summaryrefslogtreecommitdiffstats
path: root/src/nspawn/nspawn-oci.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* nspawn: clean up & unify cleanup handlersFrantisek Sumsal2023-05-181-32/+30
| | | | Also, make them follow our naming conventions.
* nspawn: use ASSERT_PTR() moreFrantisek Sumsal2023-05-181-31/+25
|
* nspawn: make sure the device type survives when setting device modeFrantisek Sumsal2023-05-161-1/+1
|
* nspawn: fix a global-buffer-overflowFrantisek Sumsal2023-05-161-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Whoopsie. ================================================================= ==3789231==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000051d0b8 at pc 0x7f70850bc904 bp 0x7ffd9bbdf660 sp 0x7ffd9bbdf658 READ of size 8 at 0x00000051d0b8 thread T0 #0 0x7f70850bc903 in json_dispatch ../src/shared/json.c:4347 #1 0x4a5b54 in oci_seccomp_syscalls ../src/nspawn/nspawn-oci.c:1838 #2 0x7f70850bd359 in json_dispatch ../src/shared/json.c:4395 #3 0x4a668c in oci_seccomp ../src/nspawn/nspawn-oci.c:1905 #4 0x7f70850bd359 in json_dispatch ../src/shared/json.c:4395 #5 0x4a7d8c in oci_linux ../src/nspawn/nspawn-oci.c:2030 #6 0x7f70850bd359 in json_dispatch ../src/shared/json.c:4395 #7 0x4aa31c in oci_load ../src/nspawn/nspawn-oci.c:2198 #8 0x446cec in load_oci_bundle ../src/nspawn/nspawn.c:4744 #9 0x44ffa7 in run ../src/nspawn/nspawn.c:5477 #10 0x4552fb in main ../src/nspawn/nspawn.c:5920 #11 0x7f7083a4a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) #12 0x7f7083a4a5c8 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x275c8) #13 0x40d284 in _start (/home/fsumsal/repos/@systemd/systemd/build-san/systemd-nspawn+0x40d284) 0x00000051d0b8 is located 40 bytes to the left of global variable 'bus_standard_errors_copy_0' defined in '../src/libsystemd/sd-bus/bus-error.h:57:1' (0x51d0e0) of size 8 0x00000051d0b8 is located 0 bytes to the right of global variable 'table' defined in '../src/nspawn/nspawn-oci.c:1829:43' (0x51d040) of size 120 SUMMARY: AddressSanitizer: global-buffer-overflow ../src/shared/json.c:4347 in json_dispatch Shadow bytes around the buggy address: 0x00008009b9c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00008009b9d0: 00 00 00 00 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x00008009b9e0: 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 0x00008009b9f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00008009ba00: 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 00 =>0x00008009ba10: 00 00 00 00 00 00 00[f9]f9 f9 f9 f9 00 f9 f9 f9 0x00008009ba20: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 0x00008009ba30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00008009ba40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00008009ba50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00008009ba60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==3789231==ABORTING
* nspawn: fix inverted conditionFrantisek Sumsal2023-05-161-1/+1
|
* nspawn: call json_dispatch() with a correct pointerFrantisek Sumsal2023-05-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Otherwise hilarity ensues: AddressSanitizer:DEADLYSIGNAL ================================================================= ==722==ERROR: AddressSanitizer: SEGV on unknown address 0xffffffff00000000 (pc 0x7f8d50ca9ffb bp 0x7fff11b0d4a0 sp 0x7fff11b0cc30 T0) ==722==The signal is caused by a READ memory access. #0 0x7f8d50ca9ffb in __interceptor_strcmp.part.0 (/lib64/libasan.so.8+0xa9ffb) #1 0x7f8d4f9cf5a1 in strcmp_ptr ../src/fundamental/string-util-fundamental.h:33 #2 0x7f8d4f9cf5f8 in streq_ptr ../src/fundamental/string-util-fundamental.h:46 #3 0x7f8d4f9d74d2 in free_and_strdup ../src/basic/string-util.c:948 #4 0x49139a in free_and_strdup_warn ../src/basic/string-util.h:197 #5 0x4923eb in oci_absolute_path ../src/nspawn/nspawn-oci.c:139 #6 0x7f8d4f6bd359 in json_dispatch ../src/shared/json.c:4395 #7 0x4a8831 in oci_hooks_array ../src/nspawn/nspawn-oci.c:2089 #8 0x7f8d4f6bd359 in json_dispatch ../src/shared/json.c:4395 #9 0x4a8b56 in oci_hooks ../src/nspawn/nspawn-oci.c:2112 #10 0x7f8d4f6bd359 in json_dispatch ../src/shared/json.c:4395 #11 0x4aa298 in oci_load ../src/nspawn/nspawn-oci.c:2197 #12 0x446cec in load_oci_bundle ../src/nspawn/nspawn.c:4744 #13 0x44ffa7 in run ../src/nspawn/nspawn.c:5477 #14 0x4552fb in main ../src/nspawn/nspawn.c:5920 #15 0x7f8d4e04a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) #16 0x7f8d4e04a5c8 in __libc_start_main@GLIBC_2.2.5 (/lib64/libc.so.6+0x275c8) #17 0x40d284 in _start (/usr/bin/systemd-nspawn+0x40d284) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (/lib64/libasan.so.8+0xa9ffb) in __interceptor_strcmp.part.0 ==722==ABORTING
