exec.go#Action

  1.     Action: func(context *cli.Context) error {
  2.         if err := checkArgs(context, 1, minArgs); err != nil {
  3.             return err
  4.         }
  5.         if err := revisePidFile(context); err != nil {
  6.             return err
  7.         }
  8.         status, err := execProcess(context)
  9.         if err == nil {
  10.             os.Exit(status)
  11.         }
  12.         return fmt.Errorf("exec failed: %v", err)
  13.     },
  14.     SkipArgReorder: true,

1) exec.go#execProcess

  1. func execProcess(context *cli.Context) (int, error) {
  2.     container, err := getContainer(context)
  3.     if err != nil {
  4.         return -1, err
  5.     }
  6.     status, err := container.Status()
  7.     if err != nil {
  8.         return -1, err
  9.     }
  10.     if status == libcontainer.Stopped {
  11.         return -1, fmt.Errorf("cannot exec a container that has stopped")
  12.     }
  13.     path := context.String("process")
  14.     if path == "" && len(context.Args()) == 1 {
  15.         return -1, fmt.Errorf("process args cannot be empty")
  16.     }
  17.     detach := context.Bool("detach")
  18.     state, err := container.State()
  19.     if err != nil {
  20.         return -1, err
  21.     }
  22.     bundle := utils.SearchLabels(state.Config.Labels, "bundle")
  23.     p, err := getProcess(context, bundle)
  24.     if err != nil {
  25.         return -1, err
  26.     }
  27.     r := &runner{
  28.         enableSubreaper: false,
  29.         shouldDestroy:   false,
  30.         container:       container,
  31.         consoleSocket:   context.String("console-socket"),
  32.         detach:          detach,
  33.         pidFile:         context.String("pid-file"),
  34.         action:          CT_ACT_RUN,
  35.         init:            false,
  36.     }
  37.     return r.run(p)
  38. }

1.1) exec.go#getProcess

  1. func getProcess(context *cli.Context, bundle string) (*specs.Process, error) {
  2.     if path := context.String("process"); path != "" {
  3.         f, err := os.Open(path)
  4.         if err != nil {
  5.             return nil, err
  6.         }
  7.         defer f.Close()
  8.         var p specs.Process
  9.         if err := json.NewDecoder(f).Decode(&p); err != nil {
  10.             return nil, err
  11.         }
  12.         return &p, validateProcessSpec(&p)
  13.     }
  14.     // process via cli flags
  15.     if err := os.Chdir(bundle); err != nil {
  16.         return nil, err
  17.     }
  18.     spec, err := loadSpec(specConfig)
  19.     if err != nil {
  20.         return nil, err
  21.     }
  22.     p := spec.Process
  23.     p.Args = context.Args()[1:]
  24.     // override the cwd, if passed
  25.     if context.String("cwd") != "" {
  26.         p.Cwd = context.String("cwd")
  27.     }
  28.     if ap := context.String("apparmor"); ap != "" {
  29.         p.ApparmorProfile = ap
  30.     }
  31.     if l := context.String("process-label"); l != "" {
  32.         p.SelinuxLabel = l
  33.     }
  34.     if caps := context.StringSlice("cap"); len(caps) > 0 {
  35.         for _, c := range caps {
  36.             p.Capabilities.Bounding = append(p.Capabilities.Bounding, c)
  37.             p.Capabilities.Inheritable = append(p.Capabilities.Inheritable, c)
  38.             p.Capabilities.Effective = append(p.Capabilities.Effective, c)
  39.             p.Capabilities.Permitted = append(p.Capabilities.Permitted, c)
  40.             p.Capabilities.Ambient = append(p.Capabilities.Ambient, c)
  41.         }
  42.     }
  43.     // append the passed env variables
  44.     p.Env = append(p.Env, context.StringSlice("env")...)
  46.     // set the tty
  47.     if context.IsSet("tty") {
  48.         p.Terminal = context.Bool("tty")
  49.     }
  50.     if context.IsSet("no-new-privs") {
  51.         p.NoNewPrivileges = context.Bool("no-new-privs")
  52.     }
  53.     // override the user, if passed
  54.     if context.String("user") != "" {
  55.         u := strings.SplitN(context.String("user"), ":", 2)
  56.         if len(u) > 1 {
  57.             gid, err := strconv.Atoi(u[1])
  58.             if err != nil {
  59.                 return nil, fmt.Errorf("parsing %s as int for gid failed: %v", u[1], err)
  60.             }
  61.             p.User.GID = uint32(gid)
  62.         }
  63.         uid, err := strconv.Atoi(u[0])
  64.         if err != nil {
  65.             return nil, fmt.Errorf("parsing %s as int for uid failed: %v", u[0], err)
  66.         }
  67.         p.User.UID = uint32(uid)
  68.     }
  69.     for _, gid := range context.Int64Slice("additional-gids") {
  70.         if gid < 0 {
  71.             return nil, fmt.Errorf("additional-gids must be a positive number %d", gid)
  72.         }
  73.         p.User.AdditionalGids = append(p.User.AdditionalGids, uint32(gid))
  74.     }
  75.     return p, nil
  76. }

