mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Kir Kolyshkin
2a7dcbbb40
When someone is using libcontainer to start and kill containers from a long lived process (i.e. the same process creates and removes the container), initProcess.wait method is used, which has a kludge to work around killing containers that do not have their own PID namespace. The code that checks for own PID namespace is not entirely correct. To be exact, it does not set sharePidns flag when the host/caller PID namespace is implicitly used. As a result, the above mentioned kludge does not work. Fix the issue, add a test case (which fails without the fix). Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
46 lines
1.0 KiB
Go
46 lines
1.0 KiB
Go
//go:build linux
|
|
// +build linux
|
|
|
|
package configs
|
|
|
|
import "golang.org/x/sys/unix"
|
|
|
|
func (n *Namespace) Syscall() int {
|
|
return namespaceInfo[n.Type]
|
|
}
|
|
|
|
var namespaceInfo = map[NamespaceType]int{
|
|
NEWNET: unix.CLONE_NEWNET,
|
|
NEWNS: unix.CLONE_NEWNS,
|
|
NEWUSER: unix.CLONE_NEWUSER,
|
|
NEWIPC: unix.CLONE_NEWIPC,
|
|
NEWUTS: unix.CLONE_NEWUTS,
|
|
NEWPID: unix.CLONE_NEWPID,
|
|
NEWCGROUP: unix.CLONE_NEWCGROUP,
|
|
}
|
|
|
|
// CloneFlags parses the container's Namespaces options to set the correct
|
|
// flags on clone, unshare. This function returns flags only for new namespaces.
|
|
func (n *Namespaces) CloneFlags() uintptr {
|
|
var flag int
|
|
for _, v := range *n {
|
|
if v.Path != "" {
|
|
continue
|
|
}
|
|
flag |= namespaceInfo[v.Type]
|
|
}
|
|
return uintptr(flag)
|
|
}
|
|
|
|
// IsPrivate tells whether the namespace of type t is configured as private
|
|
// (i.e. it exists and is not shared).
|
|
func (n Namespaces) IsPrivate(t NamespaceType) bool {
|
|
for _, v := range n {
|
|
if v.Type == t {
|
|
return v.Path == ""
|
|
}
|
|
}
|
|
// Not found, so implicitly sharing a parent namespace.
|
|
return false
|
|
}
|