diff --git a/forkexec/consts.go b/forkexec/consts.go index 4f3b6fa..513512f 100644 --- a/forkexec/consts.go +++ b/forkexec/consts.go @@ -1,6 +1,8 @@ package forkexec -import "syscall" +import ( + "golang.org/x/sys/unix" +) // defines missing consts from syscall package const ( @@ -8,9 +10,9 @@ const ( SECCOMP_SET_MODE_FILTER = 1 SECCOMP_FILTER_FLAG_TSYNC = 1 - // CLONE_NEWCGOUP is not included - UnshareFlags = syscall.CLONE_NEWIPC | syscall.CLONE_NEWNET | syscall.CLONE_NEWNS | - syscall.CLONE_NEWPID | syscall.CLONE_NEWUSER | syscall.CLONE_NEWUTS + // Unshare flags + UnshareFlags = unix.CLONE_NEWIPC | unix.CLONE_NEWNET | unix.CLONE_NEWNS | + unix.CLONE_NEWPID | unix.CLONE_NEWUSER | unix.CLONE_NEWUTS | unix.CLONE_NEWCGROUP ) // used by unshare remount / to private @@ -20,4 +22,7 @@ var ( // tmp dir made by pivot_root OldRoot = "old_root" + + // go does not allow constant uintptr to be negative... + _AT_FDCWD = unix.AT_FDCWD ) diff --git a/forkexec/fork.go b/forkexec/fork.go index 3d01833..498827d 100644 --- a/forkexec/fork.go +++ b/forkexec/fork.go @@ -149,7 +149,7 @@ func (r *Runner) Start() (int, error) { for i, m := range mountParams { // mkdirs(target) for _, p := range dirsToMake[i] { - _, _, err1 = syscall.RawSyscall(syscall.SYS_MKDIR, uintptr(unsafe.Pointer(p)), 0755, 0) + _, _, err1 = syscall.RawSyscall(syscall.SYS_MKDIRAT, uintptr(_AT_FDCWD), uintptr(unsafe.Pointer(p)), 0755) if err1 != 0 && err1 != syscall.EEXIST { goto childerror } @@ -166,13 +166,13 @@ func (r *Runner) Start() (int, error) { // pivit_root if pivotRoot != nil { // mkdir(root/old_root) - _, _, err1 = syscall.RawSyscall(syscall.SYS_MKDIR, uintptr(unsafe.Pointer(oldRoot)), 0755, 0) + _, _, err1 = syscall.RawSyscall(syscall.SYS_MKDIRAT, uintptr(_AT_FDCWD), uintptr(unsafe.Pointer(oldRoot)), 0755) if err1 != 0 { goto childerror } // pivot_root(root, root/old_root) - _, _, err1 = syscall.RawSyscall(syscall.SYS_MKDIR, uintptr(unsafe.Pointer(pivotRoot)), uintptr(unsafe.Pointer(oldRoot)), 0) + _, _, err1 = syscall.RawSyscall(syscall.SYS_PIVOT_ROOT, uintptr(unsafe.Pointer(pivotRoot)), uintptr(unsafe.Pointer(oldRoot)), 0) if err1 != 0 { goto childerror } @@ -184,7 +184,7 @@ func (r *Runner) Start() (int, error) { } // rmdir(root/old_root) - _, _, err1 = syscall.RawSyscall(syscall.SYS_RMDIR, uintptr(unsafe.Pointer(oldRoot)), 0755, 0) + _, _, err1 = syscall.RawSyscall(syscall.SYS_UNLINKAT, uintptr(_AT_FDCWD), uintptr(unsafe.Pointer(oldRoot)), uintptr(unix.AT_REMOVEDIR)) if err1 != 0 { goto childerror }