1.2) libcontainer/container_linux.go#linuxContainer.newParentProcess

如果非init进程，那么会返回SetnsProcess。

  1. func (c *linuxContainer) newParentProcess(p *Process) (parentProcess, error) {
  2.     parentPipe, childPipe, err := utils.NewSockPair("init")
  3.     if err != nil {
  4.         return nil, newSystemErrorWithCause(err, "creating new init pipe")
  5.     }
  6.     cmd, err := c.commandTemplate(p, childPipe)
  7.     if err != nil {
  8.         return nil, newSystemErrorWithCause(err, "creating new command template")
  9.     }
  10.     if !p.Init {
  11.         return c.newSetnsProcess(p, cmd, parentPipe, childPipe)
  12.     }
  14.     // We only set up fifoFd if we're not doing a `runc exec`. The historic
  15.     // reason for this is that previously we would pass a dirfd that allowed
  16.     // for container rootfs escape (and not doing it in `runc exec` avoided
  17.     // that problem), but we no longer do that. However, there's no need to do
  18.     // this for `runc exec` so we just keep it this way to be safe.
  19.     if err := c.includeExecFifo(cmd); err != nil {
  20.         return nil, newSystemErrorWithCause(err, "including execfifo in cmd.Exec setup")
  21.     }
  22.     return c.newInitProcess(p, cmd, parentPipe, childPipe)
  23. }

1.2.1) libcontainer/container_linux.go#linuxContainer.newSetnsProcess

  1. func (c *linuxContainer) newSetnsProcess(p *Process, cmd *exec.Cmd, parentPipe, childPipe *os.File) (*setnsProcess, error) {
  2.     cmd.Env = append(cmd.Env, "_LIBCONTAINER_INITTYPE="+string(initSetns))
  3.     state, err := c.currentState()
  4.     if err != nil {
  5.         return nil, newSystemErrorWithCause(err, "getting container's current state")
  6.     }
  7.     // for setns process, we don't have to set cloneflags as the process namespaces
  8.     // will only be set via setns syscall
  9.     data, err := c.bootstrapData(0, state.NamespacePaths)
  10.     if err != nil {
  11.         return nil, err
  12.     }
  13.     return &setnsProcess{
  14.         cmd:             cmd,
  15.         cgroupPaths:     c.cgroupManager.GetPaths(),
  16.         rootlessCgroups: c.config.RootlessCgroups,
  17.         intelRdtPath:    state.IntelRdtPath,
  18.         childPipe:       childPipe,
  19.         parentPipe:      parentPipe,
  20.         config:          c.newInitConfig(p),
  21.         process:         p,
  22.         bootstrapData:   data,
  23.     }, nil
  24. }

