kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #41108 from thaJeztah/containerd_userns

Browse source 
use containerd/sys to detect UserNamespaces
This commit is contained in:
Brian Goff 2020-06-15 16:48:14 -07:00 committed by GitHub
commit 88241b9989
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
15 changed files with 33 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
daemon/daemon.go
View file

@ -27,6 +27,7 @@ import (
"github.com/containerd/containerd/defaults"
"github.com/containerd/containerd/pkg/dialer"
"github.com/containerd/containerd/remotes/docker"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/api/types"
containertypes "github.com/docker/docker/api/types/container"
"github.com/docker/docker/api/types/swarm"
@ -42,7 +43,6 @@ import (
"github.com/docker/docker/errdefs"
bkconfig "github.com/moby/buildkit/cmd/buildkitd/config"
"github.com/moby/buildkit/util/resolver"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/sirupsen/logrus"
// register graph drivers
@ -1040,7 +1040,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S
sysInfo := d.RawSysInfo(false)
// Check if Devices cgroup is mounted, it is hard requirement for container security,
// on Linux.
if runtime.GOOS == "linux" && !sysInfo.CgroupDevicesEnabled && !rsystem.RunningInUserNS() {
if runtime.GOOS == "linux" && !sysInfo.CgroupDevicesEnabled && !sys.RunningInUserNS() {
return nil, errors.New("Devices cgroup isn't mounted")
}

6
daemon/daemon_unix.go
View file

@ -18,6 +18,7 @@ import (
statsV1 "github.com/containerd/cgroups/stats/v1"
statsV2 "github.com/containerd/cgroups/v2/stats"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/api/types"
"github.com/docker/docker/api/types/blkiodev"
pblkiodev "github.com/docker/docker/api/types/blkiodev"
@ -44,7 +45,6 @@ import (
lntypes "github.com/docker/libnetwork/types"
"github.com/moby/sys/mount"
"github.com/opencontainers/runc/libcontainer/cgroups"
rsystem "github.com/opencontainers/runc/libcontainer/system"
specs "github.com/opencontainers/runtime-spec/specs-go"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
@ -1668,7 +1668,7 @@ func setMayDetachMounts() error {
// Setting may_detach_mounts does not work in an
// unprivileged container. Ignore the error, but log
// it if we appear not to be in that situation.
if !rsystem.RunningInUserNS() {
if !sys.RunningInUserNS() {
logrus.Debugf("Permission denied writing %q to /proc/sys/fs/may_detach_mounts", "1")
}
return nil
@ -1688,7 +1688,7 @@ func setupOOMScoreAdj(score int) error {
// Setting oom_score_adj does not work in an
// unprivileged container. Ignore the error, but log
// it if we appear not to be in that situation.
if !rsystem.RunningInUserNS() {
if !sys.RunningInUserNS() {
logrus.Debugf("Permission denied writing %q to /proc/self/oom_score_adj", stringScore)
}
return nil

4
daemon/graphdriver/aufs/aufs.go
View file

@ -35,6 +35,7 @@ import (
"strings"
"sync"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/daemon/graphdriver"
"github.com/docker/docker/pkg/archive"
"github.com/docker/docker/pkg/chrootarchive"
@ -44,7 +45,6 @@ import (
"github.com/docker/docker/pkg/locker"
"github.com/docker/docker/pkg/system"
"github.com/moby/sys/mount"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
@ -177,7 +177,7 @@ func supportsAufs() error {
// proc/filesystems for when aufs is supported
exec.Command("modprobe", "aufs").Run()
if rsystem.RunningInUserNS() {
if sys.RunningInUserNS() {
return ErrAufsNested
}

4
daemon/graphdriver/copy/copy.go
View file

@ -11,9 +11,9 @@ import (
"syscall"
"time"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/pkg/pools"
"github.com/docker/docker/pkg/system"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"golang.org/x/sys/unix"
)
@ -184,7 +184,7 @@ func DirCopy(srcDir, dstDir string, copyMode Mode, copyXattrs bool) error {
}
case mode&os.ModeDevice != 0:
if rsystem.RunningInUserNS() {
if sys.RunningInUserNS() {
// cannot create a device if running in user namespace
return nil
}

4
daemon/graphdriver/fuse-overlayfs/fuseoverlayfs.go
View file

@ -14,6 +14,7 @@ import (
"path/filepath"
"strings"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/daemon/graphdriver"
"github.com/docker/docker/daemon/graphdriver/overlayutils"
"github.com/docker/docker/pkg/archive"
@ -25,7 +26,6 @@ import (
"github.com/docker/docker/pkg/parsers/kernel"
"github.com/docker/docker/pkg/system"
"github.com/moby/sys/mount"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
@ -475,7 +475,7 @@ func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64
GIDMaps: d.gidMaps,
// Use AUFS whiteout format: https://github.com/containers/storage/blob/39a8d5ed9843844eafb5d2ba6e6a7510e0126f40/drivers/overlay/overlay.go#L1084-L1089
WhiteoutFormat: archive.AUFSWhiteoutFormat,
InUserNS: rsystem.RunningInUserNS(),
InUserNS: sys.RunningInUserNS(),
}); err != nil {
return 0, err
}