* nspawn: all hooks should be arrays of objects, not just objectsFrantisek Sumsal2023-05-161-3/+3
| | | | See: https://github.com/opencontainers/runtime-spec/blob/v1.0.0/config.md#posix-platform-hooks
* nspawn: use the just returned errno in the log messageFrantisek Sumsal2023-05-161-1/+1
| | | | | | | Use the returned errno even though we are going to ignore it, otherwise the log message is just confusing: config.json:119:13: Failed to resolve device node 4:2, ignoring: Success
* nspawn: disableOOMKiller should be boolean, not intFrantisek Sumsal2023-05-161-7/+7
| | | | See: https://github.com/opencontainers/runtime-spec/blob/v1.0.0/config-linux.md#memory
* nspawn: file system namespace -> mount namespaceFrantisek Sumsal2023-05-151-1/+1
|
* nspawn: fix a typo in an error messageFrantisek Sumsal2023-05-151-1/+1
|
* src: fix several typos in log messagesDmitry V. Levin2023-02-151-1/+1
|
* tree-wide: use ASSERT_PTR moreDavid Tardon2022-09-131-103/+35
|
* sd-device: rename devpath_from_devnum() -> devname_from_devnum()Yu Watanabe2022-09-021-1/+1
| | | | | | | | In sd-device, `devpath` is a kind of syspath without '/sys' prefix, e.g. /devices/pci0000:00/0000:00:1c.4/0000:3c:00.0/nvme/nvme0/nvme0n1, and `devname` is a path to the device node, e.g. /dev/nvme0n1. Let's use the consistent name for the helper function.
* tree-wide: Use correct format specifiersJan Janssen2022-08-301-6/+6
| | | | gcc will complain about all these with -Wformat-signedness.
* tree-wide: use devpath_from_devnum() and device_open_from_devnum()Yu Watanabe2022-08-281-1/+2
| | | | Fixes #24465.
* basic: split out dev_t related calls into new devno-util.[ch]Lennart Poettering2022-04-131-1/+1
| | | | | | | | | | | | | | No actual code changes, just splitting out of some dev_t handling related calls from stat-util.[ch], they are quite a number already, and deserve their own module now I think. Also, try to settle on the name "devnum" as the name for the concept, instead of "devno" or "dev" or "devid". "devnum" is the name exported in udev APIs, hence probably best to stick to that. (this just renames a few symbols to "devum", local variables are left untouched, to make the patch not too invasive) No actual code changes.
* strv: make iterator in STRV_FOREACH() declaread in the loopYu Watanabe2022-03-191-1/+0
| | | | This also avoids multiple evaluations in STRV_FOREACH_BACKWARDS()
* tree-wide: fix duplicated wordsMichael Biebl2022-03-181-2/+2
| | | | | | | the the in in not not we we
* shared/json: use int64_t instead of intmax_tZbigniew Jędrzejewski-Szmek2021-11-181-28/+28
| | | | | | | | | | | We were already asserting that the intmax_t and uintmax_t types are the same as int64_t and uint64_t. Pretty much everywhere in the code base we use the latter types. In principle intmax_t could be something different on some new architecture, and then the code would fail to compile or behave differently. We actually do not want the code to behave differently on those architectures, because that'd break interoperability. So let's just use int64_t/uint64_t since that's what we indend to use.
* Typos found by codespellDimitri Papadopoulos2021-10-201-1/+1
|
* tree-wide: use UINT64_MAX or friendsYu Watanabe2021-03-041-19/+19
|
* json: rename json_dispatch_{integer,unsigned} -> json_dispatch_{intmax,uintmax}Anita Zhang2021-02-261-2/+2
| | | | | | Prompted by https://bugzilla.redhat.com/show_bug.cgi?id=1930875 in which I had previously used json_dispatch_unsigned and passed a return variable of type unsigned when json_dispatch_unsigned writes a uintmax_t.