1.3) libcontainer/process_linux.go#setnsProcess.start

  1. func (p *setnsProcess) start() (err error) {
  2.     defer p.parentPipe.Close()
  3.     err = p.cmd.Start()
  4.     p.childPipe.Close()
  5.     if err != nil {
  6.         return newSystemErrorWithCause(err, "starting setns process")
  7.     }
  8.     if p.bootstrapData != nil {
  9.         if _, err := io.Copy(p.parentPipe, p.bootstrapData); err != nil {
  10.             return newSystemErrorWithCause(err, "copying bootstrap data to pipe")
  11.         }
  12.     }
  13.     if err = p.execSetns(); err != nil {
  14.         return newSystemErrorWithCause(err, "executing setns process")
  15.     }
  16.     if len(p.cgroupPaths) > 0 {
  17.         if err := cgroups.EnterPid(p.cgroupPaths, p.pid()); err != nil && !p.rootlessCgroups {
  18.             return newSystemErrorWithCausef(err, "adding pid %d to cgroups", p.pid())
  19.         }
  20.     }
  21.     if p.intelRdtPath != "" {
  22.         // if Intel RDT "resource control" filesystem path exists
  23.         _, err := os.Stat(p.intelRdtPath)
  24.         if err == nil {
  25.             if err := intelrdt.WriteIntelRdtTasks(p.intelRdtPath, p.pid()); err != nil {
  26.                 return newSystemErrorWithCausef(err, "adding pid %d to Intel RDT resource control filesystem", p.pid())
  27.             }
  28.         }
  29.     }
  30.     // set rlimits, this has to be done here because we lose permissions
  31.     // to raise the limits once we enter a user-namespace
  32.     if err := setupRlimits(p.config.Rlimits, p.pid()); err != nil {
  33.         return newSystemErrorWithCause(err, "setting rlimits for process")
  34.     }
  35.     if err := utils.WriteJSON(p.parentPipe, p.config); err != nil {
  36.         return newSystemErrorWithCause(err, "writing config to pipe")
  37.     }
  39.     ierr := parseSync(p.parentPipe, func(sync *syncT) error {
  40.         switch sync.Type {
  41.         case procReady:
  42.             // This shouldn't happen.
  43.             panic("unexpected procReady in setns")
  44.         case procHooks:
  45.             // This shouldn't happen.
  46.             panic("unexpected procHooks in setns")
  47.         default:
  48.             return newSystemError(fmt.Errorf("invalid JSON payload from child"))
  49.         }
  50.     })
  52.     if err := unix.Shutdown(int(p.parentPipe.Fd()), unix.SHUT_WR); err != nil {
  53.         return newSystemErrorWithCause(err, "calling shutdown on init pipe")
  54.     }
  55.     // Must be done after Shutdown so the child will exit and we can wait for it.
  56.     if ierr != nil {
  57.         p.wait()
  58.         return ierr
  59.     }
  60.     return nil
  61. }

1.3.1) libcontainer/process_linux.go#setnsProcess.execSetns

  1. // execSetns runs the process that executes C code to perform the setns calls
  2. // because setns support requires the C process to fork off a child and perform the setns
  3. // before the go runtime boots, we wait on the process to die and receive the child's pid
  4. // over the provided pipe.
  5. func (p *setnsProcess) execSetns() error {
  6.     status, err := p.cmd.Process.Wait()
  7.     if err != nil {
  8.         p.cmd.Wait()
  9.         return newSystemErrorWithCause(err, "waiting on setns process to finish")
  10.     }
  11.     if !status.Success() {
  12.         p.cmd.Wait()
  13.         return newSystemError(&exec.ExitError{ProcessState: status})
  14.     }
  15.     var pid *pid
  16.     if err := json.NewDecoder(p.parentPipe).Decode(&pid); err != nil {
  17.         p.cmd.Wait()
  18.         return newSystemErrorWithCause(err, "reading pid from init pipe")
  19.     }
  21.     // Clean up the zombie parent process
  22.     firstChildProcess, err := os.FindProcess(pid.PidFirstChild)
  23.     if err != nil {
  24.         return err
  25.     }
  27.     // Ignore the error in case the child has already been reaped for any reason
  28.     _, _ = firstChildProcess.Wait()
  30.     process, err := os.FindProcess(pid.Pid)
  31.     if err != nil {
  32.         return err
  33.     }
  34.     p.cmd.Process = process
  35.     p.process.ops = p
  36.     return nil
  37. }

2) 【child】init.go

  2. import (
  3.     "os"
  4.     "runtime"
  6.     "github.com/opencontainers/runc/libcontainer"
  7.   // ********************************** NOTICE ********************************** //
  8.     _ "github.com/opencontainers/runc/libcontainer/nsenter"
  9.   // ********************************** NOTICE ********************************** //
  10.     "github.com/urfave/cli"
  11. )
  13. func init() {
  14.     if len(os.Args) > 1 && os.Args[1] == "init" {
  15.         runtime.GOMAXPROCS(1)
  16.         runtime.LockOSThread()
  17.     }
  18. }
  20. var initCommand = cli.Command{
  21.     Name:  "init",
  22.     Usage: `initialize the namespaces and launch the process (do not call it outside of runc)`,
  23.     Action: func(context *cli.Context) error {
  24.         factory, _ := libcontainer.New("")
  25.         if err := factory.StartInitialization(); err != nil {
  26.             // as the error is sent back to the parent there is no need to log
  27.             // or write it to stderr because the parent process will handle this
  28.             os.Exit(1)
  29.         }
  30.         panic("libcontainer: container init failed to exec")
  31.     },
  32. }

2.1) libcontainer/nsenter/nsenter_gccgo.go

  1. // +build linux,gccgo
  3. package nsenter
  5. /*
  6. #cgo CFLAGS: -Wall
  7. extern void nsexec();
  8. void __attribute__((constructor)) init(void) {
  9.     nsexec();
  10. }
  11. */
  12. import "C"
  14. // AlwaysFalse is here to stay false
  15. // (and be exported so the compiler doesn't optimize out its reference)
  16. var AlwaysFalse bool
  18. func init() {
  19.     if AlwaysFalse {
  20.         // by referencing this C init() in a noop test, it will ensure the compiler
  21.         // links in the C function.
  22.         // https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65134
  23.         C.init()
  24.     }
  25. }