4
daemon/graphdriver/overlay2/overlay.go
View file

@ -15,6 +15,7 @@ import (
"strings"
"sync"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/daemon/graphdriver"
"github.com/docker/docker/daemon/graphdriver/overlayutils"
"github.com/docker/docker/daemon/graphdriver/quota"
@ -29,7 +30,6 @@ import (
"github.com/docker/docker/pkg/system"
units "github.com/docker/go-units"
"github.com/moby/sys/mount"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/opencontainers/selinux/go-selinux/label"
"github.com/sirupsen/logrus"
"golang.org/x/sys/unix"
@ -683,7 +683,7 @@ func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64
UIDMaps: d.uidMaps,
GIDMaps: d.gidMaps,
WhiteoutFormat: archive.OverlayWhiteoutFormat,
InUserNS: rsystem.RunningInUserNS(),
InUserNS: sys.RunningInUserNS(),
}); err != nil {
return 0, err
}

4
daemon/graphdriver/quota/projectquota.go
View file

@ -57,7 +57,7 @@ import (
"path/filepath"
"unsafe"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/containerd/containerd/sys"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"golang.org/x/sys/unix"
@ -90,7 +90,7 @@ func NewControl(basePath string) (*Control, error) {
// If we are running in a user namespace quota won't be supported for
// now since makeBackingFsDev() will try to mknod().
//
if rsystem.RunningInUserNS() {
if sys.RunningInUserNS() {
return nil, ErrQuotaNotSupported
}

4
daemon/oci_linux.go
View file

@ -14,6 +14,7 @@ import (
"github.com/containerd/containerd/containers"
coci "github.com/containerd/containerd/oci"
"github.com/containerd/containerd/sys"
containertypes "github.com/docker/docker/api/types/container"
"github.com/docker/docker/container"
daemonconfig "github.com/docker/docker/daemon/config"
@ -28,7 +29,6 @@ import (
"github.com/opencontainers/runc/libcontainer/apparmor"
"github.com/opencontainers/runc/libcontainer/cgroups"
"github.com/opencontainers/runc/libcontainer/devices"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/opencontainers/runc/libcontainer/user"
specs "github.com/opencontainers/runtime-spec/specs-go"
"github.com/pkg/errors"
@ -857,7 +857,7 @@ func WithDevices(daemon *Daemon, c *container.Container) coci.SpecOpts {
var devs []specs.LinuxDevice
devPermissions := s.Linux.Resources.Devices
if c.HostConfig.Privileged && !rsystem.RunningInUserNS() {
if c.HostConfig.Privileged && !sys.RunningInUserNS() {
hostDevices, err := devices.HostDevices()
if err != nil {
return err

6
pkg/archive/archive_linux_test.go
View file

@ -9,10 +9,10 @@ import (
"syscall"
"testing"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/pkg/reexec"
"github.com/docker/docker/pkg/system"
"github.com/moby/sys/mount"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/pkg/errors"
"golang.org/x/sys/unix"
"gotest.tools/v3/assert"
@ -30,7 +30,7 @@ import (
// └── f1 # whiteout, 0644
func setupOverlayTestDir(t *testing.T, src string) {
skip.If(t, os.Getuid() != 0, "skipping test that requires root")
skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires initial userns (trusted.overlay.opaque xattr cannot be set in userns, even with Ubuntu kernel)")
skip.If(t, sys.RunningInUserNS(), "skipping test that requires initial userns (trusted.overlay.opaque xattr cannot be set in userns, even with Ubuntu kernel)")
// Create opaque directory containing single file and permission 0700
err := os.Mkdir(filepath.Join(src, "d1"), 0700)
assert.NilError(t, err)
@ -248,7 +248,7 @@ func isOpaque(dir string) error {
func TestReexecUserNSOverlayWhiteoutConverter(t *testing.T) {
skip.If(t, os.Getuid() != 0, "skipping test that requires root")
skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires initial userns")
skip.If(t, sys.RunningInUserNS(), "skipping test that requires initial userns")
if err := supportsUserNSOverlay(); err != nil {
t.Skipf("skipping test that requires kernel support for overlay-in-userns: %v", err)
}