* tree-wide: propagate error code from _from_string() functionsZbigniew Jędrzejewski-Szmek2021-02-101-1/+1
| | | | Now that we know we have something useful, no need to make an answer up.
* nspawn: make rootfs relative to oci bundle pathArian van Putten2021-01-121-1/+17
| | | | | | | | | | | This is inline with the OCI runtime spec: On POSIX platforms, path is either an absolute path or a relative path to the bundle. For example, with a bundle at /to/bundle and a root filesystem at /to/bundle/rootfs, the path value can be either /to/bundle/rootfs or rootfs. The value SHOULD be the conventional rootfs. (https://github.com/opencontainers/runtime-spec/blob/master/config.md)
* hostname-util: flagsify hostname_is_valid(), drop machine_name_is_valid()Lennart Poettering2020-12-151-1/+1
| | | | | | | | | | | | Let's clean up hostname_is_valid() a bit: let's turn the second boolean argument into a more explanatory flags field, and add a flag that accepts the special name ".host" as valid. This is useful for the container logic, where the special hostname ".host" refers to the "root container", i.e. the host system itself, and can be specified at various places. let's also get rid of machine_name_is_valid(). It was just an alias, which is confusing and even more so now that we have the flags param.
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* tree-wide: assorted coccinelle fixesFrantisek Sumsal2020-10-091-10/+9
|
* seccomp: add support for riscv64Aurelien Jarno2020-08-211-0/+3
| | | | | | | | | | | | | | | This patch adds seccomp support to the riscv64 architecture. seccomp support is available in the riscv64 kernel since version 5.5, and it has just been added to the libseccomp library. riscv64 uses generic syscalls like aarch64, so I used that architecture as a reference to find which code has to be modified. With this patch, the testsuite passes successfully, including the test-seccomp test. The system boots and works fine with kernel 5.4 (i.e. without seccomp support) and kernel 5.5 (i.e. with seccomp support). I have also verified that the "SystemCallFilter=~socket" option prevents a service to use the ping utility when running on kernel 5.5.
* tree-wide: avoid some loaded termsLennart Poettering2020-06-251-13/+14
| | | | | | | | | | | | | | | | | | | | | | | | https://tools.ietf.org/html/draft-knodel-terminology-02 https://lwn.net/Articles/823224/ This gets rid of most but not occasions of these loaded terms: 1. scsi_id and friends are something that is supposed to be removed from our tree (see #7594) 2. The test suite defines an API used by the ubuntu CI. We can remove this too later, but this needs to be done in sync with the ubuntu CI. 3. In some cases the terms are part of APIs we call or where we expose concepts the kernel names the way it names them. (In particular all remaining uses of the word "slave" in our codebase are like this, it's used by the POSIX PTY layer, by the network subsystem, the mount API and the block device subsystem). Getting rid of the term in these contexts would mean doing some major fixes of the kernel ABI first. Regarding the replacements: when whitelist/blacklist is used as noun we replace with with allow list/deny list, and when used as verb with allow-list/deny-list.
* tree-wide: fix spelling errorsFrantisek Sumsal2020-04-211-1/+1
| | | | | | Based on a report from Fossies.org using Codespell. Followup to #15436
* nspawn-oci: use new json_variant_strv() helperLennart Poettering2019-12-021-14/+3
|
* json: add flags parameter to json_parse_file(), for parsing "sensitive" dataLennart Poettering2019-12-021-1/+1
| | | | | | | This will call json_variant_sensitive() internally while parsing for each allocated sub-variant. This is better than calling it a posteriori at the end, because partially parsed variants will always be properly erased from memory this way.
* nspawn: fix misplaced parenthesis and merge two error handling pathsZbigniew Jędrzejewski-Szmek2019-07-171-7/+3
| | | | | | | I don't think we need to provide the two separate error messages, let's shorten the code a bit by merging them. Coverity CID#1402320.
* tree-wide: drop duplicated blank linesYu Watanabe2019-07-151-1/+0
| | | | | | | ``` $ for i in */*.[ch] */*/*.[ch]; do sed -e '/^$/ {N; s/\n$//g}' -i $i; done $ git checkout HEAD -- basic/linux shared/linux ```
* Merge pull request #12628 from keszybz/dbus-executeMichal Sekletar2019-05-301-14/+11
|\ | | | | Rework cpu affinity parsing
| * Rework cpu affinity parsingZbigniew Jędrzejewski-Szmek2019-05-291-14/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The CPU_SET_S api is pretty bad. In particular, it has a parameter for the size of the array, but operations which take two (CPU_EQUAL_S) or even three arrays (CPU_{AND,OR,XOR}_S) still take just one size. This means that all arrays must be of the same size, or buffer overruns will occur. This is exactly what our code would do, if it received an array of unexpected size over the network. ("Unexpected" here means anything different from what cpu_set_malloc() detects as the "right" size.) Let's rework this, and store the size in bytes of the allocated storage area. The code will now parse any number up to 8191, independently of what the current kernel supports. This matches the kernel maximum setting for any architecture, to make things more portable. Fixes #12605.