2.1.1) libcontainer/nsenter/nsenter.c#nsexec（Cgo无法使用交叉编译）

  1. void nsexec(void)
  2. {
  3.     int pipenum;
  4.     jmp_buf env;
  5.     int sync_child_pipe[2], sync_grandchild_pipe[2];
  6.     struct nlconfig_t config = { 0 };
  8.     /*
  9.      * If we don't have an init pipe, just return to the go routine.
  10.      * We'll only get an init pipe for start or exec.
  11.      */
  12.     pipenum = initpipe();
  13.     if (pipenum == -1)
  14.         return;
  16.     /* Parse all of the netlink configuration. */
  17.     nl_parse(pipenum, &config);
  19.     /* Set oom_score_adj. This has to be done before !dumpable because
  20.      * /proc/self/oom_score_adj is not writeable unless you're an privileged
  21.      * user (if !dumpable is set). All children inherit their parent's
  22.      * oom_score_adj value on fork(2) so this will always be propagated
  23.      * properly.
  24.      */
  25.     update_oom_score_adj(config.oom_score_adj, config.oom_score_adj_len);
  27.     /*
  28.      * Make the process non-dumpable, to avoid various race conditions that
  29.      * could cause processes in namespaces we're joining to access host
  30.      * resources (or potentially execute code).
  31.      *
  32.      * However, if the number of namespaces we are joining is 0, we are not
  33.      * going to be switching to a different security context. Thus setting
  34.      * ourselves to be non-dumpable only breaks things (like rootless
  35.      * containers), which is the recommendation from the kernel folks.
  36.      */
  37.     if (config.namespaces) {
  38.         if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) < 0)
  39.             bail("failed to set process as non-dumpable");
  40.     }
  42.     /* Pipe so we can tell the child when we've finished setting up. */
  43.     if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sync_child_pipe) < 0)
  44.         bail("failed to setup sync pipe between parent and child");
  46.     /*
  47.      * We need a new socketpair to sync with grandchild so we don't have
  48.      * race condition with child.
  49.      */
  50.     if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sync_grandchild_pipe) < 0)
  51.         bail("failed to setup sync pipe between parent and grandchild");
  53.     /* TODO: Currently we aren't dealing with child deaths properly. */
  55.     /*
  56.      * Okay, so this is quite annoying.
  57.      *
  58.      * In order for this unsharing code to be more extensible we need to split
  59.      * up unshare(CLONE_NEWUSER) and clone() in various ways. The ideal case
  60.      * would be if we did clone(CLONE_NEWUSER) and the other namespaces
  61.      * separately, but because of SELinux issues we cannot really do that. But
  62.      * we cannot just dump the namespace flags into clone(...) because several
  63.      * usecases (such as rootless containers) require more granularity around
  64.      * the namespace setup. In addition, some older kernels had issues where
  65.      * CLONE_NEWUSER wasn't handled before other namespaces (but we cannot
  66.      * handle this while also dealing with SELinux so we choose SELinux support
  67.      * over broken kernel support).
  68.      *
  69.      * However, if we unshare(2) the user namespace *before* we clone(2), then
  70.      * all hell breaks loose.
  71.      *
  72.      * The parent no longer has permissions to do many things (unshare(2) drops
  73.      * all capabilities in your old namespace), and the container cannot be set
  74.      * up to have more than one {uid,gid} mapping. This is obviously less than
  75.      * ideal. In order to fix this, we have to first clone(2) and then unshare.
  76.      *
  77.      * Unfortunately, it's not as simple as that. We have to fork to enter the
  78.      * PID namespace (the PID namespace only applies to children). Since we'll
  79.      * have to double-fork, this clone_parent() call won't be able to get the
  80.      * PID of the _actual_ init process (without doing more synchronisation than
  81.      * I can deal with at the moment). So we'll just get the parent to send it
  82.      * for us, the only job of this process is to update
  83.      * /proc/pid/{setgroups,uid_map,gid_map}.
  84.      *
  85.      * And as a result of the above, we also need to setns(2) in the first child
  86.      * because if we join a PID namespace in the topmost parent then our child
  87.      * will be in that namespace (and it will not be able to give us a PID value
  88.      * that makes sense without resorting to sending things with cmsg).
  89.      *
  90.      * This also deals with an older issue caused by dumping cloneflags into
  91.      * clone(2): On old kernels, CLONE_PARENT didn't work with CLONE_NEWPID, so
  92.      * we have to unshare(2) before clone(2) in order to do this. This was fixed
  93.      * in upstream commit 1f7f4dde5c945f41a7abc2285be43d918029ecc5, and was
  94.      * introduced by 40a0d32d1eaffe6aac7324ca92604b6b3977eb0e. As far as we're
  95.      * aware, the last mainline kernel which had this bug was Linux 3.12.
  96.      * However, we cannot comment on which kernels the broken patch was
  97.      * backported to.
  98.      *
  99.      * -- Aleksa "what has my life come to?" Sarai
  100.      */
  102.     switch (setjmp(env)) {
  103.         /*
  104.          * Stage 0: We're in the parent. Our job is just to create a new child
  105.          *          (stage 1: JUMP_CHILD) process and write its uid_map and
  106.          *          gid_map. That process will go on to create a new process, then
