libct: don't send config to nsexec when joining an existing timens#4636
libct: don't send config to nsexec when joining an existing timens#4636rata merged 2 commits intoopencontainers:mainfrom
Conversation
|
Nice find, nice fix, thanks! Just a single nit about the test case. Also, we might need to backport it to 1.2. |
cyphar
left a comment
There was a problem hiding this comment.
Unless I'm mistaken this will stop us from detecting broken configurations (i.e. configurations with timens offsets configured but not joining a time namespace). Of course it's easy to add a step to the validator but the previous version already did validation by getting an error from the kernel if appropriate.
Also, it is theoretically possible for someone to want to join a timens that hasn't been used yet and so configuring a timens offset of a timens we didn't create (while a little weird) is perfectly valid.
Personally, I think the old behaviour was better -- the user gets the same error from the kernel they would get if they tried to apply an incorrect configuration manually.
Signed-off-by: lifubang <lifubang@acmcoder.com>
We should configure the process's timens offset only when we need to create new time namespace, we shouldn't do it if we are joining an existing time namespace. (opencontainers#4635) Signed-off-by: lifubang <lifubang@acmcoder.com>
fa9f3a3 to
ad09197
Compare
Yes, make sense, I changed the logic to the same way as USERNS. runc/libcontainer/container_linux.go Lines 1082 to 1084 in ad09197 |
| if c.config.TimeOffsets != nil { | ||
| // write boottime and monotonic time ns offsets only when we are not joining an existing time ns | ||
| _, joinExistingTime := nsMaps[configs.NEWTIME] | ||
| if !joinExistingTime && c.config.TimeOffsets != nil { |
There was a problem hiding this comment.
It is theoretically possible someone will want to be able to do this, but I guess it's a fairly esoteric thing.
Fix #4635
When we exec a process in a container has private timens, we need to
join the init process's timens path, so, we should not send the timens
config to nsexec, otherwise, runc will try to update the process's time
ns configuration when joining the timens path.
We should configure the process's timens offset only when we need to
create new time namespace, we shouldn't do it if we are joining an
existing time namespace.