* | nspawn: expose the new seccomp actions in the OCI logicLennart Poettering2019-05-241-5/+11
|/
* codespell: fix spelling errorsBen Boeckel2019-04-291-0/+1
|
* json: simplify JSON_VARIANT_OBJECT_FOREACH() macro a bitLennart Poettering2019-04-121-13/+11
| | | | | | | | There's no point in returning the "key" within each loop iteration as JsonVariant object. Let's simplify things and return it as string. That simplifies usage (since the caller doesn't have to convert the object to the string anymore) and is safe since we already validate that keys are strings when an object JsonVariant is allocated.
* headers: remove unneeded includes from util.hZbigniew Jędrzejewski-Szmek2019-03-271-0/+1
| | | | | This means we need to include many more headers in various files that simply included util.h before, but it seems cleaner to do it this way.
* nspawn-oci: mount source is optionalZbigniew Jędrzejewski-Szmek2019-03-221-1/+1
|
* nspawn-oci: use _cleanup_ in one more placeZbigniew Jędrzejewski-Szmek2019-03-221-49/+30
|
* nspawn: conditionalize libseccomp useLennart Poettering2019-03-221-3/+11
| | | | | We support compilation without libseccomp, hence don't rely on its symbols.
* util-lib: get rid of a helper variableZbigniew Jędrzejewski-Szmek2019-03-211-3/+2
|
* nspawn-oci: add helper function for free_and_strdup with oom checkZbigniew Jędrzejewski-Szmek2019-03-211-10/+2
|
* nspawn-oci: use SYNTHETIC_ERRNOZbigniew Jędrzejewski-Szmek2019-03-211-265/+201
|
* nspawn: add support for executing OCI runtime bundles with nspawnLennart Poettering2019-03-151-0/+2352
This is a pretty large patch, and adds support for OCI runtime bundles to nspawn. A new switch --oci-bundle= is added that takes a path to an OCI bundle. The JSON file included therein is read similar to a .nspawn settings files, however with a different feature set. Implementation-wise this mostly extends the pre-existing Settings object to carry additional properties for OCI. However, OCI supports some concepts .nspawn files did not support yet, which this patch also adds: 1. Support for "masking" files and directories. This functionatly is now also available via the new --inaccesible= cmdline command, and Inaccessible= in .nspawn files. 2. Support for mounting arbitrary file systems. (not exposed through nspawn cmdline nor .nspawn files, because probably not a good idea) 3. Ability to configure the console settings for a container. This functionality is now also available on the nspawn cmdline in the new --console= switch (not added to .nspawn for now, as it is something specific to the invocation really, not a property of the container) 4. Console width/height configuration. Not exposed through .nspawn/cmdline, but this may be controlled through $COLUMNS and $LINES like in most other UNIX tools. 5. UID/GID configuration by raw numbers. (not exposed in .nspawn and on the cmdline, since containers likely have different user tables, and the existing --user= switch appears to be the better option) 6. OCI hook commands (no exposed in .nspawn/cmdline, as very specific to OCI) 7. Creation of additional devices nodes in /dev. Most likely not a good idea, hence not exposed in .nspawn/cmdline. There's already --bind= to achieve the same, which is the better alternative. 8. Explicit syscall filters. This is not a good idea, due to the skewed arch support, hence not exposed through .nspawn/cmdline. 9. Configuration of some sysctls on a whitelist. Questionnable, not supported in .nspawn/cmdline for now. 10. Configuration of all 5 types of capabilities. Not a useful concept, since the kernel will reduce the caps on execve() anyway. Not exposed through .nspawn/cmdline as this is not very useful hence. Note that this only implements the OCI runtime logic itself. It does not provide a runc-compatible command line tool. This is left for a later PR. Only with that in place tools such as "buildah" can use the OCI support in nspawn as drop-in replacement. Currently still missing is OCI hook support, but it's already parsed and everything, and should be easy to add. Other than that it's OCI is implemented pretty comprehensively. There's a list of incompatibilities in the nspawn-oci.c file. In a later PR I'd like to convert this into proper markdown and add it to the documentation directory.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-02 12:30:54 +0100