  107.          *          it will send us its PID which we will send to the bootstrap
  108.          *          process.
  109.          */
  110.     case JUMP_PARENT:{
  111.             int len;
  112.             pid_t child, first_child = -1;
  113.             bool ready = false;
  115.             /* For debugging. */
  116.             prctl(PR_SET_NAME, (unsigned long)"runc:[0:PARENT]", 0, 0, 0);
  118.             /* Start the process of getting a container. */
  119.             child = clone_parent(&env, JUMP_CHILD);
  120.             if (child < 0)
  121.                 bail("unable to fork: child_func");
  123.             /*
  124.              * State machine for synchronisation with the children.
  125.              *
  126.              * Father only return when both child and grandchild are
  127.              * ready, so we can receive all possible error codes
  128.              * generated by children.
  129.              */
  130.             while (!ready) {
  131.                 enum sync_t s;
  132.                 int ret;
  134.                 syncfd = sync_child_pipe[1];
  135.                 close(sync_child_pipe[0]);
  137.                 if (read(syncfd, &s, sizeof(s)) != sizeof(s))
  138.                     bail("failed to sync with child: next state");
  140.                 switch (s) {
  141.                 case SYNC_ERR:
  142.                     /* We have to mirror the error code of the child. */
  143.                     if (read(syncfd, &ret, sizeof(ret)) != sizeof(ret))
  144.                         bail("failed to sync with child: read(error code)");
  146.                     exit(ret);
  147.                 case SYNC_USERMAP_PLS:
  148.                     /*
  149.                      * Enable setgroups(2) if we've been asked to. But we also
  150.                      * have to explicitly disable setgroups(2) if we're
  151.                      * creating a rootless container for single-entry mapping.
  152.                      * i.e. config.is_setgroup == false.
  153.                      * (this is required since Linux 3.19).
  154.                      *
  155.                      * For rootless multi-entry mapping, config.is_setgroup shall be true and
  156.                      * newuidmap/newgidmap shall be used.
  157.                      */
  159.                     if (config.is_rootless_euid && !config.is_setgroup)
  160.                         update_setgroups(child, SETGROUPS_DENY);
  162.                     /* Set up mappings. */
  163.                     update_uidmap(config.uidmappath, child, config.uidmap, config.uidmap_len);
  164.                     update_gidmap(config.gidmappath, child, config.gidmap, config.gidmap_len);
  166.                     s = SYNC_USERMAP_ACK;
  167.                     if (write(syncfd, &s, sizeof(s)) != sizeof(s)) {
  168.                         kill(child, SIGKILL);
  169.                         bail("failed to sync with child: write(SYNC_USERMAP_ACK)");
  170.                     }
  171.                     break;
  172.                 case SYNC_RECVPID_PLS:{
  173.                         first_child = child;
  175.                         /* Get the init_func pid. */
  176.                         if (read(syncfd, &child, sizeof(child)) != sizeof(child)) {
  177.                             kill(first_child, SIGKILL);
  178.                             bail("failed to sync with child: read(childpid)");
  179.                         }
  181.                         /* Send ACK. */
  182.                         s = SYNC_RECVPID_ACK;
  183.                         if (write(syncfd, &s, sizeof(s)) != sizeof(s)) {
  184.                             kill(first_child, SIGKILL);
  185.                             kill(child, SIGKILL);
  186.                             bail("failed to sync with child: write(SYNC_RECVPID_ACK)");
  187.                         }
  189.                         /* Send the init_func pid back to our parent.
  190.                          *
  191.                          * Send the init_func pid and the pid of the first child back to our parent.
  192.                          * We need to send both back because we can't reap the first child we created (CLONE_PARENT).
  193.                          * It becomes the responsibility of our parent to reap the first child.
  194.                          */
  195.                         len = dprintf(pipenum, "{\"pid\": %d, \"pid_first\": %d}\n", child, first_child);
  196.                         if (len < 0) {
  197.                             kill(child, SIGKILL);
  198.                             bail("unable to generate JSON for child pid");
  199.                         }
  200.                     }
  201.                     break;
  202.                 case SYNC_CHILD_READY:
  203.                     ready = true;
  204.                     break;
  205.                 default:
  206.                     bail("unexpected sync value: %u", s);
  207.                 }
  208.             }
  210.             /* Now sync with grandchild. */
  212.             ready = false;
  213.             while (!ready) {
  214.                 enum sync_t s;
  215.                 int ret;
  217.                 syncfd = sync_grandchild_pipe[1];
  218.                 close(sync_grandchild_pipe[0]);
  220.                 s = SYNC_GRANDCHILD;
  221.                 if (write(syncfd, &s, sizeof(s)) != sizeof(s)) {
  222.                     kill(child, SIGKILL);
  223.                     bail("failed to sync with child: write(SYNC_GRANDCHILD)");
  224.                 }
