From 878cd7e95ca303f9851d227a22d2022bd49944b0 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Sun, 18 May 2014 20:48:53 +0900 Subject: [PATCH] machined: add logic to query IP addresses of containers --- src/libsystemd/sd-bus/bus-container.c | 8 +- src/machine/machine-dbus.c | 217 +++++++++++++++++++++++++- src/machine/machine.h | 4 + src/machine/machinectl.c | 75 ++++++++- src/machine/machined-dbus.c | 45 +++--- src/shared/bus-errors.h | 1 + src/shared/logs-show.c | 4 +- src/shared/util.c | 103 +++++++----- src/shared/util.h | 4 +- 9 files changed, 384 insertions(+), 77 deletions(-) diff --git a/src/libsystemd/sd-bus/bus-container.c b/src/libsystemd/sd-bus/bus-container.c index 6bd7ad631..dd4bf1512 100644 --- a/src/libsystemd/sd-bus/bus-container.c +++ b/src/libsystemd/sd-bus/bus-container.c @@ -42,7 +42,7 @@ int bus_container_connect_socket(sd_bus *b) { if (r < 0) return r; - r = namespace_open(leader, &pidnsfd, &mntnsfd, &rootfd); + r = namespace_open(leader, &pidnsfd, &mntnsfd, NULL, &rootfd); if (r < 0) return r; @@ -61,7 +61,7 @@ int bus_container_connect_socket(sd_bus *b) { if (child == 0) { pid_t grandchild; - r = namespace_enter(pidnsfd, mntnsfd, rootfd); + r = namespace_enter(pidnsfd, mntnsfd, -1, rootfd); if (r < 0) _exit(255); @@ -140,7 +140,7 @@ int bus_container_connect_kernel(sd_bus *b) { if (r < 0) return r; - r = namespace_open(leader, &pidnsfd, &mntnsfd, &rootfd); + r = namespace_open(leader, &pidnsfd, &mntnsfd, NULL, &rootfd); if (r < 0) return r; @@ -156,7 +156,7 @@ int bus_container_connect_kernel(sd_bus *b) { pair[0] = safe_close(pair[0]); - r = namespace_enter(pidnsfd, mntnsfd, rootfd); + r = namespace_enter(pidnsfd, mntnsfd, -1, rootfd); if (r < 0) _exit(EXIT_FAILURE); diff --git a/src/machine/machine-dbus.c b/src/machine/machine-dbus.c index 83ef82d2e..c9c3de0d0 100644 --- a/src/machine/machine-dbus.c +++ b/src/machine/machine-dbus.c @@ -22,11 +22,15 @@ #include #include #include +#include +#include "sd-rtnl.h" #include "bus-util.h" #include "bus-label.h" #include "strv.h" #include "machine.h" +#include "rtnl-util.h" +#include "bus-errors.h" static int property_get_id( sd_bus *bus, @@ -79,7 +83,7 @@ static int property_get_state( static BUS_DEFINE_PROPERTY_GET_ENUM(property_get_class, machine_class, MachineClass); -static int method_terminate(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { +int bus_machine_method_terminate(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Machine *m = userdata; int r; @@ -94,7 +98,7 @@ static int method_terminate(sd_bus *bus, sd_bus_message *message, void *userdata return sd_bus_reply_method_return(message, NULL); } -static int method_kill(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { +int bus_machine_method_kill(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Machine *m = userdata; const char *swho; int32_t signo; @@ -127,6 +131,208 @@ static int method_kill(sd_bus *bus, sd_bus_message *message, void *userdata, sd_ return sd_bus_reply_method_return(message, NULL); } +int bus_machine_method_get_addresses(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + _cleanup_bus_message_unref_ sd_bus_message *reply = NULL; + _cleanup_close_pair_ int pair[2] = { -1, -1 }; + _cleanup_free_ char *us = NULL, *them = NULL; + _cleanup_close_ int netns_fd = -1; + Machine *m = userdata; + const char *p; + siginfo_t si; + pid_t child; + int r; + + assert(bus); + assert(message); + assert(m); + + r = readlink_malloc("/proc/self/ns/net", &us); + if (r < 0) + return sd_bus_error_set_errno(error, r); + + p = procfs_file_alloca(m->leader, "ns/net"); + r = readlink_malloc(p, &them); + if (r < 0) + return sd_bus_error_set_errno(error, r); + + if (streq(us, them)) + return sd_bus_error_setf(error, BUS_ERROR_NO_PRIVATE_NETWORKING, "Machine %s does not use private networking", m->name); + + r = namespace_open(m->leader, NULL, NULL, &netns_fd, NULL); + if (r < 0) + return sd_bus_error_set_errno(error, r); + + if (socketpair(AF_UNIX, SOCK_SEQPACKET, 0, pair) < 0) + return sd_bus_error_set_errno(error, -errno); + + child = fork(); + if (child < 0) + return sd_bus_error_set_errno(error, -errno); + + if (child == 0) { + _cleanup_rtnl_message_unref_ sd_rtnl_message *req = NULL, *resp = NULL; + _cleanup_rtnl_unref_ sd_rtnl *rtnl = NULL; + sd_rtnl_message *addr; + + pair[0] = safe_close(pair[0]); + + r = namespace_enter(-1, -1, netns_fd, -1); + if (r < 0) + _exit(EXIT_FAILURE); + + r = sd_rtnl_open(&rtnl, 0); + if (r < 0) + _exit(EXIT_FAILURE); + + r = sd_rtnl_message_new_addr(rtnl, &req, RTM_GETADDR, 0, AF_UNSPEC); + if (r < 0) + _exit(EXIT_FAILURE); + + r = sd_rtnl_message_request_dump(req, true); + if (r < 0) + _exit(EXIT_FAILURE); + + r = sd_rtnl_call(rtnl, req, 0, &resp); + if (r < 0) + _exit(EXIT_FAILURE); + + for (addr = resp; addr; addr = sd_rtnl_message_next(addr)) { + uint16_t type; + unsigned char family; + union { + struct in_addr in; + struct in6_addr in6; + } in_addr; + struct iovec iov[2]; + + r = sd_rtnl_message_get_type(addr, &type); + if (r < 0) + _exit(EXIT_FAILURE); + + if (type != RTM_NEWADDR) + continue; + + r = sd_rtnl_message_addr_get_family(addr, &family); + if (r < 0) + _exit(EXIT_FAILURE); + + iov[0] = (struct iovec) { .iov_base = &family, .iov_len = sizeof(family) }; + + switch (family) { + + case AF_INET: + + r = sd_rtnl_message_read_in_addr(addr, IFA_LOCAL, &in_addr.in); + if (r < 0) + _exit(EXIT_FAILURE); + + if (in_addr.in.s_addr == htobe32(INADDR_LOOPBACK)) + continue; + + iov[1] = (struct iovec) { .iov_base = &in_addr.in, .iov_len = sizeof(in_addr.in) }; + break; + + case AF_INET6: + + r = sd_rtnl_message_read_in6_addr(addr, IFA_ADDRESS, &in_addr.in6); + if (r < 0) + _exit(EXIT_FAILURE); + + if (IN6_IS_ADDR_LOOPBACK(&in_addr.in6)) + continue; + + iov[1] = (struct iovec) { .iov_base = &in_addr.in6, .iov_len = sizeof(in_addr.in6) }; + break; + + default: + continue; + } + + r = writev(pair[1], iov, 2); + if (r < 0) + _exit(EXIT_FAILURE); + } + + _exit(EXIT_SUCCESS); + } + + pair[1] = safe_close(pair[1]); + + r = sd_bus_message_new_method_return(message, &reply); + if (r < 0) + return sd_bus_error_set_errno(error, r); + + r = sd_bus_message_open_container(reply, 'a', "(yay)"); + if (r < 0) + return sd_bus_error_set_errno(error, r); + + for (;;) { + unsigned char family; + ssize_t n; + union { + struct in_addr in; + struct in6_addr in6; + } in_addr; + struct iovec iov[2]; + struct msghdr mh = { + .msg_iov = iov, + .msg_iovlen = 2, + }; + + iov[0] = (struct iovec) { .iov_base = &family, .iov_len = sizeof(family) }; + iov[1] = (struct iovec) { .iov_base = &in_addr, .iov_len = sizeof(in_addr) }; + + n = recvmsg(pair[0], &mh, 0); + if (n < 0) + return sd_bus_error_set_errno(error, -errno); + if ((size_t) n < sizeof(family)) + break; + + r = sd_bus_message_open_container(reply, 'r', "yay"); + if (r < 0) + return sd_bus_error_set_errno(error, r); + + r = sd_bus_message_append(reply, "y", family); + if (r < 0) + return