woj/nsjail
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

cgroup: move to C++

Browse Source
This commit is contained in:
Robert Swiecki 2018-02-09 18:13:17 +01:00
parent 27a226ad28
commit 15170f9d6c
6 changed files with 46 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
Makefile
View File

@ -35,8 +35,8 @@ LDFLAGS += -pie -Wl,-z,noexecstack -lpthread $(shell pkg-config --libs protobuf)
BIN = nsjail
LIBS = kafel/libkafel.a
SRCS_C = log.c cgroup.c mount.c user.c util.c
SRCS_CXX = caps.cc cmdline.cc config.cc contain.cc cpu.cc net.cc nsjail.cc pid.cc sandbox.cc subproc.cc uts.cc
SRCS_C = log.c mount.c util.c
SRCS_CXX = caps.cc cgroup.cc cmdline.cc config.cc contain.cc cpu.cc net.cc nsjail.cc pid.cc sandbox.cc subproc.cc uts.cc user.cc
SRCS_PROTO = config.proto
SRCS_PB_CXX = $(SRCS_PROTO:.proto=.pb.cc)
SRCS_PB_H = $(SRCS_PROTO:.proto=.pb.h)
@ -98,21 +98,22 @@ indent:
# DO NOT DELETE THIS LINE -- make depend depends on it.
log.o: log.h nsjail.h
cgroup.o: cgroup.h nsjail.h log.h util.h
mount.o: mount.h nsjail.h common.h log.h subproc.h util.h
util.o: util.h nsjail.h common.h log.h
caps.o: caps.h nsjail.h common.h log.h util.h
cgroup.o: cgroup.h nsjail.h log.h util.h
cmdline.o: cmdline.h nsjail.h common.h log.h mount.h util.h caps.h config.h
cmdline.o: sandbox.h user.h
config.o: common.h config.h nsjail.h log.h mount.h util.h caps.h cmdline.h
config.o: user.h
contain.o: contain.h nsjail.h cgroup.h log.h mount.h caps.h cpu.h net.h pid.h
contain.o: contain.h nsjail.h log.h mount.h caps.h cgroup.h cpu.h net.h pid.h
contain.o: user.h uts.h
cpu.o: cpu.h nsjail.h log.h util.h
net.o: net.h nsjail.h log.h subproc.h
nsjail.o: nsjail.h cmdline.h common.h log.h net.h subproc.h util.h
pid.o: pid.h nsjail.h log.h subproc.h
sandbox.o: sandbox.h nsjail.h kafel/include/kafel.h log.h
subproc.o: subproc.h nsjail.h contain.h net.h sandbox.h user.h cgroup.h
subproc.o: subproc.h nsjail.h cgroup.h contain.h net.h sandbox.h user.h
subproc.o: common.h log.h util.h
uts.o: uts.h nsjail.h log.h
user.o: user.h nsjail.h common.h log.h util.h subproc.h