  226.                 if (read(syncfd, &s, sizeof(s)) != sizeof(s))
  227.                     bail("failed to sync with child: next state");
  229.                 switch (s) {
  230.                 case SYNC_ERR:
  231.                     /* We have to mirror the error code of the child. */
  232.                     if (read(syncfd, &ret, sizeof(ret)) != sizeof(ret))
  233.                         bail("failed to sync with child: read(error code)");
  235.                     exit(ret);
  236.                 case SYNC_CHILD_READY:
  237.                     ready = true;
  238.                     break;
  239.                 default:
  240.                     bail("unexpected sync value: %u", s);
  241.                 }
  242.             }
  243.             exit(0);
  244.         }
  246.         /*
  247.          * Stage 1: We're in the first child process. Our job is to join any
  248.          *          provided namespaces in the netlink payload and unshare all
  249.          *          of the requested namespaces. If we've been asked to
  250.          *          CLONE_NEWUSER, we will ask our parent (stage 0) to set up
  251.          *          our user mappings for us. Then, we create a new child
  252.          *          (stage 2: JUMP_INIT) for PID namespace. We then send the
  253.          *          child's PID to our parent (stage 0).
  254.          */
  255.     case JUMP_CHILD:{
  256.             pid_t child;
  257.             enum sync_t s;
  259.             /* We're in a child and thus need to tell the parent if we die. */
  260.             syncfd = sync_child_pipe[0];
  261.             close(sync_child_pipe[1]);
  263.             /* For debugging. */
  264.             prctl(PR_SET_NAME, (unsigned long)"runc:[1:CHILD]", 0, 0, 0);
  266.             /*
  267.              * We need to setns first. We cannot do this earlier (in stage 0)
  268.              * because of the fact that we forked to get here (the PID of
  269.              * [stage 2: JUMP_INIT]) would be meaningless). We could send it
  270.              * using cmsg(3) but that's just annoying.
  271.              */
  272.             if (config.namespaces)
  273.                 join_namespaces(config.namespaces);
  275.             /*
  276.              * Deal with user namespaces first. They are quite special, as they
  277.              * affect our ability to unshare other namespaces and are used as
  278.              * context for privilege checks.
  279.              *
  280.              * We don't unshare all namespaces in one go. The reason for this
  281.              * is that, while the kernel documentation may claim otherwise,
  282.              * there are certain cases where unsharing all namespaces at once
  283.              * will result in namespace objects being owned incorrectly.
  284.              * Ideally we should just fix these kernel bugs, but it's better to
  285.              * be safe than sorry, and fix them separately.
  286.              *
  287.              * A specific case of this is that the SELinux label of the
  288.              * internal kern-mount that mqueue uses will be incorrect if the
  289.              * UTS namespace is cloned before the USER namespace is mapped.
  290.              * I've also heard of similar problems with the network namespace
  291.              * in some scenarios. This also mirrors how LXC deals with this
  292.              * problem.
  293.              */
  294.             if (config.cloneflags & CLONE_NEWUSER) {
  295.                 if (unshare(CLONE_NEWUSER) < 0)
  296.                     bail("failed to unshare user namespace");
  297.                 config.cloneflags &= ~CLONE_NEWUSER;
  299.                 /*
  300.                  * We don't have the privileges to do any mapping here (see the
  301.                  * clone_parent rant). So signal our parent to hook us up.
  302.                  */
  304.                 /* Switching is only necessary if we joined namespaces. */
  305.                 if (config.namespaces) {
  306.                     if (prctl(PR_SET_DUMPABLE, 1, 0, 0, 0) < 0)
  307.                         bail("failed to set process as dumpable");
  308.                 }
  309.                 s = SYNC_USERMAP_PLS;
  310.                 if (write(syncfd, &s, sizeof(s)) != sizeof(s))
  311.                     bail("failed to sync with parent: write(SYNC_USERMAP_PLS)");
  313.                 /* ... wait for mapping ... */
  315.                 if (read(syncfd, &s, sizeof(s)) != sizeof(s))
  316.                     bail("failed to sync with parent: read(SYNC_USERMAP_ACK)");
  317.                 if (s != SYNC_USERMAP_ACK)
  318.                     bail("failed to sync with parent: SYNC_USERMAP_ACK: got %u", s);
  319.                 /* Switching is only necessary if we joined namespaces. */
  320.                 if (config.namespaces) {
  321.                     if (prctl(PR_SET_DUMPABLE, 0, 0, 0, 0) < 0)
  322.                         bail("failed to set process as dumpable");
  323.                 }
  325.                 /* Become root in the namespace proper. */
  326.                 if (setresuid(0, 0, 0) < 0)
  327.                     bail("failed to become root in user namespace");
  328.             }
  329.             /*
  330.              * Unshare all of the namespaces. Now, it should be noted that this
  331.              * ordering might break in the future (especially with rootless
  332.              * containers). But for now, it's not possible to split this into
  333.              * CLONE_NEWUSER + [the rest] because of some RHEL SELinux issues.
