mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-09-26 23:19:11 +08:00
mount: allow read write mount for /proc
criyle/go-judge#106 Co-authored-by: iBug <git@ibugone.com>
This commit is contained in:
parent
60a64d0fb1
commit
6d21194b72
4
go.mod
4
go.mod
@ -4,6 +4,6 @@ go 1.21
|
||||
|
||||
require (
|
||||
github.com/elastic/go-seccomp-bpf v1.4.0
|
||||
golang.org/x/net v0.24.0
|
||||
golang.org/x/sys v0.19.0
|
||||
golang.org/x/net v0.25.0
|
||||
golang.org/x/sys v0.20.0
|
||||
)
|
||||
|
8
go.sum
8
go.sum
@ -6,9 +6,9 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
|
||||
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
|
||||
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
|
||||
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
|
||||
golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
|
||||
golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
|
||||
golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
|
||||
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
|
||||
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
|
||||
golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
|
||||
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
|
@ -66,13 +66,13 @@ func isBindMountFileOrNotExists(m Mount) (bool, error) {
|
||||
return false, nil
|
||||
}
|
||||
|
||||
// WithMounts add mounts to builder
|
||||
// WithMounts adds mounts to builder
|
||||
func (b *Builder) WithMounts(m []Mount) *Builder {
|
||||
b.Mounts = append(b.Mounts, m...)
|
||||
return b
|
||||
}
|
||||
|
||||
// WithMount add single mount to builder
|
||||
// WithMount adds single mount to builder
|
||||
func (b *Builder) WithMount(m Mount) *Builder {
|
||||
b.Mounts = append(b.Mounts, m)
|
||||
return b
|
||||
@ -92,7 +92,7 @@ func (b *Builder) WithBind(source, target string, readonly bool) *Builder {
|
||||
return b
|
||||
}
|
||||
|
||||
// WithTmpfs add a tmpfs mount to builder
|
||||
// WithTmpfs adds a tmpfs mount to builder
|
||||
func (b *Builder) WithTmpfs(target, data string) *Builder {
|
||||
b.Mounts = append(b.Mounts, Mount{
|
||||
Source: "tmpfs",
|
||||
@ -104,13 +104,22 @@ func (b *Builder) WithTmpfs(target, data string) *Builder {
|
||||
return b
|
||||
}
|
||||
|
||||
// WithProc add proc file system
|
||||
// WithProc adds proc file system mounted read-only
|
||||
func (b *Builder) WithProc() *Builder {
|
||||
return b.WithProcRW(false)
|
||||
}
|
||||
|
||||
// WithProcRW adds proc file system, possibly read-write
|
||||
func (b *Builder) WithProcRW(canWrite bool) *Builder {
|
||||
var flags uintptr = unix.MS_NOSUID | unix.MS_NODEV | unix.MS_NOEXEC
|
||||
if !canWrite {
|
||||
flags |= unix.MS_RDONLY
|
||||
}
|
||||
b.Mounts = append(b.Mounts, Mount{
|
||||
Source: "proc",
|
||||
Target: "proc",
|
||||
FsType: "proc",
|
||||
Flags: unix.MS_NOSUID | unix.MS_NODEV | unix.MS_NOEXEC | unix.MS_RDONLY,
|
||||
Flags: flags,
|
||||
})
|
||||
return b
|
||||
}
|
||||
|
@ -66,19 +66,19 @@ func ensureMountTargetExists(source, target string) error {
|
||||
}
|
||||
|
||||
func (m Mount) String() string {
|
||||
flag := "rw"
|
||||
if m.Flags&syscall.MS_RDONLY == syscall.MS_RDONLY {
|
||||
flag = "ro"
|
||||
}
|
||||
switch {
|
||||
case m.Flags&syscall.MS_BIND == syscall.MS_BIND:
|
||||
flag := "rw"
|
||||
if m.Flags&syscall.MS_RDONLY == syscall.MS_RDONLY {
|
||||
flag = "ro"
|
||||
}
|
||||
return fmt.Sprintf("bind[%s:%s:%s]", m.Source, m.Target, flag)
|
||||
|
||||
case m.FsType == "tmpfs":
|
||||
return fmt.Sprintf("tmpfs[%s]", m.Target)
|
||||
|
||||
case m.FsType == "proc":
|
||||
return "proc[ro]"
|
||||
return fmt.Sprintf("proc[%s]", flag)
|
||||
|
||||
default:
|
||||
return fmt.Sprintf("mount[%s,%s:%s:%x,%s]", m.FsType, m.Source, m.Target, m.Flags, m.Data)
|
||||
|
Loading…
Reference in New Issue
Block a user