44
cgroup.c → cgroup.cc
View File

@ -30,10 +30,14 @@
#include <sys/stat.h>
#include <unistd.h>
extern "C" {
#include "log.h"
#include "util.h"
}
static bool cgroupInitNsFromParentMem(struct nsjconf_t* nsjconf, pid_t pid) {
namespace cgroup {
static bool initNsFromParentMem(struct nsjconf_t* nsjconf, pid_t pid) {
if (nsjconf->cgroup_mem_max == (size_t)0) {
return true;
}
@ -79,7 +83,7 @@ static bool cgroupInitNsFromParentMem(struct nsjconf_t* nsjconf, pid_t pid) {
return true;
}
static bool cgroupInitNsFromParentPids(struct nsjconf_t* nsjconf, pid_t pid) {
static bool initNsFromParentPids(struct nsjconf_t* nsjconf, pid_t pid) {
if (nsjconf->cgroup_pids_max == 0U) {
return true;
}
@ -115,7 +119,7 @@ static bool cgroupInitNsFromParentPids(struct nsjconf_t* nsjconf, pid_t pid) {
return true;
}
static bool cgroupInitNsFromParentNetCls(struct nsjconf_t* nsjconf, pid_t pid) {
static bool initNsFromParentNetCls(struct nsjconf_t* nsjconf, pid_t pid) {
if (nsjconf->cgroup_net_cls_classid == 0U) {
return true;
}
@ -153,7 +157,7 @@ static bool cgroupInitNsFromParentNetCls(struct nsjconf_t* nsjconf, pid_t pid) {
return true;
}
static bool cgroupInitNsFromParentCpu(struct nsjconf_t* nsjconf, pid_t pid) {
static bool initNsFromParentCpu(struct nsjconf_t* nsjconf, pid_t pid) {
if (nsjconf->cgroup_cpu_ms_per_sec == 0U) {
return true;
}
@ -200,23 +204,23 @@ static bool cgroupInitNsFromParentCpu(struct nsjconf_t* nsjconf, pid_t pid) {
return true;
}
bool cgroupInitNsFromParent(struct nsjconf_t* nsjconf, pid_t pid) {
if (!cgroupInitNsFromParentMem(nsjconf, pid)) {
bool initNsFromParent(struct nsjconf_t* nsjconf, pid_t pid) {
if (!initNsFromParentMem(nsjconf, pid)) {
return false;
}
if (!cgroupInitNsFromParentPids(nsjconf, pid)) {
if (!initNsFromParentPids(nsjconf, pid)) {
return false;
}
if (!cgroupInitNsFromParentNetCls(nsjconf, pid)) {
if (!initNsFromParentNetCls(nsjconf, pid)) {
return false;
}
if (!cgroupInitNsFromParentCpu(nsjconf, pid)) {
if (!initNsFromParentCpu(nsjconf, pid)) {
return false;
}
return true;
}
void cgroupFinishFromParentMem(struct nsjconf_t* nsjconf, pid_t pid) {
void finishFromParentMem(struct nsjconf_t* nsjconf, pid_t pid) {
if (nsjconf->cgroup_mem_max == (size_t)0) {
return;
}
@ -230,7 +234,7 @@ void cgroupFinishFromParentMem(struct nsjconf_t* nsjconf, pid_t pid) {
return;
}
void cgroupFinishFromParentPids(struct nsjconf_t* nsjconf, pid_t pid) {
void finishFromParentPids(struct nsjconf_t* nsjconf, pid_t pid) {
if (nsjconf->cgroup_pids_max == 0U) {
return;
}
@ -244,7 +248,7 @@ void cgroupFinishFromParentPids(struct nsjconf_t* nsjconf, pid_t pid) {
return;
}
void cgroupFinishFromParentCpu(struct nsjconf_t* nsjconf, pid_t pid) {
void finishFromParentCpu(struct nsjconf_t* nsjconf, pid_t pid) {
if (nsjconf->cgroup_cpu_ms_per_sec == 0U) {
return;
}
@ -258,7 +262,7 @@ void cgroupFinishFromParentCpu(struct nsjconf_t* nsjconf, pid_t pid) {
return;
}
void cgroupFinishFromParentNetCls(struct nsjconf_t* nsjconf, pid_t pid) {
void finishFromParentNetCls(struct nsjconf_t* nsjconf, pid_t pid) {
if (nsjconf->cgroup_net_cls_classid == 0U) {
return;
}
@ -272,11 +276,13 @@ void cgroupFinishFromParentNetCls(struct nsjconf_t* nsjconf, pid_t pid) {
return;
}
void cgroupFinishFromParent(struct nsjconf_t* nsjconf, pid_t pid) {
cgroupFinishFromParentMem(nsjconf, pid);
cgroupFinishFromParentPids(nsjconf, pid);
cgroupFinishFromParentNetCls(nsjconf, pid);
cgroupFinishFromParentCpu(nsjconf, pid);
void finishFromParent(struct nsjconf_t* nsjconf, pid_t pid) {
finishFromParentMem(nsjconf, pid);
finishFromParentPids(nsjconf, pid);
finishFromParentNetCls(nsjconf, pid);
finishFromParentCpu(nsjconf, pid);
}
bool cgroupInitNs(void) { return true; }
bool initNs(void) { return true; }
} // namespace cgroup