  334.              *
  335.              * Note that we don't merge this with clone() because there were
  336.              * some old kernel versions where clone(CLONE_PARENT | CLONE_NEWPID)
  337.              * was broken, so we'll just do it the long way anyway.
  338.              */
  339.             if (unshare(config.cloneflags & ~CLONE_NEWCGROUP) < 0)
  340.                 bail("failed to unshare namespaces");
  342.             /*
  343.              * TODO: What about non-namespace clone flags that we're dropping here?
  344.              *
  345.              * We fork again because of PID namespace, setns(2) or unshare(2) don't
  346.              * change the PID namespace of the calling process, because doing so
  347.              * would change the caller's idea of its own PID (as reported by getpid()),
  348.              * which would break many applications and libraries, so we must fork
  349.              * to actually enter the new PID namespace.
  350.              */
  351.             child = clone_parent(&env, JUMP_INIT);
  352.             if (child < 0)
  353.                 bail("unable to fork: init_func");
  355.             /* Send the child to our parent, which knows what it's doing. */
  356.             s = SYNC_RECVPID_PLS;
  357.             if (write(syncfd, &s, sizeof(s)) != sizeof(s)) {
  358.                 kill(child, SIGKILL);
  359.                 bail("failed to sync with parent: write(SYNC_RECVPID_PLS)");
  360.             }
  361.             if (write(syncfd, &child, sizeof(child)) != sizeof(child)) {
  362.                 kill(child, SIGKILL);
  363.                 bail("failed to sync with parent: write(childpid)");
  364.             }
  366.             /* ... wait for parent to get the pid ... */
  368.             if (read(syncfd, &s, sizeof(s)) != sizeof(s)) {
  369.                 kill(child, SIGKILL);
  370.                 bail("failed to sync with parent: read(SYNC_RECVPID_ACK)");
  371.             }
  372.             if (s != SYNC_RECVPID_ACK) {
  373.                 kill(child, SIGKILL);
  374.                 bail("failed to sync with parent: SYNC_RECVPID_ACK: got %u", s);
  375.             }
  377.             s = SYNC_CHILD_READY;
  378.             if (write(syncfd, &s, sizeof(s)) != sizeof(s)) {
  379.                 kill(child, SIGKILL);
  380.                 bail("failed to sync with parent: write(SYNC_CHILD_READY)");
  381.             }
  383.             /* Our work is done. [Stage 2: JUMP_INIT] is doing the rest of the work. */
  384.             exit(0);
  385.         }
  387.         /*
  388.          * Stage 2: We're the final child process, and the only process that will
  389.          *          actually return to the Go runtime. Our job is to just do the
  390.          *          final cleanup steps and then return to the Go runtime to allow
  391.          *          init_linux.go to run.
  392.          */
  393.     case JUMP_INIT:{
  394.             /*
  395.              * We're inside the child now, having jumped from the
  396.              * start_child() code after forking in the parent.
  397.              */
  398.             enum sync_t s;
  400.             /* We're in a child and thus need to tell the parent if we die. */
  401.             syncfd = sync_grandchild_pipe[0];
  402.             close(sync_grandchild_pipe[1]);
  403.             close(sync_child_pipe[0]);
  404.             close(sync_child_pipe[1]);
  406.             /* For debugging. */
  407.             prctl(PR_SET_NAME, (unsigned long)"runc:[2:INIT]", 0, 0, 0);
  409.             if (read(syncfd, &s, sizeof(s)) != sizeof(s))
  410.                 bail("failed to sync with parent: read(SYNC_GRANDCHILD)");
  411.             if (s != SYNC_GRANDCHILD)
  412.                 bail("failed to sync with parent: SYNC_GRANDCHILD: got %u", s);
  414.             if (setsid() < 0)
  415.                 bail("setsid failed");
  417.             if (setuid(0) < 0)
  418.                 bail("setuid failed");
  420.             if (setgid(0) < 0)
  421.                 bail("setgid failed");
  423.             if (!config.is_rootless_euid && config.is_setgroup) {
  424.                 if (setgroups(0, NULL) < 0)
  425.                     bail("setgroups failed");
  426.             }
  428.             /* ... wait until our topmost parent has finished cgroup setup in p.manager.Apply() ... */
  429.             if (config.cloneflags & CLONE_NEWCGROUP) {
  430.                 uint8_t value;
  431.                 if (read(pipenum, &value, sizeof(value)) != sizeof(value))
  432.                     bail("read synchronisation value failed");
  433.                 if (value == CREATECGROUPNS) {
  434.                     if (unshare(CLONE_NEWCGROUP) < 0)
  435.                         bail("failed to unshare cgroup namespace");
  436.                 } else
  437.                     bail("received unknown synchronisation value");
  438.             }
  440.             s = SYNC_CHILD_READY;
  441.             if (write(syncfd, &s, sizeof(s)) != sizeof(s))
  442.                 bail("failed to sync with patent: write(SYNC_CHILD_READY)");
  444.             /* Close sync pipes. */
  445.             close(sync_grandchild_pipe[0]);
  447.             /* Free netlink data. */
  448.             nl_free(&config);
  450.             /* Finish executing, let the Go runtime take over. */
  451.             return;
  452.         }
  453.     default:
  454.         bail("unexpected jump value");
  455.     }
  457.     /* Should never be reached. */
  458.     bail("should never be reached");
  459. }

