2014-01-13 21:36:59 -05:00
|
|
|
package lxc
|
|
|
|
|
|
|
|
import (
|
2014-03-03 13:19:00 -05:00
|
|
|
"encoding/json"
|
2014-01-13 21:36:59 -05:00
|
|
|
"fmt"
|
2014-03-03 13:19:00 -05:00
|
|
|
"io/ioutil"
|
2014-01-13 21:36:59 -05:00
|
|
|
"net"
|
|
|
|
"os"
|
|
|
|
"strings"
|
|
|
|
"syscall"
|
2014-05-02 17:17:31 -04:00
|
|
|
|
|
|
|
"github.com/dotcloud/docker/daemon/execdriver"
|
2014-06-09 18:52:12 -04:00
|
|
|
"github.com/dotcloud/docker/pkg/libcontainer/netlink"
|
2014-05-02 17:17:31 -04:00
|
|
|
"github.com/dotcloud/docker/pkg/user"
|
|
|
|
"github.com/syndtr/gocapability/capability"
|
2014-01-13 21:36:59 -05:00
|
|
|
)
|
|
|
|
|
2014-03-03 13:19:00 -05:00
|
|
|
// Clear environment pollution introduced by lxc-start
|
|
|
|
func setupEnv(args *execdriver.InitArgs) error {
|
|
|
|
// Get env
|
|
|
|
var env []string
|
|
|
|
content, err := ioutil.ReadFile(".dockerenv")
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Unable to load environment variables: %v", err)
|
|
|
|
}
|
|
|
|
if err := json.Unmarshal(content, &env); err != nil {
|
|
|
|
return fmt.Errorf("Unable to unmarshal environment variables: %v", err)
|
|
|
|
}
|
|
|
|
// Propagate the plugin-specific container env variable
|
|
|
|
env = append(env, "container="+os.Getenv("container"))
|
|
|
|
|
|
|
|
args.Env = env
|
|
|
|
|
|
|
|
os.Clearenv()
|
|
|
|
for _, kv := range args.Env {
|
|
|
|
parts := strings.SplitN(kv, "=", 2)
|
|
|
|
if len(parts) == 1 {
|
|
|
|
parts = append(parts, "")
|
|
|
|
}
|
|
|
|
os.Setenv(parts[0], parts[1])
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2014-01-15 16:57:07 -05:00
|
|
|
func setupHostname(args *execdriver.InitArgs) error {
|
2014-01-13 21:36:59 -05:00
|
|
|
hostname := getEnv(args, "HOSTNAME")
|
|
|
|
if hostname == "" {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
return setHostname(hostname)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Setup networking
|
2014-01-15 16:57:07 -05:00
|
|
|
func setupNetworking(args *execdriver.InitArgs) error {
|
2014-01-13 21:36:59 -05:00
|
|
|
if args.Ip != "" {
|
|
|
|
// eth0
|
|
|
|
iface, err := net.InterfaceByName("eth0")
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Unable to set up networking: %v", err)
|
|
|
|
}
|
|
|
|
ip, ipNet, err := net.ParseCIDR(args.Ip)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Unable to set up networking: %v", err)
|
|
|
|
}
|
|
|
|
if err := netlink.NetworkLinkAddIp(iface, ip, ipNet); err != nil {
|
|
|
|
return fmt.Errorf("Unable to set up networking: %v", err)
|
|
|
|
}
|
|
|
|
if err := netlink.NetworkSetMTU(iface, args.Mtu); err != nil {
|
|
|
|
return fmt.Errorf("Unable to set MTU: %v", err)
|
|
|
|
}
|
|
|
|
if err := netlink.NetworkLinkUp(iface); err != nil {
|
|
|
|
return fmt.Errorf("Unable to set up networking: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// loopback
|
|
|
|
iface, err = net.InterfaceByName("lo")
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Unable to set up networking: %v", err)
|
|
|
|
}
|
|
|
|
if err := netlink.NetworkLinkUp(iface); err != nil {
|
|
|
|
return fmt.Errorf("Unable to set up networking: %v", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if args.Gateway != "" {
|
|
|
|
gw := net.ParseIP(args.Gateway)
|
|
|
|
if gw == nil {
|
|
