mount: allow read write mount for /proc

criyle/go-judge#106

Co-authored-by: iBug <git@ibugone.com>
This commit is contained in:
criyle 2024-05-23 10:21:46 +00:00
parent 60a64d0fb1
commit 6d21194b72
4 changed files with 25 additions and 16 deletions

4
go.mod
View File

@ -4,6 +4,6 @@ go 1.21
require (
github.com/elastic/go-seccomp-bpf v1.4.0
golang.org/x/net v0.24.0
golang.org/x/sys v0.19.0
golang.org/x/net v0.25.0
golang.org/x/sys v0.20.0
)

8
go.sum
View File

@ -6,9 +6,9 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

View File

@ -66,13 +66,13 @@ func isBindMountFileOrNotExists(m Mount) (bool, error) {
return false, nil
}
// WithMounts add mounts to builder
// WithMounts adds mounts to builder
func (b *Builder) WithMounts(m []Mount) *Builder {
b.Mounts = append(b.Mounts, m...)
return b
}
// WithMount add single mount to builder
// WithMount adds single mount to builder
func (b *Builder) WithMount(m Mount) *Builder {
b.Mounts = append(b.Mounts, m)
return b
@ -92,7 +92,7 @@ func (b *Builder) WithBind(source, target string, readonly bool) *Builder {
return b
}
// WithTmpfs add a tmpfs mount to builder
// WithTmpfs adds a tmpfs mount to builder
func (b *Builder) WithTmpfs(target, data string) *Builder {
b.Mounts = append(b.Mounts, Mount{
Source: "tmpfs",
@ -104,13 +104,22 @@ func (b *Builder) WithTmpfs(target, data string) *Builder {
return b
}
// WithProc add proc file system
// WithProc adds proc file system mounted read-only
func (b *Builder) WithProc() *Builder {
return b.WithProcRW(false)
}
// WithProcRW adds proc file system, possibly read-write
func (b *Builder) WithProcRW(canWrite bool) *Builder {
var flags uintptr = unix.MS_NOSUID | unix.MS_NODEV | unix.MS_NOEXEC
if !canWrite {
flags |= unix.MS_RDONLY
}
b.Mounts = append(b.Mounts, Mount{
Source: "proc",
Target: "proc",
FsType: "proc",
Flags: unix.MS_NOSUID | unix.MS_NODEV | unix.MS_NOEXEC | unix.MS_RDONLY,
Flags: flags,
})
return b
}

View File

@ -66,19 +66,19 @@ func ensureMountTargetExists(source, target string) error {
}
func (m Mount) String() string {
flag := "rw"
if m.Flags&syscall.MS_RDONLY == syscall.MS_RDONLY {
flag = "ro"
}
switch {
case m.Flags&syscall.MS_BIND == syscall.MS_BIND:
flag := "rw"
if m.Flags&syscall.MS_RDONLY == syscall.MS_RDONLY {
flag = "ro"
}
return fmt.Sprintf("bind[%s:%s:%s]", m.Source, m.Target, flag)
case m.FsType == "tmpfs":
return fmt.Sprintf("tmpfs[%s]", m.Target)
case m.FsType == "proc":
return "proc[ro]"
return fmt.Sprintf("proc[%s]", flag)
default:
return fmt.Sprintf("mount[%s,%s:%s:%x,%s]", m.FsType, m.Source, m.Target, m.Flags, m.Data)