12df56b9f1
This commit adds extra setup when cgroupsv2 is enabled. In particular, we make sure that the root namespace has setup cgroup.subtree_control with the controllers we need. If the necessary controller are not listed, we have to move all processes out of the root namespace before we can change this (the 'no internal processes' rule: https://unix.stackexchange.com/a/713343). Currently we only handle the case where the nsjail process is the only process in the cgroup. It seems like this would be relatively rare, but since nsjail is frequently the root process in a Docker container (e.g. for hosting CTF challenges), I think this case is common enough to make it worth implementing. This also adds `--detect_cgroupv2`, which will attempt to detect whether `--cgroupv2_mount` is a valid cgroupv2 mount, and if so it will set `use_cgroupv2`. This is useful in containerized environments where you may not know the kernel version ahead of time. References: https://github.com/redpwn/jail/blob/master/internal/cgroup/cgroup2.go
66 lines
2.0 KiB
C++
66 lines
2.0 KiB
C++
/*
|
|
|
|
nsjail - useful procedures
|
|
-----------------------------------------
|
|
|
|
Copyright 2016 Google Inc. All Rights Reserved.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
|
|
*/
|
|
|
|
#ifndef NS_UTIL_H
|
|
#define NS_UTIL_H
|
|
|
|
#include <inttypes.h>
|
|
#include <stdbool.h>
|
|
#include <stdint.h>
|
|
#include <stdlib.h>
|
|
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
#include "nsjail.h"
|
|
|
|
#define RETURN_ON_FAILURE(expr) \
|
|
do { \
|
|
if (!(expr)) { \
|
|
return false; \
|
|
} \
|
|
} while (0)
|
|
|
|
#define QC(x) util::StrQuote(x).c_str()
|
|
|
|
namespace util {
|
|
|
|
ssize_t readFromFd(int fd, void* buf, size_t len);
|
|
ssize_t readFromFile(const char* fname, void* buf, size_t len);
|
|
bool writeToFd(int fd, const void* buf, size_t len);
|
|
bool writeBufToFile(const char* filename, const void* buf, size_t len, int open_flags, bool log_errors = true);
|
|
bool createDirRecursively(const char* dir);
|
|
std::string* StrAppend(std::string* str, const char* format, ...)
|
|
__attribute__((format(printf, 2, 3)));
|
|
std::string StrPrintf(const char* format, ...) __attribute__((format(printf, 1, 2)));
|
|
const std::string StrQuote(const std::string& str);
|
|
bool isANumber(const char* s);
|
|
uint64_t rnd64(void);
|
|
const std::string sigName(int signo);
|
|
const std::string timeToStr(time_t t);
|
|
std::vector<std::string> strSplit(const std::string str, char delim);
|
|
long syscall(long sysno, uintptr_t a0 = 0, uintptr_t a1 = 0, uintptr_t a2 = 0, uintptr_t a3 = 0,
|
|
uintptr_t a4 = 0, uintptr_t a5 = 0);
|
|
|
|
} // namespace util
|
|
|
|
#endif /* NS_UTIL_H */
|