sd_bus_error_set_errno(error, r); + + switch (family) { + + case AF_INET: + if (n != sizeof(struct in_addr) + sizeof(family)) + return sd_bus_error_set_errno(error, EIO); + + r = sd_bus_message_append_array(reply, 'y', &in_addr.in, sizeof(in_addr.in)); + break; + + case AF_INET6: + if (n != sizeof(struct in6_addr) + sizeof(family)) + return sd_bus_error_set_errno(error, EIO); + + r = sd_bus_message_append_array(reply, 'y', &in_addr.in6, sizeof(in_addr.in6)); + break; + } + if (r < 0) + return sd_bus_error_set_errno(error, r); + + r = sd_bus_message_close_container(reply); + if (r < 0) + return sd_bus_error_set_errno(error, r); + } + + r = wait_for_terminate(child, &si); + if (r < 0) + return sd_bus_error_set_errno(error, r); + if (si.si_code != CLD_EXITED || si.si_status != EXIT_SUCCESS) + return sd_bus_error_set_errno(error, EIO); + + r = sd_bus_message_close_container(reply); + if (r < 0) + return sd_bus_error_set_errno(error, r); + + return sd_bus_send(bus, reply, NULL); +} + const sd_bus_vtable machine_vtable[] = { SD_BUS_VTABLE_START(0), SD_BUS_PROPERTY("Name", "s", NULL, offsetof(Machine, name), SD_BUS_VTABLE_PROPERTY_CONST), @@ -139,9 +345,10 @@ const sd_bus_vtable machine_vtable[] = { SD_BUS_PROPERTY("Class", "s", property_get_class, offsetof(Machine, class), SD_BUS_VTABLE_PROPERTY_CONST), SD_BUS_PROPERTY("RootDirectory", "s", NULL, offsetof(Machine, root_directory), SD_BUS_VTABLE_PROPERTY_CONST), SD_BUS_PROPERTY("State", "s", property_get_state, 0, 0), - SD_BUS_METHOD("Terminate", NULL, NULL, method_terminate, SD_BUS_VTABLE_CAPABILITY(CAP_KILL)), - SD_BUS_METHOD("Kill", "si", NULL, method_kill, SD_BUS_VTABLE_CAPABILITY(CAP_KILL)), - SD_BUS_VTABLE_END + SD_BUS_METHOD("Terminate", NULL, NULL, bus_machine_method_terminate, SD_BUS_VTABLE_CAPABILITY(CAP_KILL)), + SD_BUS_METHOD("Kill", "si", NULL, bus_machine_method_kill, SD_BUS_VTABLE_CAPABILITY(CAP_KILL)), + SD_BUS_METHOD("GetAddresses", NULL, "a(yay)", bus_machine_method_get_addresses, SD_BUS_VTABLE_UNPRIVILEGED), + SD_BUS_VTABLE_END }; int machine_object_find(sd_bus *bus, const char *path, const char *interface, void *userdata, void **found, sd_bus_error *error) { diff --git a/src/machine/machine.h b/src/machine/machine.h index f4aefc550..a894a463a 100644 --- a/src/machine/machine.h +++ b/src/machine/machine.h @@ -96,6 +96,10 @@ char *machine_bus_path(Machine *s); int machine_object_find(sd_bus *bus, const char *path, const char *interface, void *userdata, void **found, sd_bus_error *error); int machine_node_enumerator(sd_bus *bus, const char *path, void *userdata, char ***nodes, sd_bus_error *error); +int bus_machine_method_terminate(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error); +int bus_machine_method_kill(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error); +int bus_machine_method_get_addresses(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error); + int machine_send_signal(Machine *m, bool new_machine); int machine_send_create_reply(Machine *m, sd_bus_error *error); diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c index 6337aa274..c2bf7e519 100644 --- a/src/machine/machinectl.c +++ b/src/machine/machinectl.c @@ -27,6 +27,8 @@ #include #include #include +#include +#include #include "sd-bus.h" #include "log.h" @@ -165,6 +167,63 @@ static int show_unit_cgroup(sd_bus *bus, const char *unit, pid_t leader) { return 0; } +static int print_addresses(sd_bus *bus, const char *name, const char *prefix, const char *prefix2) { + _cleanup_bus_message_unref_ sd_bus_message *reply = NULL; + int r; + + assert(bus); + assert(name); + assert(prefix); + assert(prefix2); + + r = sd_bus_call_method(bus, + "org.freedesktop.machine1", + "/org/freedesktop/machine1", + "org.freedesktop.machine1.Manager", + "GetMachineAddresses", + NULL, + &reply, + "s", name); + if (r < 0) + return r; + + r = sd_bus_message_enter_container(reply, 'a', "(yay)"); + if (r < 0) + return bus_log_parse_error(r); + + while ((r = sd_bus_message_enter_container(reply, 'r', "yay")) > 0) { + unsigned char family; + const void *a; + size_t sz; + char buffer[MAX(INET6_ADDRSTRLEN, INET_ADDRSTRLEN)]; + + r = sd_bus_message_read(reply, "y", &family); + if (r < 0) + return bus_log_parse_error(r); + + r = sd_bus_message_read_array(reply, 'y', &a, &sz); + if (r < 0) + return bus_log_parse_error(r); + + printf("%s%s\n", prefix, inet_ntop(family, a, buffer, sizeof(buffer))); + + r = sd_bus_message_exit_container(reply); + if (r < 0) + return bus_log_parse_error(r); + + if (prefix != prefix2) + prefix = prefix2; + } + if (r < 0) + return bus_log_parse_error(r); + + r = sd_bus_message_exit_container(reply); + if (r < 0) + return bus_log_parse_error(r); + + return 0; +} + typedef struct MachineStatusInfo { char *name; sd_id128_t id; @@ -221,6 +280,10 @@ static void print_machine_status_info(sd_bus *bus, MachineStatusInfo *i) { if (i->root_directory) printf("\t Root: %s\n", i->root_directory); + print_addresses(bus, i->name, + "\t Address: ", + "\t "); + if (i->unit) { printf("\t Unit: %s\n", i->unit); show_unit_cgroup(bus, i->unit, i->leader); @@ -427,7 +490,7 @@ static int openpt_in_namespace(pid_t pid, int flags) { pid_t child; siginfo_t si; - r = namespace_open(pid, &pidnsfd, &mntnsfd, &rootfd); + r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, &rootfd); if (r < 0) return r; @@ -441,7 +504,7 @@ static int openpt_in_namespace(pid_t pid, int flags) { if (child == 0) { pair[0] = safe_close(pair[0]); - r = namespace_enter(pidnsfd, mntnsfd, rootfd); + r = namespace_enter(pidnsfd, mntnsfd, -1, rootfd); if (r < 0) _exit(EXIT_FAILURE); @@ -466,10 +529,10 @@ static int openpt_in_namespace(pid_t pid, int flags) { pair[1] = safe_close(pair[1]); r = wait_for_terminate(child, &si); - if (r < 0 || si.si_code != CLD_EXITED || si.si_status != EXIT_SUCCESS) { - - return r < 0 ? r : -EIO; - } + if (r < 0) + return r; + if (si.si_code != CLD_EXITED || si.si_status != EXIT_SUCCESS) + return -EIO; if (recvmsg(pair[0], &mh, MSG_NOSIGNAL|MSG_CMSG_CLOEXEC) < 0) return -errno; diff --git a/src/machine/machined-dbus.c b/src/machine/machined-dbus.c index a32d7f5d7..0078a277d 100644 --- a/src/machine/machined-dbus.c +++ b/src/machine/machined-dbus.c @@ -27,7 +27,6 @@ #include "sd-id128.h" #include "sd-messages.h" - #include "strv.h" #include "mkdir.h" #include "path-util.h" @@ -343,50 +342,49 @@ static int method_terminate_machine(sd_bus *bus, sd_bus_message *message, void * if (!machine) return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_MACHINE, "No machine '%s' known", name); - r = machine_stop(machine); - if (r < 0) - return sd_bus_error_set_errno(error, r); - - return sd_bus_reply_method_return(message, NULL); + return bus_machine_method_terminate(bus, message, machine, error); } static int method_kill_machine(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { Manager *m = userdata; Machine *machine; const char *name; - const char *swho; - int32_t signo; - KillWho who; int