syscall: Adds support for User Namespaces in Linux by a...

src/syscall/exec_linux.go

 // Copyright 2011 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
 // +build linux
 
 package syscall
 
 import (
         "unsafe"
 )
 
+// Holds Container to Host ID mappings used for User Namespaces in Linux.

[bradfitz, 2014/10/01 03:40:07]

Style issue. See
https://code.google.com/p/go-wiki/wiki/CodeReviewComments#Comment_Sentences

[mrunalp, 2014/10/01 21:48:42]

Done.

+type IdMap struct {
+        ContainerId int // Container Id.
+        HostId      int // Host Id.
+        Size        int // Size.
+}
+
 type SysProcAttr struct {
-        Chroot     string      // Chroot.
-        Credential *Credential // Credential.
-        Ptrace     bool        // Enable tracing.
-        Setsid     bool        // Create session.
-        Setpgid    bool        // Set process group ID to new pid (SYSV setpgrp)
-        Setctty    bool        // Set controlling terminal to fd Ctty (only meaningful if Setsid is set)
-        Noctty     bool        // Detach fd 0 from controlling terminal
-        Ctty       int         // Controlling TTY fd (Linux only)
-        Pdeathsig  Signal      // Signal that the process will get when its parent dies (Linux only)
-        Cloneflags uintptr     // Flags for clone calls (Linux only)
-        Foreground bool        // Set foreground process group to child's pid. (Implies Setpgid. Stdin should be a TTY)
-        Joinpgrp   int         // If != 0, child's process group ID. (Setpgid must not be set)
+        Chroot      string      // Chroot.
+        Credential  *Credential // Credential.
+        Ptrace      bool        // Enable tracing.
+        Setsid      bool        // Create session.
+        Setpgid     bool        // Set process group ID to new pid (SYSV setpgrp)
+        Setctty     bool        // Set controlling terminal to fd Ctty (only meaningful if Setsid is set)
+        Noctty      bool        // Detach fd 0 from controlling terminal
+        Ctty        int         // Controlling TTY fd (Linux only)
+        Pdeathsig   Signal      // Signal that the process will get when its parent dies (Linux only)
+        Cloneflags  uintptr     // Flags for clone calls (Linux only)
+        Foreground  bool        // Set foreground process group to child's pid. (Implies Setpgid. Stdin should be a TTY)
+        Joinpgrp    int         // If != 0, child's process group ID. (Setpgid must not be set)
+        UidMappings []IdMap     // User ID mappings for user namespaces.
+        GidMappings []IdMap     // Group ID mappings for user namespaces.
 }
 
 // Implemented in runtime package.
 func runtime_BeforeFork()
 func runtime_AfterFork()
 
 // Fork, dup fd onto 0..len(fd), and exec(argv0, argvv, envv) in child.
 // If a dup or exec fails, write the errno error to pipe.
 // (Pipe is close-on-exec so if exec succeeds, it will be closed.)
 // In the child, this function must not acquire any locks, because
 // they might have been locked at the time of the fork.  This means
 // no rescheduling, no malloc calls, and no new stack segments.
 // For the same reason compiler does not race instrument it.
 // The calls to RawSyscall are okay because they are assembly
 // functions that do not grow the stack.
-func forkAndExecInChild(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr *ProcAttr, sys *SysProcAttr, pipe int) (pid int, err Errno) {
+func forkAndExecInChild(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr *ProcAttr, sys *SysProcAttr, child, parent int) (pid int, err Errno) {
         // Declare all variables at top in case any
         // declarations require heap allocation (e.g., err1).
         var (
                 r1     uintptr
                 err1   Errno
                 nextfd int
                 i      int
+                lzero  uintptr

[iant, 2014/10/01 14:55:08]

This can just be byte.  Or you can just use err1.

[mrunalp, 2014/10/01 21:48:42]

Done.