2.2) libcontainer/setns_init_linux.go#linuxSetnsInit.Init

  1. func (l *linuxSetnsInit) Init() error {
  2.     runtime.LockOSThread()
  3.     defer runtime.UnlockOSThread()
  5.     if !l.config.Config.NoNewKeyring {
  6.         // Do not inherit the parent's session keyring.
  7.         if _, err := keys.JoinSessionKeyring(l.getSessionRingName()); err != nil {
  8.             // Same justification as in standart_init_linux.go as to why we
  9.             // don't bail on ENOSYS.
  10.             //
  11.             // TODO(cyphar): And we should have logging here too.
  12.             if errors.Cause(err) != unix.ENOSYS {
  13.                 return errors.Wrap(err, "join session keyring")
  14.             }
  15.         }
  16.     }
  17.     if l.config.CreateConsole {
  18.         if err := setupConsole(l.consoleSocket, l.config, false); err != nil {
  19.             return err
  20.         }
  21.         if err := system.Setctty(); err != nil {
  22.             return err
  23.         }
  24.     }
  25.     if l.config.NoNewPrivileges {
  26.         if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
  27.             return err
  28.         }
  29.     }
  30.     if err := label.SetProcessLabel(l.config.ProcessLabel); err != nil {
  31.         return err
  32.     }
  33.     defer label.SetProcessLabel("")
  34.     // Without NoNewPrivileges seccomp is a privileged operation, so we need to
  35.     // do this before dropping capabilities; otherwise do it as late as possible
  36.     // just before execve so as few syscalls take place after it as possible.
  37.     if l.config.Config.Seccomp != nil && !l.config.NoNewPrivileges {
  38.         if err := seccomp.InitSeccomp(l.config.Config.Seccomp); err != nil {
  39.             return err
  40.         }
  41.     }
  42.     if err := finalizeNamespace(l.config); err != nil {
  43.         return err
  44.     }
  45.     if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
  46.         return err
  47.     }
  48.     // Set seccomp as close to execve as possible, so as few syscalls take
  49.     // place afterward (reducing the amount of syscalls that users need to
  50.     // enable in their seccomp profiles).
  51.     if l.config.Config.Seccomp != nil && l.config.NoNewPrivileges {
  52.         if err := seccomp.InitSeccomp(l.config.Config.Seccomp); err != nil {
  53.             return newSystemErrorWithCause(err, "init seccomp")
  54.         }
  55.     }
  56.     return system.Execv(l.config.Args[0], l.config.Args[0:], os.Environ())
  57. }