if isDir {
|
|
return os.MkdirAll(path, 0755)
|
|
}
|
|
if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
|
|
return err
|
|
}
|
|
f, err := os.OpenFile(path, os.O_CREATE, 0755)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
f.Close()
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// remountReadonly will bind over the top of an existing path and ensure that it is read-only.
|
|
func remountReadonly(path string) error {
|
|
for i := 0; i < 5; i++ {
|
|
if err := syscall.Mount("", path, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil && !os.IsNotExist(err) {
|
|
switch err {
|
|
case syscall.EINVAL:
|
|
// Probably not a mountpoint, use bind-mount
|
|
if err := syscall.Mount(path, path, "", syscall.MS_BIND, ""); err != nil {
|
|
return err
|
|
}
|
|
return syscall.Mount(path, path, "", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC|defaultMountFlags, "")
|
|
case syscall.EBUSY:
|
|
time.Sleep(100 * time.Millisecond)
|
|
continue
|
|
default:
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
return fmt.Errorf("unable to mount %s as readonly max retries reached", path)
|
|
}
|
|
|
|
// maskFile bind mounts /dev/null over the top of the specified path inside a container
|
|
// to avoid security issues from processes reading information from non-namespace aware mounts ( proc/kcore ).
|
|
func maskFile(path string) error {
|
|
if err := syscall.Mount("/dev/null", path, "", syscall.MS_BIND, ""); err != nil && !os.IsNotExist(err) {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|