Move PID ns to a separate module

diff --git a/Makefile b/Makefile
index 5caf5526950434efca1bcdfb60d790880bebf1ff..841352bdb2acb751763e9b24dc20550ee3db2b45 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -26,7 +26,7 @@ CFLAGS += -O2 -c -std=gnu11 \
 
 LDFLAGS += -Wl,-z,now -Wl,-z,relro -pie -Wl,-z,noexecstack
 
-SRCS = nsjail.c cmdline.c contain.c log.c mount.c net.c sandbox.c subproc.c user.c util.c uts.c seccomp/bpf-helper.c
+SRCS = nsjail.c cmdline.c contain.c log.c mount.c net.c pid.c sandbox.c subproc.c user.c util.c uts.c seccomp/bpf-helper.c
 OBJS = $(SRCS:.c=.o)
 BIN = nsjail
 

diff --git a/contain.c b/contain.c
index 2f26b2dd979f663c34af1252c52cc876c43a1c85..ff56777d8116d792cbae011c8029963fb4d0cf54 100644 (file)
--- a/contain.c
+++ b/contain.c
@@ -45,9 +45,15 @@
 #include "log.h"
 #include "mount.h"
 #include "net.h"
+#include "pid.h"
 #include "util.h"
 #include "uts.h"
 
+static bool containInitPidNs(struct nsjconf_t *nsjconf)
+{
+       return pidInitNs(nsjconf);
+}
+
 static bool containInitNetNs(struct nsjconf_t *nsjconf)
 {
        return netInitNsFromChild(nsjconf);
@@ -282,6 +288,9 @@ bool containSetupFD(struct nsjconf_t * nsjconf, int fd_in, int fd_out, int fd_er
 
 bool containContain(struct nsjconf_t * nsjconf)
 {
+       if (containInitPidNs(nsjconf) == false) {
+               return false;
+       }
        if (containInitMountNs(nsjconf) == false) {
                return false;
        }

diff --git a/pid.c b/pid.c
new file mode 100644 (file)
index 0000000..26f5d8d
--- /dev/null
+++ b/pid.c
@@ -0,0 +1,52 @@
+/*
+
+   nsjail - CLONE_PID routines
+   -----------------------------------------
+
+   Copyright 2014 Google Inc. All Rights Reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+*/
+
+#include "pid.h"
+
+#include <signal.h>
+#include <sched.h>
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+
+#include "log.h"
+
+bool pidInitNs(struct nsjconf_t * nsjconf)
+{
+       if (nsjconf->mode != MODE_STANDALONE_EXECVE) {
+               return true;
+       }
+
+       pid_t pid = syscall(__NR_clone, (uintptr_t) CLONE_FS, NULL, NULL, NULL, (uintptr_t) 0);
+       if (pid == -1) {
+               LOG_E("Couldn't create a dummy init process");
+               return false;
+       }
+       if (pid > 0) {
+               return true;
+       }
+       if (prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0) == -1) {
+               LOG_W("(prctl(PR_SET_PDEATHSIG, SIGKILL) failed");
+       }
+       for (;;) {
+               pause();
+       }
+}

diff --git a/pid.h b/pid.h
new file mode 100644 (file)
index 0000000..8943a64
--- /dev/null
+++ b/pid.h
@@ -0,0 +1,31 @@
+/*
+
+   nsjail - CLONE_PID routines
+   -----------------------------------------
+
+   Copyright 2014 Google Inc. All Rights Reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+*/
+
+#ifndef NS_PID_H
+#define NS_PID_H
+
+#include <stdbool.h>
+
+#include "common.h"
+
+bool pidInitNs(struct nsjconf_t *nsjconf);
+
+#endif                         /* NS_PID_H */

diff --git a/subproc.c b/subproc.c
index 57d20e6c39e6a85854389530f9f2508de39139be..20a86b6850c502ea782aedd6d38dda4f1e611970 100644 (file)
--- a/subproc.c
+++ b/subproc.c
@@ -278,23 +278,6 @@ static bool subprocInitParent(struct nsjconf_t *nsjconf, pid_t pid, int pipefd)
        return true;
 }
 
-void subprocDummyInit()
-{
-       pid_t pid = syscall(__NR_clone, (uintptr_t) CLONE_FS, NULL, NULL, NULL, (uintptr_t) 0);
-       if (pid == -1) {
-               LOG_F("Couldn't create a dummy init process");
-       }
-       if (pid > 0) {
-               return;
-       }
-       if (prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0) == -1) {
-               LOG_W("(prctl(PR_SET_PDEATHSIG, SIGKILL) failed");
-       }
-       for (;;) {
-               pause();
-       }
-}
-
 void subprocRunChild(struct nsjconf_t *nsjconf, int fd_in, int fd_out, int fd_err)
 {
        if (netLimitConns(nsjconf, fd_in) == false) {
@@ -315,11 +298,6 @@ void subprocRunChild(struct nsjconf_t *nsjconf, int fd_in, int fd_out, int fd_er
                        PLOG_E("unshare(%#lx)", flags);
                        _exit(EXIT_FAILURE);
                }
-               if (nsjconf->clone_newpid) {
-                       LOG_D
-                           ("CLONE_NEWPID requested. We must create a dummy init process, to avoid ENOMEM with clone/fork/vfork");
-                       subprocDummyInit();
-               }
                subprocNewProc(nsjconf, fd_in, fd_out, fd_err, -1);
        }