|
|
return fmt.Errorf("Unable to set up networking, %s is not a valid gateway IP", args.Gateway)
|
|
|
|
}
|
|
|
|
|
2014-05-17 03:06:29 -04:00
|
|
|
if err := netlink.AddDefaultGw(gw.String(), "eth0"); err != nil {
|
2014-01-13 21:36:59 -05:00
|
|
|
return fmt.Errorf("Unable to set up networking: %v", err)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Setup working directory
|
2014-01-15 16:57:07 -05:00
|
|
|
func setupWorkingDirectory(args *execdriver.InitArgs) error {
|
2014-01-13 21:36:59 -05:00
|
|
|
if args.WorkDir == "" {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
if err := syscall.Chdir(args.WorkDir); err != nil {
|
|
|
|
return fmt.Errorf("Unable to change dir to %v: %v", args.WorkDir, err)
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Takes care of dropping privileges to the desired user
|
2014-01-15 16:57:07 -05:00
|
|
|
func changeUser(args *execdriver.InitArgs) error {
|
2013-12-27 12:47:42 -05:00
|
|
|
uid, gid, suppGids, err := user.GetUserGroupSupplementary(
|
|
|
|
args.User,
|
|
|
|
syscall.Getuid(), syscall.Getgid(),
|
|
|
|
)
|
2014-01-13 21:36:59 -05:00
|
|
|
if err != nil {
|
2013-12-27 12:47:42 -05:00
|
|
|
return err
|
2014-01-13 21:36:59 -05:00
|
|
|
}
|
|
|
|
|
2013-12-27 12:47:42 -05:00
|
|
|
if err := syscall.Setgroups(suppGids); err != nil {
|
|
|
|
return fmt.Errorf("Setgroups failed: %v", err)
|
2014-01-13 21:36:59 -05:00
|
|
|
}
|
|
|
|
if err := syscall.Setgid(gid); err != nil {
|
2013-12-27 12:47:42 -05:00
|
|
|
return fmt.Errorf("Setgid failed: %v", err)
|
2014-01-13 21:36:59 -05:00
|
|
|
}
|
|
|
|
if err := syscall.Setuid(uid); err != nil {
|
2013-12-27 12:47:42 -05:00
|
|
|
return fmt.Errorf("Setuid failed: %v", err)
|
2014-01-13 21:36:59 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2014-01-15 16:57:07 -05:00
|
|
|
func setupCapabilities(args *execdriver.InitArgs) error {
|
2014-01-13 21:36:59 -05:00
|
|
|
if args.Privileged {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
drop := []capability.Cap{
|
|
|
|
capability.CAP_SETPCAP,
|
|
|
|
capability.CAP_SYS_MODULE,
|
|
|
|
capability.CAP_SYS_RAWIO,
|
|
|
|
capability.CAP_SYS_PACCT,
|
|
|
|
capability.CAP_SYS_ADMIN,
|
|
|
|
capability.CAP_SYS_NICE,
|
|
|
|
capability.CAP_SYS_RESOURCE,
|
|
|
|
capability.CAP_SYS_TIME,
|
|
|
|
capability.CAP_SYS_TTY_CONFIG,
|
|
|
|
capability.CAP_AUDIT_WRITE,
|
|
|
|
capability.CAP_AUDIT_CONTROL,
|
|
|
|
capability.CAP_MAC_OVERRIDE,
|
|
|
|
capability.CAP_MAC_ADMIN,
|
2014-02-11 05:10:55 -05:00
|
|
|
capability.CAP_NET_ADMIN,
|
2014-04-30 02:20:22 -04:00
|
|
|
capability.CAP_SYSLOG,
|
2014-01-13 21:36:59 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
c, err := capability.NewPid(os.Getpid())
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
c.Unset(capability.CAPS|capability.BOUNDS, drop...)
|
|
|
|
|
|
|
|
if err := c.Apply(capability.CAPS | capability.BOUNDS); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2014-01-15 16:57:07 -05:00
|
|
|
func getEnv(args *execdriver.InitArgs, key string) string {
|
2014-01-13 21:36:59 -05:00
|
|
|
for _, kv := range args.Env {
|
|
|
|
parts := strings.SplitN(kv, "=", 2)
|
|
|
|
if parts[0] == key && len(parts) == 2 {
|
|
|
|
return parts[1]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return ""
|
|
|
|
}
|