syscall: Adds support for User Namespaces in Linux by a...

src/syscall/exec_linux.go

 // Copyright 2011 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
 // +build linux
 
 package syscall
 
 import (
         "unsafe"
 )
 
+// SysProcIDMap holds Container ID to Host ID mappings used for User Namespaces in Linux.
+// See user_namespaces(7).
+type SysProcIDMap struct {
+        ContainerID int // Container ID.
+        HostID      int // Host ID.
+        Size        int // Size.
+}
+
 type SysProcAttr struct {
-        Chroot     string      // Chroot.
-        Credential *Credential // Credential.
-        Ptrace     bool        // Enable tracing.
-        Setsid     bool        // Create session.
-        Setpgid    bool        // Set process group ID to new pid (SYSV setpgrp)
-        Setctty    bool        // Set controlling terminal to fd Ctty (only meaningful if Setsid is set)
-        Noctty     bool        // Detach fd 0 from controlling terminal
-        Ctty       int         // Controlling TTY fd (Linux only)
-        Pdeathsig  Signal      // Signal that the process will get when its parent dies (Linux only)
-        Cloneflags uintptr     // Flags for clone calls (Linux only)
-        Foreground bool        // Set foreground process group to child's pid. (Implies Setpgid. Stdin should be a TTY)
-        Joinpgrp   int         // If != 0, child's process group ID. (Setpgid must not be set)
+        Chroot      string         // Chroot.
+        Credential  *Credential    // Credential.
+        Ptrace      bool           // Enable tracing.
+        Setsid      bool           // Create session.
+        Setpgid     bool           // Set process group ID to new pid (SYSV setpgrp)
+        Setctty     bool           // Set controlling terminal to fd Ctty (only meaningful if Setsid is set)
+        Noctty      bool           // Detach fd 0 from controlling terminal
+        Ctty        int            // Controlling TTY fd (Linux only)
+        Pdeathsig   Signal         // Signal that the process will get when its parent dies (Linux only)
+        Cloneflags  uintptr        // Flags for clone calls (Linux only)
+        Foreground  bool           // Set foreground process group to child's pid. (Implies Setpgid. Stdin should be a TTY)
+        Joinpgrp    int            // If != 0, child's process group ID. (Setpgid must not be set)
+        UidMappings []SysProcIDMap // User ID mappings for user namespaces.
+        GidMappings []SysProcIDMap // Group ID mappings for user namespaces.
 }
 
 // Implemented in runtime package.
 func runtime_BeforeFork()
 func runtime_AfterFork()
 
 // Fork, dup fd onto 0..len(fd), and exec(argv0, argvv, envv) in child.
 // If a dup or exec fails, write the errno error to pipe.
 // (Pipe is close-on-exec so if exec succeeds, it will be closed.)
 // In the child, this function must not acquire any locks, because
 // they might have been locked at the time of the fork.  This means
 // no rescheduling, no malloc calls, and no new stack segments.
 // For the same reason compiler does not race instrument it.
 // The calls to RawSyscall are okay because they are assembly
 // functions that do not grow the stack.
 func forkAndExecInChild(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr *ProcAttr, sys *SysProcAttr, pipe int) (pid int, err Errno) {
         // Declare all variables at top in case any
         // declarations require heap allocation (e.g., err1).
         var (
                 r1     uintptr
                 err1   Errno
+                err2   Errno
                 nextfd int
                 i      int
+                p      [2]int
         )
 
         // Guard against side effects of shuffling fds below.
         // Make sure that nextfd is beyond any currently open files so
         // that we can't run the risk of overwriting any of them.
         fd := make([]int, len(attr.Files))
         nextfd = len(attr.Files)
         for i, ufd := range attr.Files {
                 if nextfd < int(ufd) {
                         nextfd = int(ufd)
                 }
                 fd[i] = int(ufd)
         }
         nextfd++
 
+        // Allocate another pipe for parent to child communication for
+        // synchronizing writing of User ID/Group ID mappings.
+        if sys.UidMappings != nil || sys.GidMappings != nil {
+                if err := forkExecPipe(p[:]); err != nil {
+                        return 0, err.(Errno)
+                }
+        }
+
         // About to call fork.
         // No more allocation or calls of non-assembly functions.
         runtime_BeforeFork()
         r1, _, err1 = RawSyscall6(SYS_CLONE, uintptr(SIGCHLD)|sys.Cloneflags, 0, 0, 0, 0, 0)
         if err1 != 0 {
                 runtime_AfterFork()
                 return 0, err1
         }
 
         if r1 != 0 {
                 // parent; return PID
                 runtime_AfterFork()
                 pid = int(r1)
 
