#include "krate-builder.h"
-#include <klay/cgroup.h>
-#include <klay/namespace.h>
#include <klay/exception.h>
#include <klay/filesystem.h>
-#include <klay/xml/parser.h>
-#include <klay/xml/document.h>
-#define CGROUP_SUBSYSTEM "krate"
+#define KRATE_UID_MIN 6000
+#define KRATE_UID_MAX 6999
-#define KRATE_UID_MIN 60001
-#define KRATE_UID_MAX 60100
+namespace {
-#define LAZYMOUNT_EXTERN extern
-#define LAZYMOUNT_LIB "/usr/lib/liblazymount.so.0"
-
-std::string buildKrateManifestPath(const std::string& name)
-{
- return "/home/" + name + "/.config/krate/krate.xml";
+static std::string getFlagFilePath(runtime::User &user) {
+ return "/run/user/" + std::to_string(user.getUid()) + "/.container";
}
+} // namespace
+
std::string getKrateName(pam_handle_t* handle)
{
const void* retItem;
return static_cast<const char*>(retItem);
}
-void enterKrate(const std::string& name)
-{
- std::string path = CGROUP_SUBSYSTEM "/" + name;
- pid_t pid = 0;
-
- if (runtime::Cgroup::exist(CGROUP_SUBSYSTEM, path)) {
- auto pids = runtime::Cgroup::getProcessList(CGROUP_SUBSYSTEM, path);
- if (pids.size() > 0) {
- pid = pids[0];
- }
- } else {
- runtime::Cgroup::create(CGROUP_SUBSYSTEM, path);
- }
-
- if (pid == 0) {
- runtime::Cgroup::addProcess(CGROUP_SUBSYSTEM, path, ::getpid());
- runtime::Namespace::unshare(CLONE_NEWNS | CLONE_NEWIPC);
- } else {
- runtime::Namespace::attach(pid);
- }
-}
-
-static int wait_condition(void)
-{
- int r;
- void *h;
-
- int (*wait_mount_user)(void);
-
- r = access(LAZYMOUNT_LIB, F_OK);
- if (r < 0){
- fprintf(stderr, "cannot find lazymount module - No support lazymount\n");
- return 0;
- }
-
- h = dlopen(LAZYMOUNT_LIB, RTLD_LAZY);
- if (!h) {
- fprintf(stderr, "lazymount module dlopen error\n");
- return -1;
- }
-
- do{
- wait_mount_user = (int (*)())dlsym(h, "wait_mount_user");
- if (!wait_mount_user) {
- fprintf(stderr, "dlsym wait_mount_user error\n");
- dlclose(h);
- return -1;
- }
- } while (0);
-
- r = wait_mount_user();
- if (r < 0) {
- fprintf(stderr, "wait_mout_user failed\n");
- dlclose(h);
- return r;
- }
-
- dlclose(h);
- return 0;
-}
-
extern "C" {
-LAZYMOUNT_EXTERN __attribute__((visibility("default")))
-int container_preprocess(char* id) {
- std::cout << "kraterize (UID " << id << ")..." << std::endl << std::flush;
- try {
- runtime::User user(std::stoi(std::string(id)));
-
- enterKrate(user.getName());
-
- if (user.getUid() >= KRATE_UID_MIN && user.getUid() <= KRATE_UID_MAX ) {
- wait_condition();
- }
- } catch (runtime::Exception& e) {
- std::cerr << "krate error : " << e.what() <<std::endl << std::flush;
- return -1;
- }
-
- std::cout << "krate preprocess completed!" << std::endl << std::flush;
- return 0;
-}
-
-LAZYMOUNT_EXTERN __attribute__((visibility("default")))
-int container_postprocess(char* id) {
- try {
- runtime::User user(std::stoi(std::string(id)));
- KrateBuilder builder(user, buildKrateManifestPath(user.getName()));
- builder.mountOwnFilesystem();
- } catch (runtime::Exception& e) {
- std::cerr << "krate error : " << e.what() << std::endl << std::flush;
- return -1;
- }
- std::cout << "krate postprocess completed!" << std::endl << std::flush;
- std::cout << "kraterized!" << std::endl << std::flush;
- return 0;
-}
-
PAM_EXTERN __attribute__((visibility("default")))
int pam_sm_open_session(pam_handle_t* pamh, int flags, int argc, const char* argv[])
{
try {
runtime::User user(getKrateName(pamh));
- enterKrate(user.getName());
+ KrateBuilder builder(user);
+ builder.enterKrate();
- KrateBuilder builder(user, buildKrateManifestPath(user.getName()));
- builder.mountOwnFilesystem();
+ if (user.getUid() >= KRATE_UID_MIN && user.getUid() <= KRATE_UID_MAX ) {
+ runtime::File flag(getFlagFilePath(user));
+ if (!flag.exists())
+ flag.create(0644);
+ }
} catch (runtime::Exception& e) {
::pam_syslog(pamh, LOG_ERR, "%s", e.what());
return PAM_SESSION_ERR;
int pam_sm_close_session(pam_handle_t* pamh, int flags, int argc, const char* argv[])
{
try {
- std::string name = getKrateName(pamh);
- auto pids = runtime::Cgroup::getProcessList(CGROUP_SUBSYSTEM, name);
- if (pids.size() <= 1) {
- std::string path = CGROUP_SUBSYSTEM "/" + name;
- runtime::Cgroup::destroy(CGROUP_SUBSYSTEM, path);
- }
+ runtime::User user(getKrateName(pamh));
+
+ KrateBuilder builder(user);
+ builder.exitKrate();
+
+ runtime::File flag(getFlagFilePath(user));
+ if (flag.exists())
+ flag.remove(false);
} catch (runtime::Exception& e) {
::pam_syslog(pamh, LOG_ERR, "%s", e.what());
return PAM_SESSION_ERR;