container: syncAfterExec to sync after execve rather than before

This commit is contained in:
criyle 2025-02-20 19:48:39 +00:00
parent 3d8333e952
commit f15b953065
4 changed files with 37 additions and 20 deletions

View File

@ -325,13 +325,14 @@ func start() (*runner.Result, error) {
r = &containerRunner{
Environment: m,
ExecveParam: container.ExecveParam{
Args: args,
Env: []string{pathEnv},
Files: fds,
ExecFile: execFile,
RLimits: rlims.PrepareRLimit(),
Seccomp: filter,
SyncFunc: syncFunc,
Args: args,
Env: []string{pathEnv},
Files: fds,
ExecFile: execFile,
RLimits: rlims.PrepareRLimit(),
Seccomp: filter,
SyncFunc: syncFunc,
SyncAfterExec: cg == nil,
},
}
} else if runt == "ns" {

View File

@ -48,7 +48,7 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error {
cmd.Argv[0] = exePath
}
syncFunc := func(pid int) error {
syncPid := func(pid int) error {
msg := unixsocket.Msg{
Cred: &syscall.Ucred{
Pid: int32(pid),
@ -68,6 +68,10 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error {
}
return nil
}
var syncFunc func(pid int) error
if !cmd.SyncAfter {
syncFunc = syncPid
}
if c.Cred {
cred = &syscall.Credential{
@ -109,6 +113,11 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error {
c.recvCmd()
return c.sendReply(reply{}, unixsocket.Msg{})
}
if cmd.SyncAfter {
if err := syncPid(1); err != nil {
syscall.Kill(-1, syscall.SIGKILL)
}
}
return c.handleExecveStarted(pid)
}

View File

@ -36,6 +36,10 @@ type ExecveParam struct {
// SyncFunc calls with pid just before execve (for attach the process to cgroups)
SyncFunc func(pid int) error
// SyncAfterExec makes syncFunc sync after the start of the execution
// Thus, since pid is not guarantee to be exist (may exit early), it is not passed
SyncAfterExec bool
}
// Execve runs process inside container. It accepts context cancelation as time limit exceeded.
@ -55,12 +59,13 @@ func (c *container) Execve(ctx context.Context, param ExecveParam) runner.Result
Fds: files,
}
execCmd := &execCmd{
Argv: param.Args,
Env: param.Env,
RLimits: param.RLimits,
Seccomp: param.Seccomp,
FdExec: param.ExecFile > 0,
CTTY: param.CTTY,
Argv: param.Args,
Env: param.Env,
RLimits: param.RLimits,
Seccomp: param.Seccomp,
FdExec: param.ExecFile > 0,
CTTY: param.CTTY,
SyncAfter: param.SyncAfterExec,
}
cm := cmd{
Cmd: cmdExecve,
@ -76,6 +81,7 @@ func (c *container) Execve(ctx context.Context, param ExecveParam) runner.Result
}
// if sync function did not involved
if rep.Error != nil {
c.execveSyncKill()
return errResult("execve: %v", rep.Error)
}
// if pid not received

View File

@ -36,12 +36,13 @@ type deleteCmd struct {
// execCmd stores execve parameter
type execCmd struct {
Argv []string // execve argv
Env []string // execve env
RLimits []rlimit.RLimit // execve posix rlimit
Seccomp seccomp.Filter // seccomp filter
FdExec bool // if use fexecve (fd[0] as exec)
CTTY bool // if set CTTY
Argv []string // execve argv
Env []string // execve env
RLimits []rlimit.RLimit // execve posix rlimit
Seccomp seccomp.Filter // seccomp filter
FdExec bool // if use fexecve (fd[0] as exec)
CTTY bool // if set CTTY
SyncAfter bool // if sync function calls after execve returns
}
// confCmd stores conf parameter