diff --git a/container/protocol_linux.go b/container/protocol_linux.go index 9b7253a..7d889ce 100644 --- a/container/protocol_linux.go +++ b/container/protocol_linux.go @@ -13,11 +13,12 @@ import ( // cmd is the control message send into container type cmd struct { - OpenCmd []OpenCmd // open argument DeleteCmd *deleteCmd // delete argument ExecCmd *execCmd // execve argument ConfCmd *confCmd // to set configuration + OpenCmd []OpenCmd // open argument + Cmd cmdType // type of the cmd } @@ -74,8 +75,8 @@ type reply struct { // errorReply stores error returned back from container type errorReply struct { - Msg string Errno *syscall.Errno + Msg string } // execReply stores execve result diff --git a/go.mod b/go.mod index 069624a..a368728 100644 --- a/go.mod +++ b/go.mod @@ -4,6 +4,6 @@ go 1.20 require ( github.com/elastic/go-seccomp-bpf v1.3.0 - golang.org/x/net v0.7.0 - golang.org/x/sys v0.5.0 + golang.org/x/net v0.9.0 + golang.org/x/sys v0.7.0 ) diff --git a/go.sum b/go.sum index d033666..9a3862a 100644 --- a/go.sum +++ b/go.sum @@ -3,8 +3,8 @@ github.com/elastic/go-seccomp-bpf v1.3.0 h1:e6teyX946lvPOnZERSYRrMYmsjxaQcWhoiGT github.com/elastic/go-seccomp-bpf v1.3.0/go.mod h1:wIMxjTbKpWGQk4CV9WltlG6haB4brjSH/dvAohBPM1I= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk= -golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= -golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM= +golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns= +golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU= +golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= diff --git a/pkg/forkexec/runner_linux.go b/pkg/forkexec/runner_linux.go index 00c07a0..c5c8830 100644 --- a/pkg/forkexec/runner_linux.go +++ b/pkg/forkexec/runner_linux.go @@ -31,21 +31,6 @@ type Runner struct { // seccomp syscall filter applied to child Seccomp *syscall.SockFprog - // ptrace controls child process to call ptrace(PTRACE_TRACEME) - // runtime.LockOSThread is required for tracer to call ptrace syscalls - Ptrace bool - - // no_new_privs calls prctl(PR_SET_NO_NEW_PRIVS) to 0 to disable calls to - // setuid processes. It is automatically enabled when seccomp filter is provided - NoNewPrivs bool - - // stop before seccomp calls kill(getpid(), SIGSTOP) to wait for tracer to continue - // right before the calls to seccomp. It is automatically enabled when seccomp - // filter and ptrace are provided since kill might not be available after - // seccomp and execve might be traced by ptrace - // cannot stop after seccomp since kill might not be allowed by seccomp filter - StopBeforeSeccomp bool - // clone unshare flag to create linux namespace, effective when clone child // since unshare syscall does not join the new pid group CloneFlags uintptr @@ -72,19 +57,10 @@ type Runner struct { // HostName and DomainName to be set after unshare UTS & user (CAP_SYS_ADMIN) HostName, DomainName string - // drop_caps calls cap_set(self, 0) to drop all capabilities - // from effective, permitted, inheritable capability sets before execve - // it should avoid calls to set ambient capabilities - DropCaps bool - // UidMappings / GidMappings for unshared user namespaces, no-op if mapping is null UIDMappings []syscall.SysProcIDMap GIDMappings []syscall.SysProcIDMap - // GidMappingsEnableSetgroups allows / disallows setgroups syscall. - // deny if GIDMappings is nil - GIDMappingsEnableSetgroups bool - // Credential holds user and group identities to be assumed // by a child process started by StartProcess. Credential *syscall.Credential @@ -95,6 +71,30 @@ type Runner struct { // SyncFunc is called right before execve, thus it could track cpu more accurately SyncFunc func(int) error + // ptrace controls child process to call ptrace(PTRACE_TRACEME) + // runtime.LockOSThread is required for tracer to call ptrace syscalls + Ptrace bool + + // no_new_privs calls prctl(PR_SET_NO_NEW_PRIVS) to 0 to disable calls to + // setuid processes. It is automatically enabled when seccomp filter is provided + NoNewPrivs bool + + // stop before seccomp calls kill(getpid(), SIGSTOP) to wait for tracer to continue + // right before the calls to seccomp. It is automatically enabled when seccomp + // filter and ptrace are provided since kill might not be available after + // seccomp and execve might be traced by ptrace + // cannot stop after seccomp since kill might not be allowed by seccomp filter + StopBeforeSeccomp bool + + // GidMappingsEnableSetgroups allows / disallows setgroups syscall. + // deny if GIDMappings is nil + GIDMappingsEnableSetgroups bool + + // drop_caps calls cap_set(self, 0) to drop all capabilities + // from effective, permitted, inheritable capability sets before execve + // it should avoid calls to set ambient capabilities + DropCaps bool + // UnshareCgroupAfterSync specifies whether to unshare cgroup namespace after // sync (the syncFunc might be add the child to the cgroup) UnshareCgroupAfterSync bool diff --git a/pkg/pipe/buffer.go b/pkg/pipe/buffer.go index 483b0c7..01b7032 100644 --- a/pkg/pipe/buffer.go +++ b/pkg/pipe/buffer.go @@ -13,9 +13,9 @@ import ( // at most max bytes to a buffer type Buffer struct { W *os.File - Max int64 Buffer *bytes.Buffer Done <-chan struct{} + Max int64 } // NewPipe create a pipe with a goroutine to copy its read-end to writer