         )
 
         // Guard against side effects of shuffling fds below.
         // Make sure that nextfd is beyond any currently open files so
         // that we can't run the risk of overwriting any of them.
         fd := make([]int, len(attr.Files))
         nextfd = len(attr.Files)
         for i, ufd := range attr.Files {
                 if nextfd < int(ufd) {
                         nextfd = int(ufd)
                 }
                 fd[i] = int(ufd)
         }
         nextfd++
 
         // About to call fork.
         // No more allocation or calls of non-assembly functions.
         runtime_BeforeFork()
         r1, _, err1 = RawSyscall6(SYS_CLONE, uintptr(SIGCHLD)|sys.Cloneflags, 0, 0, 0, 0, 0)
         if err1 != 0 {
                 runtime_AfterFork()
                 return 0, err1
         }
 
         if r1 != 0 {
                 // parent; return PID
                 runtime_AfterFork()
                 pid = int(r1)
 
+                if sys.UidMappings != nil || sys.GidMappings != nil {
+                        if err := writeUidGidMappings(pid, sys); err != nil {
+                                return 0, err.(Errno)

[mrunalp, 2014/10/01 01:37:12]

I am not sure if this is the right way to handle this. Also, what do we do in
exec_unix if writing the mappings fail? Just goto error like now or attempt to
kill the child process?

[iant, 2014/10/01 14:55:08]

Good point.  If there are mappings, the child process is going to be waiting for
a notification that it can continue.  If there is an error writing the
notifications, I think what we should do is use that notification to tell the
child to exit.  Probably we should pass the Errno value to the child, and then
have it pass the same Errno value back to the parent process.

+                        }
+                }
+
                 if sys.Joinpgrp != 0 {
                         // Place the child in the specified process group.
                         RawSyscall(SYS_SETPGID, r1, uintptr(sys.Joinpgrp), 0)
                 } else if sys.Foreground || sys.Setpgid {
                         // Place the child in a new process group.
                         RawSyscall(SYS_SETPGID, 0, 0, 0)
 
                         if sys.Foreground {
                                 // Set new foreground process group.
                                 RawSyscall(SYS_IOCTL, uintptr(Stdin), TIOCSPGRP, uintptr(unsafe.Pointer(&pid)))
                         }
                 }
 
                 return pid, 0
         }
 
         // Fork succeeded, now in child.
+        if _, _, err1 = RawSyscall(SYS_CLOSE, uintptr(child), 0, 0); err != 0 {
+                goto childerror
+        }
+
+        if sys.UidMappings != nil || sys.GidMappings != nil {
+                _, _, err1 = RawSyscall(SYS_READ, uintptr(parent), uintptr(unsafe.Pointer(&lzero)), uintptr(1))
+                if err1 != 0 {
+                        goto childerror
+                }
+        }
 
         // Parent death signal
         if sys.Pdeathsig != 0 {
                 _, _, err1 = RawSyscall6(SYS_PRCTL, PR_SET_PDEATHSIG, uintptr(sys.Pdeathsig), 0, 0, 0, 0)
                 if err1 != 0 {
                         goto childerror
                 }
 
                 // Signal self if parent is already dead. This might cause a
                 // duplicate signal in rare cases, but it won't matter when
@@ skipping 83 matching lines @@
         // Chdir
         if dir != nil {
                 _, _, err1 = RawSyscall(SYS_CHDIR, uintptr(unsafe.Pointer(dir)), 0, 0)
                 if err1 != 0 {
                         goto childerror
                 }
         }
 
         // Pass 1: look for fd[i] < i and move those up above len(fd)
         // so that pass 2 won't stomp on an fd it needs later.
-        if pipe < nextfd {
-                _, _, err1 = RawSyscall(SYS_DUP2, uintptr(pipe), uintptr(nextfd), 0)
+        if child < nextfd {
+                _, _, err1 = RawSyscall(SYS_DUP2, uintptr(child), uintptr(nextfd), 0)
                 if err1 != 0 {
                         goto childerror
                 }
                 RawSyscall(SYS_FCNTL, uintptr(nextfd), F_SETFD, FD_CLOEXEC)
-                pipe = nextfd
+                child = nextfd
                 nextfd++
         }
         for i = 0; i < len(fd); i++ {
                 if fd[i] >= 0 && fd[i] < int(i) {
                         _, _, err1 = RawSyscall(SYS_DUP2, uintptr(fd[i]), uintptr(nextfd), 0)
                         if err1 != 0 {
                                 goto childerror
                         }
                         RawSyscall(SYS_FCNTL, uintptr(nextfd), F_SETFD, FD_CLOEXEC)
                         fd[i] = nextfd
                         nextfd++
-                        if nextfd == pipe { // don't stomp on pipe
+                        if nextfd == child { // don't stomp on pipe
                                 nextfd++
                         }
                 }
         }
 