10
cgroup.h
View File

@ -27,8 +27,12 @@
#include "nsjail.h"
bool cgroupInitNsFromParent(struct nsjconf_t* nsjconf, pid_t pid);
bool cgroupInitNs(void);
void cgroupFinishFromParent(struct nsjconf_t* nsjconf, pid_t pid);
namespace cgroup {
bool initNsFromParent(struct nsjconf_t* nsjconf, pid_t pid);
bool initNs(void);
void finishFromParent(struct nsjconf_t* nsjconf, pid_t pid);
} // namespace cgroup
#endif /* _CGROUP_H */

4
contain.cc
View File

@ -38,12 +38,12 @@
#include <unistd.h>
extern "C" {
#include "cgroup.h"
#include "log.h"
#include "mount.h"
}
#include "caps.h"
#include "cgroup.h"
#include "cpu.h"
#include "net.h"
#include "pid.h"
@ -60,7 +60,7 @@ static bool containInitNetNs(struct nsjconf_t* nsjconf) { return net::initNsFrom
static bool containInitUtsNs(struct nsjconf_t* nsjconf) { return uts::initNs(nsjconf); }
static bool containInitCgroupNs(void) { return cgroupInitNs(); }
static bool containInitCgroupNs(void) { return cgroup::initNs(); }
static bool containDropPrivs(struct nsjconf_t* nsjconf) {
#ifndef PR_SET_NO_NEW_PRIVS

8
subproc.cc
View File

@ -42,13 +42,13 @@
#include <time.h>
#include <unistd.h>
#include "cgroup.h"
#include "contain.h"
#include "net.h"
#include "sandbox.h"
#include "user.h"
extern "C" {
#include "cgroup.h"
#include "common.h"
#include "log.h"
#include "util.h"
@ -148,7 +148,7 @@ static int subprocNewProc(
LOG_E("Couldn't initialize net user namespace");
_exit(0xff);
}
if (cgroupInitNsFromParent(nsjconf, getpid()) == false) {
if (cgroup::initNsFromParent(nsjconf, getpid()) == false) {
LOG_E("Couldn't initialize net user namespace");
_exit(0xff);
}
@ -317,7 +317,7 @@ int reapProc(struct nsjconf_t* nsjconf) {
}
if (wait4(si.si_pid, &status, WNOHANG, NULL) == si.si_pid) {
cgroupFinishFromParent(nsjconf, si.si_pid);
cgroup::finishFromParent(nsjconf, si.si_pid);
const char* remote_txt = "[UNKNOWN]";
struct pids_t* elem = getPidElem(nsjconf, si.si_pid);
@ -380,7 +380,7 @@ static bool initParent(struct nsjconf_t* nsjconf, pid_t pid, int pipefd) {
LOG_E("Couldn't create and put MACVTAP interface into NS of PID '%d'", pid);
return false;
}
if (cgroupInitNsFromParent(nsjconf, pid) == false) {
if (cgroup::initNsFromParent(nsjconf, pid) == false) {
LOG_E("Couldn't initialize cgroup user namespace");
exit(0xff);
}

4
user.cc
View File

@ -349,8 +349,8 @@ static gid_t parseGid(const char* id) {
return (gid_t)-1;
}
bool parseId(struct nsjconf_t* nsjconf, const char* i_id, const char* o_id, size_t cnt,
bool is_gid, bool is_newidmap) {
bool parseId(struct nsjconf_t* nsjconf, const char* i_id, const char* o_id, size_t cnt, bool is_gid,
bool is_newidmap) {
uid_t inside_id;
uid_t outside_id;