syscall: Adds support for User Namespaces in Linux by a...

src/syscall/exec_linux.go

 // Copyright 2011 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
 // +build linux
 
 package syscall
 
 import (
         "unsafe"
 )
 
+// IdMap holds Container ID to Host ID mappings used for User Namespaces in Linux. See user_namespaces(7).

[iant, 2014/10/01 22:27:18]

Please break the comment line after "Linux.".

[mrunalp, 2014/10/02 00:07:04]

Done.

+type IdMap struct {

[mrunalp, 2014/10/01 21:48:42]

Should I rename Id --> ID everywhere as per naming guidelines?

[iant, 2014/10/01 22:27:18]

Yes, please, sorry I missed that.

Actually IDMap is not a great name, really, not that there are any great names. 
This is so specific to GNU/Linux and to Exec.  Maybe SysProcIDMap would convey
the right association with SysProcAttr.

[mrunalp, 2014/10/02 00:07:04]

Done.

+        ContainerId int // Container Id.
+        HostId      int // Host Id.
+        Size        int // Size.
+}
+
 type SysProcAttr struct {
-        Chroot     string      // Chroot.
-        Credential *Credential // Credential.
-        Ptrace     bool        // Enable tracing.
-        Setsid     bool        // Create session.
-        Setpgid    bool        // Set process group ID to new pid (SYSV setpgrp)
-        Setctty    bool        // Set controlling terminal to fd Ctty (only meaningful if Setsid is set)
-        Noctty     bool        // Detach fd 0 from controlling terminal
-        Ctty       int         // Controlling TTY fd (Linux only)
-        Pdeathsig  Signal      // Signal that the process will get when its parent dies (Linux only)
-        Cloneflags uintptr     // Flags for clone calls (Linux only)
-        Foreground bool        // Set foreground process group to child's pid. (Implies Setpgid. Stdin should be a TTY)
-        Joinpgrp   int         // If != 0, child's process group ID. (Setpgid must not be set)
+        Chroot      string      // Chroot.
+        Credential  *Credential // Credential.
+        Ptrace      bool        // Enable tracing.
+        Setsid      bool        // Create session.
+        Setpgid     bool        // Set process group ID to new pid (SYSV setpgrp)
+        Setctty     bool        // Set controlling terminal to fd Ctty (only meaningful if Setsid is set)
+        Noctty      bool        // Detach fd 0 from controlling terminal
+        Ctty        int         // Controlling TTY fd (Linux only)
+        Pdeathsig   Signal      // Signal that the process will get when its parent dies (Linux only)
+        Cloneflags  uintptr     // Flags for clone calls (Linux only)
+        Foreground  bool        // Set foreground process group to child's pid. (Implies Setpgid. Stdin should be a TTY)
+        Joinpgrp    int         // If != 0, child's process group ID. (Setpgid must not be set)
+        UidMappings []IdMap     // User ID mappings for user namespaces.
+        GidMappings []IdMap     // Group ID mappings for user namespaces.
 }
 
 // Implemented in runtime package.
 func runtime_BeforeFork()
 func runtime_AfterFork()
 
 // Fork, dup fd onto 0..len(fd), and exec(argv0, argvv, envv) in child.
 // If a dup or exec fails, write the errno error to pipe.
 // (Pipe is close-on-exec so if exec succeeds, it will be closed.)
 // In the child, this function must not acquire any locks, because
 // they might have been locked at the time of the fork.  This means
 // no rescheduling, no malloc calls, and no new stack segments.
 // For the same reason compiler does not race instrument it.
 // The calls to RawSyscall are okay because they are assembly
 // functions that do not grow the stack.
 func forkAndExecInChild(argv0 *byte, argv, envv []*byte, chroot, dir *byte, attr *ProcAttr, sys *SysProcAttr, pipe int) (pid int, err Errno) {
         // Declare all variables at top in case any
         // declarations require heap allocation (e.g., err1).
         var (
                 r1     uintptr
                 err1   Errno
                 nextfd int
                 i      int
+                p      [2]int
         )
 
         // Guard against side effects of shuffling fds below.
         // Make sure that nextfd is beyond any currently open files so
         // that we can't run the risk of overwriting any of them.
         fd := make([]int, len(attr.Files))
         nextfd = len(attr.Files)
         for i, ufd := range attr.Files {
                 if nextfd < int(ufd) {
                         nextfd = int(ufd)
                 }
                 fd[i] = int(ufd)
         }
         nextfd++
 
+        // Allocate another pipe for parent to child communication for synchronizing writing of uid/gid mappings.
+        if sys.UidMappings != nil || sys.GidMappings != nil {
+                p[0] = -1

[iant, 2014/10/01 22:27:18]

No need to set p[0] and p[1] to -1.  I'm not sure why the code in exec_unix.go
does that.

[mrunalp, 2014/10/02 00:07:04]

Done.

+                p[1] = -1
+                if err := forkExecPipe(p[:]); err != nil {
+                        return 0, err.(Errno)
+                }
+        }
+
         // About to call fork.
         // No more allocation or calls of non-assembly functions.
         runtime_BeforeFork()
         r1, _, err1 = RawSyscall6(SYS_CLONE, uintptr(SIGCHLD)|sys.Cloneflags, 0, 0, 0, 0, 0)
         if err1 != 0 {
                 runtime_AfterFork()
                 return 0, err1
         }
 
         if r1 != 0 {
                 // parent; return PID
                 runtime_AfterFork()
                 pid = int(r1)
 
+                if sys.UidMappings != nil || sys.GidMappings != nil {
+                        Close(p[0])
+                        var err2 uintptr

[iant, 2014/10/01 22:27:18]

Should probably declare err2 up above next to err1.  No need to set err2 to 0,
it's the default value anyhow.

