mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-09-26 23:19:11 +08:00
container: syncAfterExec to sync after execve rather than before
This commit is contained in:
parent
3d8333e952
commit
f15b953065
@ -325,13 +325,14 @@ func start() (*runner.Result, error) {
|
||||
r = &containerRunner{
|
||||
Environment: m,
|
||||
ExecveParam: container.ExecveParam{
|
||||
Args: args,
|
||||
Env: []string{pathEnv},
|
||||
Files: fds,
|
||||
ExecFile: execFile,
|
||||
RLimits: rlims.PrepareRLimit(),
|
||||
Seccomp: filter,
|
||||
SyncFunc: syncFunc,
|
||||
Args: args,
|
||||
Env: []string{pathEnv},
|
||||
Files: fds,
|
||||
ExecFile: execFile,
|
||||
RLimits: rlims.PrepareRLimit(),
|
||||
Seccomp: filter,
|
||||
SyncFunc: syncFunc,
|
||||
SyncAfterExec: cg == nil,
|
||||
},
|
||||
}
|
||||
} else if runt == "ns" {
|
||||
|
@ -48,7 +48,7 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error {
|
||||
cmd.Argv[0] = exePath
|
||||
}
|
||||
|
||||
syncFunc := func(pid int) error {
|
||||
syncPid := func(pid int) error {
|
||||
msg := unixsocket.Msg{
|
||||
Cred: &syscall.Ucred{
|
||||
Pid: int32(pid),
|
||||
@ -68,6 +68,10 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error {
|
||||
}
|
||||
return nil
|
||||
}
|
||||
var syncFunc func(pid int) error
|
||||
if !cmd.SyncAfter {
|
||||
syncFunc = syncPid
|
||||
}
|
||||
|
||||
if c.Cred {
|
||||
cred = &syscall.Credential{
|
||||
@ -109,6 +113,11 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error {
|
||||
c.recvCmd()
|
||||
return c.sendReply(reply{}, unixsocket.Msg{})
|
||||
}
|
||||
if cmd.SyncAfter {
|
||||
if err := syncPid(1); err != nil {
|
||||
syscall.Kill(-1, syscall.SIGKILL)
|
||||
}
|
||||
}
|
||||
return c.handleExecveStarted(pid)
|
||||
}
|
||||
|
||||
|
@ -36,6 +36,10 @@ type ExecveParam struct {
|
||||
|
||||
// SyncFunc calls with pid just before execve (for attach the process to cgroups)
|
||||
SyncFunc func(pid int) error
|
||||
|
||||
// SyncAfterExec makes syncFunc sync after the start of the execution
|
||||
// Thus, since pid is not guarantee to be exist (may exit early), it is not passed
|
||||
SyncAfterExec bool
|
||||
}
|
||||
|
||||
// Execve runs process inside container. It accepts context cancelation as time limit exceeded.
|
||||
@ -55,12 +59,13 @@ func (c *container) Execve(ctx context.Context, param ExecveParam) runner.Result
|
||||
Fds: files,
|
||||
}
|
||||
execCmd := &execCmd{
|
||||
Argv: param.Args,
|
||||
Env: param.Env,
|
||||
RLimits: param.RLimits,
|
||||
Seccomp: param.Seccomp,
|
||||
FdExec: param.ExecFile > 0,
|
||||
CTTY: param.CTTY,
|
||||
Argv: param.Args,
|
||||
Env: param.Env,
|
||||
RLimits: param.RLimits,
|
||||
Seccomp: param.Seccomp,
|
||||
FdExec: param.ExecFile > 0,
|
||||
CTTY: param.CTTY,
|
||||
SyncAfter: param.SyncAfterExec,
|
||||
}
|
||||
cm := cmd{
|
||||
Cmd: cmdExecve,
|
||||
@ -76,6 +81,7 @@ func (c *container) Execve(ctx context.Context, param ExecveParam) runner.Result
|
||||
}
|
||||
// if sync function did not involved
|
||||
if rep.Error != nil {
|
||||
c.execveSyncKill()
|
||||
return errResult("execve: %v", rep.Error)
|
||||
}
|
||||
// if pid not received
|
||||
|
@ -36,12 +36,13 @@ type deleteCmd struct {
|
||||
|
||||
// execCmd stores execve parameter
|
||||
type execCmd struct {
|
||||
Argv []string // execve argv
|
||||
Env []string // execve env
|
||||
RLimits []rlimit.RLimit // execve posix rlimit
|
||||
Seccomp seccomp.Filter // seccomp filter
|
||||
FdExec bool // if use fexecve (fd[0] as exec)
|
||||
CTTY bool // if set CTTY
|
||||
Argv []string // execve argv
|
||||
Env []string // execve env
|
||||
RLimits []rlimit.RLimit // execve posix rlimit
|
||||
Seccomp seccomp.Filter // seccomp filter
|
||||
FdExec bool // if use fexecve (fd[0] as exec)
|
||||
CTTY bool // if set CTTY
|
||||
SyncAfter bool // if sync function calls after execve returns
|
||||
}
|
||||
|
||||
// confCmd stores conf parameter
|
||||
|
Loading…
Reference in New Issue
Block a user