container: add ability to mask path

This commit is contained in:
criyle 2021-11-28 23:26:57 -08:00
parent 5a79fa24f7
commit 96ad6f979b
5 changed files with 65 additions and 30 deletions

27
env/env_linux.go vendored
View File

@ -31,8 +31,9 @@ func NewBuilder(c Config) (pool.EnvBuilder, error) {
c.Info("Created tmp dir for container root at:", root)
var (
mb *mount.Builder
sym []container.SymbolicLink
mountBuilder *mount.Builder
symbolicLinks []container.SymbolicLink
maskPaths []string
)
mc, err := readMountConfig(c.MountConf)
if err != nil {
@ -40,23 +41,28 @@ func NewBuilder(c Config) (pool.EnvBuilder, error) {
return nil, err
}
c.Info("Mount.yaml(", c.MountConf, ") does not exists, use the default container mount")
mb = getDefaultMount(c.TmpFsParam)
mountBuilder = getDefaultMount(c.TmpFsParam)
} else {
mb, err = parseMountConfig(mc)
mountBuilder, err = parseMountConfig(mc)
if err != nil {
return nil, err
}
}
if mc != nil && len(mc.SymLinks) > 0 {
sym = make([]container.SymbolicLink, 0, len(mc.SymLinks))
symbolicLinks = make([]container.SymbolicLink, 0, len(mc.SymLinks))
for _, l := range mc.SymLinks {
sym = append(sym, container.SymbolicLink{LinkPath: l.LinkPath, Target: l.Target})
symbolicLinks = append(symbolicLinks, container.SymbolicLink{LinkPath: l.LinkPath, Target: l.Target})
}
} else {
sym = defaultSymLinks
symbolicLinks = defaultSymLinks
}
m := mb.FilterNotExist().Mounts
c.Info("Created container mount at:", mb)
if mc != nil && len(mc.MaskPaths) > 0 {
maskPaths = mc.MaskPaths
} else {
maskPaths = defaultMaskPaths
}
m := mountBuilder.FilterNotExist().Mounts
c.Info("Created container mount at:", mountBuilder)
seccomp, err := readSeccompConf(c.SeccompConf)
if err != nil {
@ -99,7 +105,8 @@ func NewBuilder(c Config) (pool.EnvBuilder, error) {
b := &container.Builder{
Root: root,
Mounts: m,
SymbolicLinks: sym,
SymbolicLinks: symbolicLinks,
MaskPaths: maskPaths,
CredGenerator: credGen,
Stderr: os.Stderr,
CloneFlags: unshareFlags,

31
env/mount_linux.go vendored
View File

@ -28,14 +28,15 @@ type Link struct {
// Mounts defines mount points for the container.
type Mounts struct {
Mount []Mount `yaml:"mount"`
SymLinks []Link `yaml:"symLink"`
WorkDir string `yaml:"workDir"`
HostName string `yaml:"hostName"`
DomainName string `yaml:"domainName"`
UID int `yaml:"uid"`
GID int `yaml:"gid"`
Proc bool `yaml:"proc"`
Mount []Mount `yaml:"mount"`
SymLinks []Link `yaml:"symLink"`
MaskPaths []string `yaml:"maskPath"`
WorkDir string `yaml:"workDir"`
HostName string `yaml:"hostName"`
DomainName string `yaml:"domainName"`
UID int `yaml:"uid"`
GID int `yaml:"gid"`
Proc bool `yaml:"proc"`
}
func readMountConfig(p string) (*Mounts, error) {
@ -121,3 +122,17 @@ var defaultSymLinks = []container.SymbolicLink{
{LinkPath: "/dev/stdout", Target: "/proc/self/fd/1"},
{LinkPath: "/dev/stderr", Target: "/proc/self/fd/2"},
}
var defaultMaskPaths = []string{
"/proc/acpi",
"/proc/asound",
"/proc/kcore",
"/proc/keys",
"/proc/latency_stats",
"/proc/timer_list",
"/proc/timer_stats",
"/proc/sched_debug",
"/proc/scsi",
"/usr/lib/wsl/drivers",
"/usr/lib/wsl/lib",
}