         // Pass 2: dup fd[i] down onto i.
         for i = 0; i < len(fd); i++ {
                 if fd[i] == -1 {
                         RawSyscall(SYS_CLOSE, uintptr(i), 0, 0)
                         continue
@@ skipping 40 matching lines @@
         }
 
         // Time to exec.
         _, _, err1 = RawSyscall(SYS_EXECVE,
                 uintptr(unsafe.Pointer(argv0)),
                 uintptr(unsafe.Pointer(&argv[0])),
                 uintptr(unsafe.Pointer(&envv[0])))
 
 childerror:
         // send error code on pipe
-        RawSyscall(SYS_WRITE, uintptr(pipe), uintptr(unsafe.Pointer(&err1)), unsafe.Sizeof(err1))
+        RawSyscall(SYS_WRITE, uintptr(child), uintptr(unsafe.Pointer(&err1)), unsafe.Sizeof(err1))
         for {
                 RawSyscall(SYS_EXIT, 253, 0, 0)
         }
 }
 
 // Try to open a pipe with O_CLOEXEC set on both file descriptors.
 func forkExecPipe(p []int) (err error) {
         err = Pipe2(p, O_CLOEXEC)
         // pipe2 was added in 2.6.27 and our minimum requirement is 2.6.23, so it
         // might not be implemented.
         if err == ENOSYS {
                 if err = Pipe(p); err != nil {
                         return
                 }
                 if _, err = fcntl(p[0], F_SETFD, FD_CLOEXEC); err != nil {
                         return
                 }
                 _, err = fcntl(p[1], F_SETFD, FD_CLOEXEC)
         }
         return
 }
+
+func writeUidGidMappings(pid int, sys *SysProcAttr) error {

[iant, 2014/10/01 14:55:08]

Add a comment saying what this function does and noting that it is called in the
parent process.

[mrunalp, 2014/10/01 21:48:42]

Done.

+        if sys.UidMappings != nil {
+                uidf := "/proc/" + itoa(pid) + "/uid_map"
+                fd, err := Open(uidf, O_RDWR, 0)
+                if err != nil {
+                        return err
+                }
+
+                data := ""
+                for _, um := range sys.UidMappings {

[iant, 2014/10/01 14:55:08]

Might as well use a function to write out the mappings rather than repeating the
code.

[mrunalp, 2014/10/01 21:48:42]

Done.

+                        data = data + itoa(um.ContainerId) + " " + itoa(um.HostId) + " " + itoa(um.Size) + "\n"
+                }
+
+                bytes, err := ByteSliceFromString(data)
+                if err != nil {
+                        return err

[iant, 2014/10/01 14:55:07]

Close(fd).

[mrunalp, 2014/10/01 21:48:42]

Done.

+                }
+
+                if _, err := Write(fd, bytes); err != nil {
+                        Close(fd)

[mrunalp, 2014/10/01 01:37:12]

Not yet handles the errors from Close. I see similar pattern in exec_unix.go. I
can add error codes in the next update anyways.

[iant, 2014/10/01 14:55:08]

The Close calls in exec_unix.go are for descriptors opened for reading, not
writing.  It's OK to ignore the error from closing a descriptor opened for
reading, because there is nothing useful to do with the error.  It's not OK to
ignore the error from a descriptor opened for writing, because some errors on
writing the data only appear when the descriptor is closed.

[mrunalp, 2014/10/01 21:48:42]

Acknowledged.

[mrunalp, 2014/10/01 21:48:42]

Done.

+                        return err
+                }
+
+                Close(fd)
+        }
+
+        if sys.GidMappings != nil {
+                gidf := "/proc/" + itoa(pid) + "/gid_map"
+                fd, err := Open(gidf, O_RDWR, 0)
+                if err != nil {
+                        return err
+                }
+
+                data := ""
+                for _, gm := range sys.GidMappings {
+                        data = data + itoa(gm.ContainerId) + " " + itoa(gm.HostId) + " " + itoa(gm.Size) + "\n"
+                }
+
+                bytes, err := ByteSliceFromString(data)
+                if err != nil {
+                        return err
+                }
+
+                if _, err := Write(fd, bytes); err != nil {
+                        Close(fd)
+                        return err
+                }
+
+                Close(fd)
+        }
+
+        return nil
+}