diff --git a/container/consts_linux.go b/container/consts_linux.go index b97bbf5..dccf8c5 100644 --- a/container/consts_linux.go +++ b/container/consts_linux.go @@ -4,7 +4,6 @@ type cmdType int8 const ( cmdPing cmdType = iota + 1 - cmdCopyIn cmdOpen cmdDelete cmdReset diff --git a/container/container_exec_linux.go b/container/container_exec_linux.go index ea8cf03..810a380 100644 --- a/container/container_exec_linux.go +++ b/container/container_exec_linux.go @@ -17,7 +17,7 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error { cred *syscall.Credential ) if cmd == nil { - return c.sendErrorReply("execve: no parameter provided") + return c.sendErrorReply("handle: no parameter provided") } if len(msg.Fds) > 0 { files = intSliceToUintptr(msg.Fds) @@ -30,12 +30,20 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error { // if fexecve, then the first fd must be executable if cmd.FdExec { if len(files) == 0 { - return fmt.Errorf("execve: expected fexecve fd") + return c.sendErrorReply("handle: expected fexecve fd") } execFile = files[0] files = files[1:] } + if len(cmd.Argv) > 0 { + exePath, err := lookPath(cmd.Argv[0], cmd.Env) + if err != nil { + return c.sendErrorReply("handle: %s: %v", cmd.Argv[0], err) + } + cmd.Argv[0] = exePath + } + syncFunc := func(pid int) error { msg := unixsocket.Msg{ Cred: &syscall.Ucred{ diff --git a/container/host_exec_linux.go b/container/host_exec_linux.go index 621cba5..4793d9f 100644 --- a/container/host_exec_linux.go +++ b/container/host_exec_linux.go @@ -75,10 +75,16 @@ func (c *container) Execve(ctx context.Context, param ExecveParam) runner.Result return errResult("execve: recvReply %v", err) } // if sync function did not involved - if rep.Error != nil || msg.Cred == nil { + if rep.Error != nil { + return errResult("execve: %v", rep.Error) + } + // if pid not received + if msg.Cred == nil { // tell kill function to exit and sync c.execveSyncKill() - return errResult("execve: no pid received or error %v", rep.Error) + // tell err exec function to exit and sync + c.execveSyncKill() + return errResult("execve: no pid received") } if param.SyncFunc != nil { if err := param.SyncFunc(int(msg.Cred.Pid)); err != nil { diff --git a/container/lookup_linux.go b/container/lookup_linux.go new file mode 100644 index 0000000..0d5e611 --- /dev/null +++ b/container/lookup_linux.go @@ -0,0 +1,63 @@ +package container + +import ( + "errors" + "io/fs" + "os" + "path/filepath" + "strings" +) + +var ( + errNotFound = errors.New("executable file not found in $PATH") + errNoPath = errors.New("no PATH environment variable provided for look up") +) + +func findExecutable(file string) error { + d, err := os.Stat(file) + if err != nil { + return err + } + if m := d.Mode(); !m.IsDir() && m&0111 != 0 { + return nil + } + return fs.ErrPermission +} + +func lookPath(name string, env []string) (string, error) { + // don't look if abs path provided + if filepath.Base(name) != name { + return name, nil + } + + // don't look if exist in current dir + if err := findExecutable(name); err == nil { + return name, nil + } + + path, err := findPath(env) + if err != nil { + return "", err + } + for _, dir := range path { + if dir == "" { + dir = "." + } + p := filepath.Join(dir, name) + if err := findExecutable(p); err == nil { + return p, nil + } + } + return "", errNotFound +} + +func findPath(env []string) ([]string, error) { + // find PATH= + const pathPrefix = "PATH=" + for _, s := range env { + if strings.HasPrefix(s, pathPrefix) { + return filepath.SplitList(s[len(pathPrefix):]), nil + } + } + return nil, errNoPath +} diff --git a/go.mod b/go.mod index 4ab9a46..fdec8ff 100644 --- a/go.mod +++ b/go.mod @@ -4,8 +4,8 @@ go 1.18 require ( github.com/elastic/go-seccomp-bpf v1.2.0 - golang.org/x/net v0.0.0-20220809184613-07c6da5e1ced - golang.org/x/sys v0.0.0-20220808155132-1c4a2a72c664 + golang.org/x/net v0.0.0-20220812174116-3211cb980234 + golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab ) require github.com/pkg/errors v0.9.1 // indirect diff --git a/go.sum b/go.sum index 888db79..e9cb2f3 100644 --- a/go.sum +++ b/go.sum @@ -13,12 +13,12 @@ github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= -golang.org/x/net v0.0.0-20220809184613-07c6da5e1ced h1:3dYNDff0VT5xj+mbj2XucFst9WKk6PdGOrb9n+SbIvw= -golang.org/x/net v0.0.0-20220809184613-07c6da5e1ced/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk= +golang.org/x/net v0.0.0-20220812174116-3211cb980234 h1:RDqmgfe7SvlMWoqC3xwQ2blLO3fcWcxMa3eBLRdRW7E= +golang.org/x/net v0.0.0-20220812174116-3211cb980234/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190405154228-4b34438f7a67/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20220808155132-1c4a2a72c664 h1:v1W7bwXHsnLLloWYTVEdvGvA7BHMeBYsPcF0GLDxIRs= -golang.org/x/sys v0.0.0-20220808155132-1c4a2a72c664/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab h1:2QkjZIsXupsJbJIdSjjUOgWK3aEtzyuh2mPt3l/CkeU= +golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=