kotovalexarian-likes-github
/
moby--moby
mirror of https://github.com/moby/moby.git
1
0
Fork 0
Code Releases Activity

daemon: use containerd/sys to detect UserNamespaces 

The implementation in libcontainer/system is quite complicated,
and we only use it to detect if user-namespaces are enabled.

In addition, the implementation in containerd uses a sync.Once,
so that detection (and reading/parsing `/proc/self/uid_map`) is
only performed once.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
This commit is contained in:
Sebastiaan van Stijn 2020-06-15 13:06:08 +02:00
parent aaf470eca7
commit 4534a7afc3
No known key found for this signature in database
GPG Key ID: 76698F39D527CE8C
8 changed files with 17 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
daemon/daemon.go
View File

@ -27,6 +27,7 @@ import (
"github.com/containerd/containerd/defaults"
"github.com/containerd/containerd/pkg/dialer"
"github.com/containerd/containerd/remotes/docker"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/api/types"
containertypes "github.com/docker/docker/api/types/container"
"github.com/docker/docker/api/types/swarm"
@ -42,7 +43,6 @@ import (
"github.com/docker/docker/errdefs"
bkconfig "github.com/moby/buildkit/cmd/buildkitd/config"
"github.com/moby/buildkit/util/resolver"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/sirupsen/logrus"
// register graph drivers
@ -1040,7 +1040,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S
sysInfo := d.RawSysInfo(false)
// Check if Devices cgroup is mounted, it is hard requirement for container security,
// on Linux.
if runtime.GOOS == "linux" && !sysInfo.CgroupDevicesEnabled && !rsystem.RunningInUserNS() {
if runtime.GOOS == "linux" && !sysInfo.CgroupDevicesEnabled && !sys.RunningInUserNS() {
return nil, errors.New("Devices cgroup isn't mounted")
}

6
daemon/daemon_unix.go
View File

@ -18,6 +18,7 @@ import (
statsV1 "github.com/containerd/cgroups/stats/v1"
statsV2 "github.com/containerd/cgroups/v2/stats"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/api/types"
"github.com/docker/docker/api/types/blkiodev"
pblkiodev "github.com/docker/docker/api/types/blkiodev"
@ -44,7 +45,6 @@ import (
lntypes "github.com/docker/libnetwork/types"
"github.com/moby/sys/mount"
"github.com/opencontainers/runc/libcontainer/cgroups"
rsystem "github.com/opencontainers/runc/libcontainer/system"
specs "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
@ -1668,7 +1668,7 @@ func setMayDetachMounts() error {
// Setting may_detach_mounts does not work in an
// unprivileged container. Ignore the error, but log
// it if we appear not to be in that situation.
if !rsystem.RunningInUserNS() {
if !sys.RunningInUserNS() {
logrus.Debugf("Permission denied writing %q to /proc/sys/fs/may_detach_mounts", "1")
}
return nil
@ -1688,7 +1688,7 @@ func setupOOMScoreAdj(score int) error {
// Setting oom_score_adj does not work in an
// unprivileged container. Ignore the error, but log
// it if we appear not to be in that situation.
if !rsystem.RunningInUserNS() {
if !sys.RunningInUserNS() {
logrus.Debugf("Permission denied writing %q to /proc/self/oom_score_adj", stringScore)
}
return nil

4
daemon/graphdriver/aufs/aufs.go
View File

@ -35,6 +35,7 @@ import (
"strings"
"sync"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/daemon/graphdriver"
"github.com/docker/docker/pkg/archive"
"github.com/docker/docker/pkg/chrootarchive"
@ -44,7 +45,6 @@ import (
"github.com/docker/docker/pkg/locker"
"github.com/docker/docker/pkg/system"
"github.com/moby/sys/mount"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
@ -177,7 +177,7 @@ func supportsAufs() error {
// proc/filesystems for when aufs is supported
exec.Command("modprobe", "aufs").Run()
if rsystem.RunningInUserNS() {
if sys.RunningInUserNS() {
return ErrAufsNested
}

