woj/nsjail
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

make indent depend + style of comments

Browse Source
This commit is contained in:
Robert Swiecki 2022-11-22 22:15:01 +01:00
parent 4437810830
commit cc4245d23a
6 changed files with 32 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Makefile
View File

@ -118,7 +118,8 @@ cpu.o: cpu.h nsjail.h logs.h util.h
logs.o: logs.h macros.h util.h nsjail.h
mnt.o: mnt.h nsjail.h logs.h macros.h subproc.h util.h
net.o: net.h nsjail.h logs.h subproc.h
nsjail.o: nsjail.h cmdline.h logs.h macros.h net.h sandbox.h subproc.h util.h
nsjail.o: nsjail.h cgroup2.h cmdline.h logs.h macros.h net.h sandbox.h
nsjail.o: subproc.h util.h
pid.o: pid.h nsjail.h logs.h subproc.h
sandbox.o: sandbox.h nsjail.h kafel/include/kafel.h logs.h util.h
subproc.o: subproc.h nsjail.h cgroup.h cgroup2.h contain.h logs.h macros.h

32
cgroup2.cc
View File

@ -24,12 +24,12 @@
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <linux/magic.h>
#include <stdarg.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/vfs.h>
#include <linux/magic.h>
#include <unistd.h>
#include <fstream>
@ -60,8 +60,10 @@ static bool createCgroup(const std::string &cgroup_path, pid_t pid) {
}
static bool moveSelfIntoChildCgroup(nsjconf_t *nsjconf) {
// Move ourselves into another group to avoid the 'No internal processes' rule
// https://unix.stackexchange.com/a/713343
/*
* Move ourselves into another group to avoid the 'No internal processes' rule
* https://unix.stackexchange.com/a/713343
*/
std::string jail_cgroup_path = getJailCgroupPath(nsjconf);
LOG_I("nsjail is moving itself to a new child cgroup: %s\n", jail_cgroup_path.c_str());
RETURN_ON_FAILURE(createCgroup(jail_cgroup_path, getpid()));
@ -69,26 +71,30 @@ static bool moveSelfIntoChildCgroup(nsjconf_t *nsjconf) {
return true;
}
static bool enableCgroupSubtree(nsjconf_t *nsjconf, const std::string &controller, pid_t pid) {
std::string cgroup_path = nsjconf->cgroupv2_mount;
LOG_D("Enable cgroup.subtree_control +'%s' to '%s' for pid=%d", controller.c_str(), cgroup_path.c_str(), pid);
LOG_D("Enable cgroup.subtree_control +'%s' to '%s' for pid=%d", controller.c_str(),
cgroup_path.c_str(), pid);
std::string val = "+" + controller;
// Try once without moving the nsjail process and if that fails then try moving the nsjail process
// into a child cgroup before trying a second time.
if (util::writeBufToFile(
(cgroup_path + "/cgroup.subtree_control").c_str(), val.c_str(), val.length(), O_WRONLY, false)) {
/* Try once without moving the nsjail process and if that fails then try moving the nsjail
* process into a child cgroup before trying a second time.
*/
if (util::writeBufToFile((cgroup_path + "/cgroup.subtree_control").c_str(), val.c_str(),
val.length(), O_WRONLY, false)) {
return true;
}
if (errno == EBUSY) {
RETURN_ON_FAILURE(moveSelfIntoChildCgroup(nsjconf));
if (util::writeBufToFile(
(cgroup_path + "/cgroup.subtree_control").c_str(), val.c_str(), val.length(), O_WRONLY)) {
if (util::writeBufToFile((cgroup_path + "/cgroup.subtree_control").c_str(),
val.c_str(), val.length(), O_WRONLY)) {
return true;
}
}
LOG_E("Could not apply '%s' to cgroup.subtree_control in '%s'. If you are running in Docker, nsjail MUST be the root process to use cgroups.", val.c_str(), cgroup_path.c_str());
LOG_E(
"Could not apply '%s' to cgroup.subtree_control in '%s'. If you are running in Docker, "
"nsjail MUST be the root process to use cgroups.",
val.c_str(), cgroup_path.c_str());
return false;
}
@ -153,7 +159,7 @@ bool setup(nsjconf_t *nsjconf) {
// the controllers we need are there.
auto p = nsjconf->cgroupv2_mount + "/cgroup.subtree_control";
char buf[SUBTREE_CONTROL_BUF_LEN];
int read = util::readFromFile(p.c_str(), buf, SUBTREE_CONTROL_BUF_LEN-1);
int read = util::readFromFile(p.c_str(), buf, SUBTREE_CONTROL_BUF_LEN - 1);
if (read < 0) {
LOG_W("cgroupv2 setup: Could not read root subtree_control");
return false;

4
cgroup2.h
View File

@ -32,8 +32,8 @@ namespace cgroup2 {
bool initNsFromParent(nsjconf_t* nsjconf, pid_t pid);
bool initNs(void);
void finishFromParent(nsjconf_t* nsjconf, pid_t pid);
bool setup(nsjconf_t *nsjconf);
bool detectCgroupv2(nsjconf_t *nsjconf);
bool setup(nsjconf_t* nsjconf);
bool detectCgroupv2(nsjconf_t* nsjconf);
} // namespace cgroup2

2
nsjail.cc
View File

@ -39,6 +39,7 @@
#include <memory>
#include <vector>
#include "cgroup2.h"
#include "cmdline.h"
#include "logs.h"
#include "macros.h"
@ -46,7 +47,6 @@
#include "sandbox.h"
#include "subproc.h"
#include "util.h"
#include "cgroup2.h"
namespace nsjail {

6
util.cc
View File

@ -89,7 +89,8 @@ bool writeToFd(int fd, const void* buf, size_t len) {
return true;
}
bool writeBufToFile(const char* filename, const void* buf, size_t len, int open_flags, bool log_errors) {
bool writeBufToFile(
const char* filename, const void* buf, size_t len, int open_flags, bool log_errors) {
int fd;
TEMP_FAILURE_RETRY(fd = open(filename, open_flags, 0644));
if (fd == -1) {
@ -101,7 +102,8 @@ bool writeBufToFile(const char* filename, const void* buf, size_t len, int open_
if (!writeToFd(fd, buf, len)) {
if (log_errors) {
PLOG_E("Couldn't write '%zu' bytes to file '%s' (fd='%d')", len, filename, fd);
PLOG_E(
"Couldn't write '%zu' bytes to file '%s' (fd='%d')", len, filename, fd);
}
close(fd);
if (open_flags & O_CREAT) {

3
util.h
View File

@ -46,7 +46,8 @@ namespace util {
ssize_t readFromFd(int fd, void* buf, size_t len);
ssize_t readFromFile(const char* fname, void* buf, size_t len);
bool writeToFd(int fd, const void* buf, size_t len);
bool writeBufToFile(const char* filename, const void* buf, size_t len, int open_flags, bool log_errors = true);
bool writeBufToFile(
const char* filename, const void* buf, size_t len, int open_flags, bool log_errors = true);
bool createDirRecursively(const char* dir);
std::string* StrAppend(std::string* str, const char* format, ...)
__attribute__((format(printf, 2, 3)));