8
go.mod
View File

@ -4,12 +4,12 @@ go 1.17
require (
github.com/creack/pty v1.1.17
github.com/criyle/go-sandbox v0.8.10
github.com/criyle/go-sandbox v0.8.11
github.com/elastic/go-seccomp-bpf v1.2.0
github.com/elastic/go-ucfg v0.8.4
github.com/gin-contrib/pprof v1.3.0
github.com/gin-contrib/zap v0.0.1
github.com/gin-gonic/gin v1.7.4
github.com/gin-gonic/gin v1.7.7
github.com/golang/protobuf v1.5.2
github.com/gorilla/websocket v1.4.2
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
@ -19,9 +19,9 @@ require (
github.com/zsais/go-gin-prometheus v0.1.0
go.uber.org/zap v1.19.1
golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871
golang.org/x/net v0.0.0-20211118161319-6a13c67c3ce4
golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1
golang.org/x/sys v0.0.0-20211124211545-fe61309f8881
google.golang.org/grpc v1.42.0
google.golang.org/protobuf v1.27.1
gopkg.in/yaml.v2 v2.4.0

16
go.sum
View File

@ -69,8 +69,8 @@ github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWH
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
github.com/criyle/go-sandbox v0.8.10 h1:iw5zI5YAEDlhBBDtJdiFoILMcuYQWnbj3CGA8ErWdVg=
github.com/criyle/go-sandbox v0.8.10/go.mod h1:ficIk6tNwu96V8MdfJnGaM7GeXuU+PMILAkq7RPQPuQ=
github.com/criyle/go-sandbox v0.8.11 h1:j37dLBCNRTCCBNPLerpOxgV1dFx4ioZdbFYArLghkas=
github.com/criyle/go-sandbox v0.8.11/go.mod h1:Zo9IpOfqD5BpsZUcrGDjV7DedILcOkfcRL+diW9TYGo=
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@ -99,8 +99,8 @@ github.com/gin-contrib/zap v0.0.1 h1:wsX/ahRftxPiXpiUw0YqyHj+TQTKtv+DAFWH84G1Uvg
github.com/gin-contrib/zap v0.0.1/go.mod h1:vJJndZ8f44gsTHQrDPIB4YOZzwOwiEIdE0mMrZLOogk=
github.com/gin-gonic/gin v1.5.0/go.mod h1:Nd6IXA8m5kNZdNEHMBd93KT+mdY3+bewLgRvmCsR2Do=
github.com/gin-gonic/gin v1.6.2/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
github.com/gin-gonic/gin v1.7.4 h1:QmUZXrvJ9qZ3GfWvQ+2wnW/1ePrTEJqPKMYEU3lD/DM=
github.com/gin-gonic/gin v1.7.4/go.mod h1:jD2toBW3GZUr5UMcdrwQA10I7RuaFOl/SGeDjXkfUtY=
github.com/gin-gonic/gin v1.7.7 h1:3DoBmSbJbZAWqXJC3SLjAPfutPJJRN1U5pALB7EeTTs=
github.com/gin-gonic/gin v1.7.7/go.mod h1:axIBovoeJpVj8S3BwE0uPMTeReE4+AfFtqpqaZ1qq1U=
github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@ -394,8 +394,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20211118161319-6a13c67c3ce4 h1:DZshvxDdVoeKIbudAdFEKi+f70l51luSy/7b76ibTY0=
golang.org/x/net v0.0.0-20211118161319-6a13c67c3ce4/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9 h1:0qxwC5n+ttVOINCBeRHO0nq9X7uy8SDsPoi5OaCdIEI=
golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@ -460,8 +460,8 @@ golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1 h1:kwrAHlwJ0DUBZwQ238v+Uod/3eZ8B2K5rYsUHBQvzmI=
golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.0.0-20211124211545-fe61309f8881 h1:TyHqChC80pFkXWraUUf6RuB5IqFdQieMLwwCJokV2pc=
golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

View File

@ -82,6 +82,19 @@ symLink:
target: /proc/self/fd/1
- linkPath: /dev/stderr
target: /proc/self/fd/2
# mask mounted paths with empty / null mount
maskPath:
- /proc/acpi
- /proc/asound
- /proc/kcore
- /proc/keys
- /proc/latency_stats
- /proc/timer_list
- /proc/timer_stats
- /proc/sched_debug
- /proc/scsi
- /usr/lib/wsl/drivers
- /usr/lib/wsl/lib
# container work directory
workDir: /w
# container host name