netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Unmount procfs from sandbox process, irrespective of apply-caps flag.

Browse Source 
Earlier, we were only unmounting procfs mount if apply-caps flag was not set.
Directfs and hostinet set this flag to true.

PiperOrigin-RevId: 501136480
This commit is contained in:
Ayush Ranjan
2023-01-10 17:37:47 -08:00
committed by gVisor bot
parent 9ba9d78ca9
commit 5bb418ecdb
1 changed files with 16 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/cmd/boot.go
+16 -12
View File
@@ -137,7 +137,7 @@ func (b *Boot) SetFlags(f *flag.FlagSet) {
f.BoolVar(&b.setUpRoot, "setup-root", false, "if true, set up an empty root for the process")
f.BoolVar(&b.pidns, "pidns", false, "if true, the sandbox is in its own PID namespace")
f.IntVar(&b.cpuNum, "cpu-num", 0, "number of CPUs to create inside the sandbox")
f.IntVar(&b.procMountSyncFD, "proc-mount-sync-fd", -1, "file descriptor that has to be closed when /proc isn't needed")
f.IntVar(&b.procMountSyncFD, "proc-mount-sync-fd", -1, "file descriptor that has to be written to when /proc isn't needed anymore and can be unmounted")
f.Uint64Var(&b.totalMem, "total-memory", 0, "sets the initial amount of total memory to report back to the container")
f.BoolVar(&b.attached, "attached", false, "if attached is true, kills the sandbox process when the parent process terminates")
f.StringVar(&b.productName, "product-name", "", "value to show in /sys/devices/virtual/dmi/id/product_name")
@@ -196,7 +196,7 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomma
util.Fatalf("error setting up chroot: %v", err)
}
if !b.applyCaps && !conf.Rootless {
if !conf.Rootless {
// /proc is umounted from a forked process, because the
// current one is going to re-execute itself without
// capabilities.
@@ -208,19 +208,23 @@ func (b *Boot) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomma
}
b.procMountSyncFD = int(w.Fd())
// Remove --apply-caps arg to call myself. It has already been done.
args := b.prepareArgs("setup-root")
// Clear FD_CLOEXEC.
// Clear FD_CLOEXEC. Regardless of b.applyCaps, this process will be
// re-executed. procMountSyncFD should remain open.
if _, _, errno := unix.RawSyscall(unix.SYS_FCNTL, w.Fd(), unix.F_SETFD, 0); errno != 0 {
util.Fatalf("error clearing CLOEXEC: %v", errno)
}
// Note that we've already read the spec from the spec FD, and
// we will read it again after the exec call. This works
// because the ReadSpecFromFile function seeks to the beginning
// of the file before reading.
util.Fatalf("callSelfAsNobody(%v): %v", args, callSelfAsNobody(args))
panic("unreachable")
if !b.applyCaps {
// Remove --setup-root arg to call myself. It has already been done.
args := b.prepareArgs("setup-root")
// Note that we've already read the spec from the spec FD, and
// we will read it again after the exec call. This works
// because the ReadSpecFromFile function seeks to the beginning
// of the file before reading.
util.Fatalf("callSelfAsNobody(%v): %v", args, callSelfAsNobody(args))
panic("unreachable")
}
}
}