+                if sys.UidMappings != nil || sys.GidMappings != nil {
+                        Close(p[0])
+                        err := writeUidGidMappings(pid, sys)
+                        if err != nil {
+                                err2 = err.(Errno)
+                        }
+                        RawSyscall(SYS_WRITE, uintptr(p[1]), uintptr(unsafe.Pointer(&err2)), unsafe.Sizeof(err2))
+                        Close(p[1])
+                }
+
                 if sys.Joinpgrp != 0 {
                         // Place the child in the specified process group.
                         RawSyscall(SYS_SETPGID, r1, uintptr(sys.Joinpgrp), 0)
                 } else if sys.Foreground || sys.Setpgid {
                         // Place the child in a new process group.
                         RawSyscall(SYS_SETPGID, 0, 0, 0)
 
                         if sys.Foreground {
                                 // Set new foreground process group.
                                 RawSyscall(SYS_IOCTL, uintptr(Stdin), TIOCSPGRP, uintptr(unsafe.Pointer(&pid)))
                         }
                 }
 
                 return pid, 0
         }
 
         // Fork succeeded, now in child.
 
+        // Wait for User ID/Group ID mappings to be written.
+        if sys.UidMappings != nil || sys.GidMappings != nil {
+                if _, _, err1 = RawSyscall(SYS_CLOSE, uintptr(p[1]), 0, 0); err1 != 0 {
+                        goto childerror
+                }
+                r1, _, err1 = RawSyscall(SYS_READ, uintptr(p[0]), uintptr(unsafe.Pointer(&err2)), unsafe.Sizeof(err2))
+                if err1 != 0 || r1 != unsafe.Sizeof(uintptr(0)) {

[mrunalp, 2014/10/02 00:07:04]

Should we set err1 to something specific when r1 doesn't have the expected
number of bytes?

[iant, 2014/10/02 00:33:34]

Yes.  I guess EINVAL unless you can think of something better.

[mrunalp, 2014/10/02 05:14:25]

Sounds good to me.

[mrunalp, 2014/10/02 05:14:25]

Done.

+                        goto childerror
+                }
+                if err2 != 0 {
+                        err1 = err2
+                        goto childerror
+                }
+        }
+
         // Parent death signal
         if sys.Pdeathsig != 0 {
                 _, _, err1 = RawSyscall6(SYS_PRCTL, PR_SET_PDEATHSIG, uintptr(sys.Pdeathsig), 0, 0, 0, 0)
                 if err1 != 0 {
                         goto childerror
                 }
 
                 // Signal self if parent is already dead. This might cause a
                 // duplicate signal in rare cases, but it won't matter when
                 // using SIGKILL.
@@ skipping 183 matching lines @@
                 if err = Pipe(p); err != nil {
                         return
                 }
                 if _, err = fcntl(p[0], F_SETFD, FD_CLOEXEC); err != nil {
                         return
                 }
                 _, err = fcntl(p[1], F_SETFD, FD_CLOEXEC)
         }
         return
 }
+
+// writeIDMappings writes the user namespace User ID or Group ID mappings to the specified path.
+func writeIDMappings(path string, idMap []SysProcIDMap) error {
+        fd, err := Open(path, O_RDWR, 0)
+        if err != nil {
+                return err
+        }
+
+        data := ""
+        for _, im := range idMap {
+                data = data + itoa(im.ContainerID) + " " + itoa(im.HostID) + " " + itoa(im.Size) + "\n"
+        }
+
+        bytes, err := ByteSliceFromString(data)
+        if err != nil {
+                Close(fd)
+                return err
+        }
+
+        if _, err := Write(fd, bytes); err != nil {
+                Close(fd)
+                return err
+        }
+
+        if err := Close(fd); err != nil {
+                return err
+        }
+
+        return nil
+}
+
+// writeUidGidMappings writes User ID and Group ID mappings for user namespaces
+// for a process and it is called from the parent process.
+func writeUidGidMappings(pid int, sys *SysProcAttr) error {
+        if sys.UidMappings != nil {
+                uidf := "/proc/" + itoa(pid) + "/uid_map"
+                if err := writeIDMappings(uidf, sys.UidMappings); err != nil {
+                        return err
+                }
+        }
+
+        if sys.GidMappings != nil {
+                gidf := "/proc/" + itoa(pid) + "/gid_map"
+                if err := writeIDMappings(gidf, sys.GidMappings); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}