mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
container: look up executable by PATH
This commit is contained in:
parent
7e7babb354
commit
47ad6f0016
@ -4,7 +4,6 @@ type cmdType int8
|
|||||||
|
|
||||||
const (
|
const (
|
||||||
cmdPing cmdType = iota + 1
|
cmdPing cmdType = iota + 1
|
||||||
cmdCopyIn
|
|
||||||
cmdOpen
|
cmdOpen
|
||||||
cmdDelete
|
cmdDelete
|
||||||
cmdReset
|
cmdReset
|
||||||
|
|||||||
@ -17,7 +17,7 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error {
|
|||||||
cred *syscall.Credential
|
cred *syscall.Credential
|
||||||
)
|
)
|
||||||
if cmd == nil {
|
if cmd == nil {
|
||||||
return c.sendErrorReply("execve: no parameter provided")
|
return c.sendErrorReply("handle: no parameter provided")
|
||||||
}
|
}
|
||||||
if len(msg.Fds) > 0 {
|
if len(msg.Fds) > 0 {
|
||||||
files = intSliceToUintptr(msg.Fds)
|
files = intSliceToUintptr(msg.Fds)
|
||||||
@ -30,12 +30,20 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error {
|
|||||||
// if fexecve, then the first fd must be executable
|
// if fexecve, then the first fd must be executable
|
||||||
if cmd.FdExec {
|
if cmd.FdExec {
|
||||||
if len(files) == 0 {
|
if len(files) == 0 {
|
||||||
return fmt.Errorf("execve: expected fexecve fd")
|
return c.sendErrorReply("handle: expected fexecve fd")
|
||||||
}
|
}
|
||||||
execFile = files[0]
|
execFile = files[0]
|
||||||
files = files[1:]
|
files = files[1:]
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if len(cmd.Argv) > 0 {
|
||||||
|
exePath, err := lookPath(cmd.Argv[0], cmd.Env)
|
||||||
|
if err != nil {
|
||||||
|
return c.sendErrorReply("handle: %s: %v", cmd.Argv[0], err)
|
||||||
|
}
|
||||||
|
cmd.Argv[0] = exePath
|
||||||
|
}
|
||||||
|
|
||||||
syncFunc := func(pid int) error {
|
syncFunc := func(pid int) error {
|
||||||
msg := unixsocket.Msg{
|
msg := unixsocket.Msg{
|
||||||
Cred: &syscall.Ucred{
|
Cred: &syscall.Ucred{
|
||||||
|
|||||||
@ -75,10 +75,16 @@ func (c *container) Execve(ctx context.Context, param ExecveParam) runner.Result
|
|||||||
return errResult("execve: recvReply %v", err)
|
return errResult("execve: recvReply %v", err)
|
||||||
}
|
}
|
||||||
// if sync function did not involved
|
// if sync function did not involved
|
||||||
if rep.Error != nil || msg.Cred == nil {
|
if rep.Error != nil {
|
||||||
|
return errResult("execve: %v", rep.Error)
|
||||||
|
}
|
||||||
|
// if pid not received
|
||||||
|
if msg.Cred == nil {
|
||||||
// tell kill function to exit and sync
|
// tell kill function to exit and sync
|
||||||
c.execveSyncKill()
|
c.execveSyncKill()
|
||||||
return errResult("execve: no pid received or error %v", rep.Error)
|
// tell err exec function to exit and sync
|
||||||
|
c.execveSyncKill()
|
||||||
|
return errResult("execve: no pid received")
|
||||||
}
|
}
|
||||||
if param.SyncFunc != nil {
|
if param.SyncFunc != nil {
|
||||||
if err := param.SyncFunc(int(msg.Cred.Pid)); err != nil {
|
if err := param.SyncFunc(int(msg.Cred.Pid)); err != nil {
|
||||||
|
|||||||
63
container/lookup_linux.go
Normal file
63
container/lookup_linux.go
Normal file
@ -0,0 +1,63 @@
|
|||||||
|
package container
|
||||||
|
|
||||||
|
import (
|
||||||
|
"errors"
|
||||||
|
"io/fs"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
errNotFound = errors.New("executable file not found in $PATH")
|
||||||
|
errNoPath = errors.New("no PATH environment variable provided for look up")
|
||||||
|
)
|
||||||
|
|
||||||
|
func findExecutable(file string) error {
|
||||||
|
d, err := os.Stat(file)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if m := d.Mode(); !m.IsDir() && m&0111 != 0 {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return fs.ErrPermission
|
||||||
|
}
|
||||||
|
|
||||||
|
func lookPath(name string, env []string) (string, error) {
|
||||||
|
// don't look if abs path provided
|
||||||
|
if filepath.Base(name) != name {
|
||||||
|
return name, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// don't look if exist in current dir
|
||||||
|
if err := findExecutable(name); err == nil {
|
||||||
|
return name, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
path, err := findPath(env)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
for _, dir := range path {
|
||||||
|
if dir == "" {
|
||||||
|
dir = "."