4
daemon/graphdriver/copy/copy.go
View File

@ -11,9 +11,9 @@ import (
"syscall"
"time"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/pkg/pools"
"github.com/docker/docker/pkg/system"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"golang.org/x/sys/unix"
)
@ -184,7 +184,7 @@ func DirCopy(srcDir, dstDir string, copyMode Mode, copyXattrs bool) error {
}
case mode&os.ModeDevice != 0:
if rsystem.RunningInUserNS() {
if sys.RunningInUserNS() {
// cannot create a device if running in user namespace
return nil
}

4
daemon/graphdriver/fuse-overlayfs/fuseoverlayfs.go
View File

@ -14,6 +14,7 @@ import (
"path/filepath"
"strings"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/daemon/graphdriver"
"github.com/docker/docker/daemon/graphdriver/overlayutils"
"github.com/docker/docker/pkg/archive"
@ -25,7 +26,6 @@ import (
"github.com/docker/docker/pkg/parsers/kernel"
"github.com/docker/docker/pkg/system"
"github.com/moby/sys/mount"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
@ -475,7 +475,7 @@ func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64
GIDMaps: d.gidMaps,
// Use AUFS whiteout format: https://github.com/containers/storage/blob/39a8d5ed9843844eafb5d2ba6e6a7510e0126f40/drivers/overlay/overlay.go#L1084-L1089
WhiteoutFormat: archive.AUFSWhiteoutFormat,
InUserNS: rsystem.RunningInUserNS(),
InUserNS: sys.RunningInUserNS(),
}); err != nil {
return 0, err
}

4
daemon/graphdriver/overlay2/overlay.go
View File

@ -15,6 +15,7 @@ import (
"strings"
"sync"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/daemon/graphdriver"
"github.com/docker/docker/daemon/graphdriver/overlayutils"
"github.com/docker/docker/daemon/graphdriver/quota"
@ -29,7 +30,6 @@ import (
"github.com/docker/docker/pkg/system"
units "github.com/docker/go-units"
"github.com/moby/sys/mount"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/sirupsen/logrus"
"golang.org/x/sys/unix"
@ -683,7 +683,7 @@ func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64
UIDMaps: d.uidMaps,
GIDMaps: d.gidMaps,
WhiteoutFormat: archive.OverlayWhiteoutFormat,
InUserNS: rsystem.RunningInUserNS(),
InUserNS: sys.RunningInUserNS(),
}); err != nil {
return 0, err
}

4
daemon/graphdriver/quota/projectquota.go
View File

@ -57,7 +57,7 @@ import (
"path/filepath"
"unsafe"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/containerd/containerd/sys"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"golang.org/x/sys/unix"
@ -90,7 +90,7 @@ func NewControl(basePath string) (*Control, error) {
// If we are running in a user namespace quota won't be supported for
// now since makeBackingFsDev() will try to mknod().
//
if rsystem.RunningInUserNS() {
if sys.RunningInUserNS() {
return nil, ErrQuotaNotSupported
}

4
daemon/oci_linux.go
View File

@ -14,6 +14,7 @@ import (
"github.com/containerd/containerd/containers"
coci "github.com/containerd/containerd/oci"
"github.com/containerd/containerd/sys"
containertypes "github.com/docker/docker/api/types/container"
"github.com/docker/docker/container"
daemonconfig "github.com/docker/docker/daemon/config"
@ -28,7 +29,6 @@ import (
"github.com/opencontainers/runc/libcontainer/apparmor"
"github.com/opencontainers/runc/libcontainer/cgroups"
"github.com/opencontainers/runc/libcontainer/devices"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/opencontainers/runc/libcontainer/user"
specs "github.com/opencontainers/runtime-spec/specs-go"
"github.com/pkg/errors"
@ -857,7 +857,7 @@ func WithDevices(daemon *Daemon, c *container.Container) coci.SpecOpts {
var devs []specs.LinuxDevice
devPermissions := s.Linux.Resources.Devices
if c.HostConfig.Privileged && !rsystem.RunningInUserNS() {
if c.HostConfig.Privileged && !sys.RunningInUserNS() {
hostDevices, err := devices.HostDevices()
if err != nil {
return err