[mrunalp, 2014/10/02 00:07:04]

Done.

+                        err2 = 0
+                        err := writeUidGidMappings(pid, sys)
+                        if err != nil {
+                                err2 = uintptr(err.(Errno))
+                        }
+                        RawSyscall(SYS_WRITE, uintptr(p[1]), uintptr(unsafe.Pointer(&err2)), unsafe.Sizeof(err2))

[mrunalp, 2014/10/01 21:48:42]

Again questions around error-handling here. There isn't much we can do if we
can't send this to the child. Does a panic work or make sense here? 

[iant, 2014/10/01 22:27:18]

Fortunately I don't think we have to worry about this (somewhat unlikely) error
case.  It's hard to see how closing the pipe could fail, and that will mean that
the child will fail to read the expected value, so the child will wind up
exiting anyhow.

[mrunalp, 2014/10/02 00:07:04]

Acknowledged.

+                        Close(p[1])
+                }
+
                 if sys.Joinpgrp != 0 {
                         // Place the child in the specified process group.
                         RawSyscall(SYS_SETPGID, r1, uintptr(sys.Joinpgrp), 0)
                 } else if sys.Foreground || sys.Setpgid {
                         // Place the child in a new process group.
                         RawSyscall(SYS_SETPGID, 0, 0, 0)
 
                         if sys.Foreground {
                                 // Set new foreground process group.
                                 RawSyscall(SYS_IOCTL, uintptr(Stdin), TIOCSPGRP, uintptr(unsafe.Pointer(&pid)))
                         }
                 }
 
                 return pid, 0
         }
 
         // Fork succeeded, now in child.
 
+        // Wait for uid/gid mappings to be written.
+        if sys.UidMappings != nil || sys.GidMappings != nil {
+                if _, _, err1 = RawSyscall(SYS_CLOSE, uintptr(p[1]), 0, 0); err1 != 0 {
+                        goto childerror
+                }
+                _, _, err2 := RawSyscall(SYS_READ, uintptr(p[0]), uintptr(unsafe.Pointer(&err1)), uintptr(1))

[iant, 2014/10/01 22:27:17]

The parent is going to write unsafe.Sizeof(uintptr(0)) bytes, and that is how
many we should read here.  We shouldn't pass &err1, we should pass &err2.  We
should err1 here, and not use :=.  We should catch the first return value, which
is the number of bytes read, and make sure it is == unsafe.Sizeof(uintptr(0)).

[mrunalp, 2014/10/02 00:07:04]

Ahh, I missed that. Thanks!

[mrunalp, 2014/10/02 00:07:04]

Done.

+                if err2 != 0 {
+                        err1 = err2
+                        goto childerror
+                }
+                if err1 != 0 {
+                        goto childerror
+                }
+        }
+
         // Parent death signal
         if sys.Pdeathsig != 0 {
                 _, _, err1 = RawSyscall6(SYS_PRCTL, PR_SET_PDEATHSIG, uintptr(sys.Pdeathsig), 0, 0, 0, 0)
                 if err1 != 0 {
                         goto childerror
                 }
 
                 // Signal self if parent is already dead. This might cause a
                 // duplicate signal in rare cases, but it won't matter when
                 // using SIGKILL.
@@ skipping 183 matching lines @@
                 if err = Pipe(p); err != nil {
                         return
                 }
                 if _, err = fcntl(p[0], F_SETFD, FD_CLOEXEC); err != nil {
                         return
                 }
                 _, err = fcntl(p[1], F_SETFD, FD_CLOEXEC)
         }
         return
 }
+
+// writeIdMappings writes the user namespace uid or gid mappings to the specified path.
+func writeIdMappings(path string, idMap []IdMap) error {
+        fd, err := Open(path, O_RDWR, 0)
+        if err != nil {
+                return err
+        }
+
+        data := ""
+        for _, im := range idMap {
+                data = data + itoa(im.ContainerId) + " " + itoa(im.HostId) + " " + itoa(im.Size) + "\n"
+        }
+
+        bytes, err := ByteSliceFromString(data)
+        if err != nil {
+                Close(fd)
+                return err
+        }
+
+        if _, err := Write(fd, bytes); err != nil {
+                Close(fd)
+                return err
+        }
+
+        if err := Close(fd); err != nil {
+                return err
+        }
+
+        return nil
+}
+
+// writeUidGidMappings writes uid/gid mappings for user namespaces for a process and it is called from the parent process.

[iant, 2014/10/01 22:27:18]

Add a line break somewhere in the comment.

[mrunalp, 2014/10/02 00:07:04]

Done.

+func writeUidGidMappings(pid int, sys *SysProcAttr) error {
+        if sys.UidMappings != nil {
+                uidf := "/proc/" + itoa(pid) + "/uid_map"
+                if err := writeIdMappings(uidf, sys.UidMappings); err != nil {
+                        return err
+                }
+        }
+
+        if sys.GidMappings != nil {
+                gidf := "/proc/" + itoa(pid) + "/gid_map"
+                if err := writeIdMappings(gidf, sys.GidMappings); err != nil {
+                        return err
+                }
+        }
+
+        return nil
+}