4
pkg/archive/archive_test.go
View file

@ -16,9 +16,9 @@ import (
"testing"
"time"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/pkg/idtools"
"github.com/docker/docker/pkg/ioutils"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"gotest.tools/v3/assert"
is "gotest.tools/v3/assert/cmp"
"gotest.tools/v3/skip"
@ -1230,7 +1230,7 @@ func TestReplaceFileTarWrapper(t *testing.T) {
// version of this package that was built with <=go17 are still readable.
func TestPrefixHeaderReadable(t *testing.T) {
skip.If(t, runtime.GOOS != "windows" && os.Getuid() != 0, "skipping test that requires root")
skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires more than 010000000 UIDs, which is unlikely to be satisfied when running in userns")
skip.If(t, sys.RunningInUserNS(), "skipping test that requires more than 010000000 UIDs, which is unlikely to be satisfied when running in userns")
// https://gist.github.com/stevvooe/e2a790ad4e97425896206c0816e1a882#file-out-go
var testFile = []byte("\x1f\x8b\x08\x08\x44\x21\x68\x59\x00\x03\x74\x2e\x74\x61\x72\x00\x4b\xcb\xcf\x67\xa0\x35\x30\x80\x00\x86\x06\x10\x47\x01\xc1\x37\x40\x00\x54\xb6\xb1\xa1\xa9\x99\x09\x48\x25\x1d\x40\x69\x71\x49\x62\x91\x02\xe5\x76\xa1\x79\x84\x21\x91\xd6\x80\x72\xaf\x8f\x82\x51\x30\x0a\x46\x36\x00\x00\xf0\x1c\x1e\x95\x00\x06\x00\x00")

4
pkg/archive/archive_unix.go
View file

@ -10,9 +10,9 @@ import (
"strings"
"syscall"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/pkg/idtools"
"github.com/docker/docker/pkg/system"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"golang.org/x/sys/unix"
)
@ -81,7 +81,7 @@ func getFileUIDGID(stat interface{}) (idtools.Identity, error) {
// handleTarTypeBlockCharFifo is an OS-specific helper function used by
// createTarFile to handle the following types of header: Block; Char; Fifo
func handleTarTypeBlockCharFifo(hdr *tar.Header, path string) error {
if rsystem.RunningInUserNS() {
if sys.RunningInUserNS() {
// cannot create a device if running in user namespace
return nil
}

4
pkg/archive/archive_unix_test.go
View file

@ -13,8 +13,8 @@ import (
"syscall"
"testing"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/pkg/system"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"golang.org/x/sys/unix"
"gotest.tools/v3/assert"
is "gotest.tools/v3/assert/cmp"
@ -184,7 +184,7 @@ func getInode(path string) (uint64, error) {
func TestTarWithBlockCharFifo(t *testing.T) {
skip.If(t, os.Getuid() != 0, "skipping test that requires root")
skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires initial userns")
skip.If(t, sys.RunningInUserNS(), "skipping test that requires initial userns")
origin, err := ioutil.TempDir("", "docker-test-tar-hardlink")
assert.NilError(t, err)

4
pkg/chrootarchive/chroot_linux.go
View file

@ -6,9 +6,9 @@ import (
"os"
"path/filepath"
"github.com/containerd/containerd/sys"
"github.com/moby/sys/mount"
"github.com/moby/sys/mountinfo"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"golang.org/x/sys/unix"
)
@ -20,7 +20,7 @@ import (
// This is similar to how libcontainer sets up a container's rootfs
func chroot(path string) (err error) {
// if the engine is running in a user namespace we need to use actual chroot
if rsystem.RunningInUserNS() {
if sys.RunningInUserNS() {
return realChroot(path)
}
if err := unix.Unshare(unix.CLONE_NEWNS); err != nil {

6
pkg/chrootarchive/diff_unix.go
View file

@ -13,10 +13,10 @@ import (
"path/filepath"
"runtime"
"github.com/containerd/containerd/sys"
"github.com/docker/docker/pkg/archive"
"github.com/docker/docker/pkg/reexec"
"github.com/docker/docker/pkg/system"
rsystem "github.com/opencontainers/runc/libcontainer/system"
)
type applyLayerResponse struct {
@ -36,7 +36,7 @@ func applyLayer() {
runtime.LockOSThread()
flag.Parse()
inUserns := rsystem.RunningInUserNS()
inUserns := sys.RunningInUserNS()
if err := chroot(flag.Arg(0)); err != nil {
fatal(err)
}
@ -95,7 +95,7 @@ func applyLayerHandler(dest string, layer io.Reader, options *archive.TarOptions
}
if options == nil {
options = &archive.TarOptions{}
if rsystem.RunningInUserNS() {
if sys.RunningInUserNS() {
options.InUserNS = true
}
}

4
pkg/sysinfo/cgroup2_linux.go
View file

@ -6,7 +6,7 @@ import (
"strings"
cgroupsV2 "github.com/containerd/cgroups/v2"
rsystem "github.com/opencontainers/runc/libcontainer/system"
"github.com/containerd/containerd/sys"
"github.com/sirupsen/logrus"
)
@ -146,6 +146,6 @@ func applyPIDSCgroupInfoV2(info *SysInfo, controllers map[string]struct{}, _ str
}
func applyDevicesCgroupInfoV2(info *SysInfo, controllers map[string]struct{}, _ string) []string {
info.CgroupDevicesEnabled = !rsystem.RunningInUserNS()
info.CgroupDevicesEnabled = !sys.RunningInUserNS()
return nil
}