r; assert(bus); assert(message); assert(m); - r = sd_bus_message_read(message, "ssi", &name, &swho, &signo); + r = sd_bus_message_read(message, "s", &name); if (r < 0) return sd_bus_error_set_errno(error, r); - if (isempty(swho)) - who = KILL_ALL; - else { - who = kill_who_from_string(swho); - if (who < 0) - return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid kill parameter '%s'", swho); - } - - if (signo <= 0 || signo >= _NSIG) - return sd_bus_error_setf(error, SD_BUS_ERROR_INVALID_ARGS, "Invalid signal %i", signo); - machine = hashmap_get(m->machines, name); if (!machine) return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_MACHINE, "No machine '%s' known", name); - r = machine_kill(machine, who, signo); + return bus_machine_method_kill(bus, message, machine, error); +} + +static int method_get_machine_addresses(sd_bus *bus, sd_bus_message *message, void *userdata, sd_bus_error *error) { + Manager *m = userdata; + Machine *machine; + const char *name; + int r; + + assert(bus); + assert(message); + assert(m); + + r = sd_bus_message_read(message, "s", &name); if (r < 0) return sd_bus_error_set_errno(error, r); - return sd_bus_reply_method_return(message, NULL); + machine = hashmap_get(m->machines, name); + if (!machine) + return sd_bus_error_setf(error, BUS_ERROR_NO_SUCH_MACHINE, "No machine '%s' known", name); + + return bus_machine_method_get_addresses(bus, message, machine, error); } const sd_bus_vtable manager_vtable[] = { @@ -398,6 +396,7 @@ const sd_bus_vtable manager_vtable[] = { SD_BUS_METHOD("RegisterMachine", "sayssus", "o", method_register_machine, 0), SD_BUS_METHOD("KillMachine", "ssi", NULL, method_kill_machine, SD_BUS_VTABLE_CAPABILITY(CAP_KILL)), SD_BUS_METHOD("TerminateMachine", "s", NULL, method_terminate_machine, SD_BUS_VTABLE_CAPABILITY(CAP_KILL)), + SD_BUS_METHOD("GetMachineAddresses", "s", "a(yay)", method_get_machine_addresses, SD_BUS_VTABLE_UNPRIVILEGED), SD_BUS_SIGNAL("MachineNew", "so", 0), SD_BUS_SIGNAL("MachineRemoved", "so", 0), SD_BUS_VTABLE_END diff --git a/src/shared/bus-errors.h b/src/shared/bus-errors.h index 563793591..45e129387 100644 --- a/src/shared/bus-errors.h +++ b/src/shared/bus-errors.h @@ -42,6 +42,7 @@ #define BUS_ERROR_NO_SUCH_MACHINE "org.freedesktop.machine1.NoSuchMachine" #define BUS_ERROR_NO_MACHINE_FOR_PID "org.freedesktop.machine1.NoMachineForPID" #define BUS_ERROR_MACHINE_EXISTS "org.freedesktop.machine1.MachineExists" +#define BUS_ERROR_NO_PRIVATE_NETWORKING "org.freedesktop.machine1.NoPrivateNetworking" #define BUS_ERROR_NO_SUCH_SESSION "org.freedesktop.login1.NoSuchSession" #define BUS_ERROR_NO_SESSION_FOR_PID "org.freedesktop.login1.NoSessionForPID" diff --git a/src/shared/logs-show.c b/src/shared/logs-show.c index 72c9ad2eb..c3578ac91 100644 --- a/src/shared/logs-show.c +++ b/src/shared/logs-show.c @@ -1158,7 +1158,7 @@ static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) { if (r < 0) return r; - r = namespace_open(pid, &pidnsfd, &mntnsfd, &rootfd); + r = namespace_open(pid, &pidnsfd, &mntnsfd, NULL, &rootfd); if (r < 0) return r; @@ -1174,7 +1174,7 @@ static int get_boot_id_for_machine(const char *machine, sd_id128_t *boot_id) { pair[0] = safe_close(pair[0]); - r = namespace_enter(pidnsfd, mntnsfd, rootfd); + r = namespace_enter(pidnsfd, mntnsfd, -1, rootfd); if (r < 0) _exit(EXIT_FAILURE); diff --git a/src/shared/util.c b/src/shared/util.c index 020c1da7a..0cc51e096 100644 --- a/src/shared/util.c +++ b/src/shared/util.c @@ -6091,60 +6091,93 @@ int container_get_leader(const char *machine, pid_t *pid) { return 0; } -int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *root_fd) { - _cleanup_close_ int pidnsfd = -1, mntnsfd = -1; - const char *pidns, *mntns, *root; +int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *netns_fd, int *root_fd) { + _cleanup_close_ int pidnsfd = -1, mntnsfd = -1, netnsfd = -1; int rfd; assert(pid >= 0); - assert(pidns_fd); - assert(mntns_fd); - assert(root_fd); - mntns = procfs_file_alloca(pid, "ns/mnt"); - mntnsfd = open(mntns, O_RDONLY|O_NOCTTY|O_CLOEXEC); - if (mntnsfd < 0) - return -errno; + if (mntns_fd) { + const char *mntns; - pidns = procfs_file_alloca(pid, "ns/pid"); - pidnsfd = open(pidns, O_RDONLY|O_NOCTTY|O_CLOEXEC); - if (pidnsfd < 0) - return -errno; + mntns = procfs_file_alloca(pid, "ns/mnt"); + mntnsfd = open(mntns, O_RDONLY|O_NOCTTY|O_CLOEXEC); + if (mntnsfd < 0) + return -errno; + } - root = procfs_file_alloca(pid, "root"); - rfd = open(root, O_RDONLY|O_NOCTTY|O_CLOEXEC|O_DIRECTORY); - if (rfd < 0) - return -errno; + if (pidns_fd) { + const char *pidns; + + pidns = procfs_file_alloca(pid, "ns/pid"); + pidnsfd = open(pidns, O_RDONLY|O_NOCTTY|O_CLOEXEC); + if (pidnsfd < 0) + return -errno; + } + + if (netns_fd) { + const char *netns; + + netns = procfs_file_alloca(pid, "ns/net"); + netnsfd = open(netns, O_RDONLY|O_NOCTTY|O_CLOEXEC); + if (netnsfd < 0) + return -errno; + } + + if (root_fd) { + const char *root; + + root = procfs_file_alloca(pid, "root"); + rfd = open(root, O_RDONLY|O_NOCTTY|O_CLOEXEC|O_DIRECTORY); + if (rfd < 0) + return -errno; + } + + if (pidns_fd) + *pidns_fd = pidnsfd; - *pidns_fd = pidnsfd; - *mntns_fd = mntnsfd; - *root_fd = rfd; - pidnsfd = -1; - mntnsfd = -1; + if (mntns_fd) + *mntns_fd = mntnsfd; + + if (netns_fd) + *netns_fd = netnsfd; + + if (root_fd) + *root_fd = rfd; + + pidnsfd = mntnsfd = netnsfd = -1; return 0; } -int namespace_enter(int pidns_fd, int mntns_fd, int root_fd) { - assert(pidns_fd >= 0); - assert(mntns_fd >= 0); - assert(root_fd >= 0); +int namespace_enter(int pidns_fd, int mntns_fd, int netns_fd, int root_fd) { - if (setns(pidns_fd, CLONE_NEWPID) < 0) - return -errno; + if (pidns_fd >= 0) + if (setns(pidns_fd, CLONE_NEWPID) < 0) + return -errno; - if (setns(mntns_fd, CLONE_NEWNS) < 0) - return -errno; + if (mntns_fd >= 0) + if (setns(mntns_fd, CLONE_NEWNS) < 0) + return -errno; - if (fchdir(root_fd) < 0) - return -errno; + if (netns_fd >= 0) + if (setns(netns_fd, CLONE_NEWNET) < 0) + return -errno; - if (chroot(".") < 0) - return -errno; + if (root_fd >= 0) { + if (fchdir(root_fd) < 0) + return -errno; + + if (chroot(".") < 0) + return -errno; + } if (setresgid(0, 0, 0) < 0) return -errno; + if (setgroups(0, NULL) < 0) + return -errno; + if (setresuid(0, 0, 0) < 0) return -errno; diff --git a/src/shared/util.h b/src/shared/util.h index f2ce4f0d6..7a7d15c82 100644 --- a/src/shared/util.h +++ b/src/shared/util.h @@ -910,8 +910,8 @@ int parse_proc_cmdline(int (*parse_word)(const char *key, const char *value)); int container_get_leader(const char *machine, pid_t *pid); -int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *root_fd); -int namespace_enter(int pidns_fd, int mntns_fd, int root_fd); +int namespace_open(pid_t pid, int *pidns_fd, int *mntns_fd, int *netns_fd, int *root_fd); +int namespace_enter(int pidns_fd, int mntns_fd, int netns_fd, int root_fd); bool pid_is_alive(pid_t pid); bool pid_is_unwaited(pid_t pid); -- 2.30.2