|
||||||
|
}
|
||||||
|
p := filepath.Join(dir, name)
|
||||||
|
if err := findExecutable(p); err == nil {
|
||||||
|
return p, nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return "", errNotFound
|
||||||
|
}
|
||||||
|
|
||||||
|
func findPath(env []string) ([]string, error) {
|
||||||
|
// find PATH=
|
||||||
|
const pathPrefix = "PATH="
|
||||||
|
for _, s := range env {
|
||||||
|
if strings.HasPrefix(s, pathPrefix) {
|
||||||
|
return filepath.SplitList(s[len(pathPrefix):]), nil
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil, errNoPath
|
||||||
|
}
|
||||||
4
go.mod
4
go.mod
@ -4,8 +4,8 @@ go 1.18
|
|||||||
|
|
||||||
require (
|
require (
|
||||||
github.com/elastic/go-seccomp-bpf v1.2.0
|
github.com/elastic/go-seccomp-bpf v1.2.0
|
||||||
golang.org/x/net v0.0.0-20220809184613-07c6da5e1ced
|
golang.org/x/net v0.0.0-20220812174116-3211cb980234
|
||||||
golang.org/x/sys v0.0.0-20220808155132-1c4a2a72c664
|
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab
|
||||||
)
|
)
|
||||||
|
|
||||||
require github.com/pkg/errors v0.9.1 // indirect
|
require github.com/pkg/errors v0.9.1 // indirect
|
||||||
|
|||||||
8
go.sum
8
go.sum
@ -13,12 +13,12 @@ github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0
|
|||||||
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
|
||||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||||
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||||
golang.org/x/net v0.0.0-20220809184613-07c6da5e1ced h1:3dYNDff0VT5xj+mbj2XucFst9WKk6PdGOrb9n+SbIvw=
|
golang.org/x/net v0.0.0-20220812174116-3211cb980234 h1:RDqmgfe7SvlMWoqC3xwQ2blLO3fcWcxMa3eBLRdRW7E=
|
||||||
golang.org/x/net v0.0.0-20220809184613-07c6da5e1ced/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
|
golang.org/x/net v0.0.0-20220812174116-3211cb980234/go.mod h1:YDH+HFinaLZZlnHAfSS6ZXJJ9M9t4Dl22yv3iI2vPwk=
|
||||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||||
golang.org/x/sys v0.0.0-20190405154228-4b34438f7a67/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
golang.org/x/sys v0.0.0-20190405154228-4b34438f7a67/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||||
golang.org/x/sys v0.0.0-20220808155132-1c4a2a72c664 h1:v1W7bwXHsnLLloWYTVEdvGvA7BHMeBYsPcF0GLDxIRs=
|
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab h1:2QkjZIsXupsJbJIdSjjUOgWK3aEtzyuh2mPt3l/CkeU=
|
||||||
golang.org/x/sys v0.0.0-20220808155132-1c4a2a72c664/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||||
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user