sandboxsetup

func AdjustMountOptions ¶

func AdjustMountOptions(conf *config.Config, path string, opts []string) ([]string, error)

AdjustMountOptions adds filesystem-specific gofer mount options.

func ApplyCaps ¶

func ApplyCaps(caps *specs.LinuxCapabilities) error

ApplyCaps applies the capabilities in the spec to the current thread.

Precondition: Must be called with the current OS thread locked (runtime.LockOSThread).

func CallSelfAsNobody ¶

func CallSelfAsNobody(args []string) error

CallSelfAsNobody sets UID and GID to nobody and then execve's itself again.

func CapsFromNames ¶

func CapsFromNames(names []string) ([]capability.Cap, error)

CapsFromNames converts capability string names to capability.Cap values.

func CopyFile ¶

func CopyFile(dst, src string) error

CopyFile copies a file from src to dst.

func ExecProcUmounter ¶

func ExecProcUmounter() (*exec.Cmd, *os.File)

ExecProcUmounter executes a child process that umounts /proc when the returned pipe is closed.

func GetCaps ¶

func GetCaps(which capability.CapType, caps *specs.LinuxCapabilities) []string

GetCaps returns the capability names for the given capability type from the provided LinuxCapabilities spec.

func NewSocket ¶

func NewSocket(ioFD int) *unet.Socket

NewSocket creates a unet.Socket from a file descriptor. It fatally exits if the socket cannot be created.

func PivotRoot ¶

func PivotRoot(root string) error

PivotRoot changes the root filesystem to the given directory using pivot_root(2). The old root is unmounted after the pivot.

func PrepareArgs ¶

func PrepareArgs(subCmdName string, fSet *flag.FlagSet, override map[string]string) []string

PrepareArgs returns the args that can be used to re-execute the current program. It manipulates the flags of the subcommand identified by subCmdName and fSet is the flag.FlagSet of this subcommand. It applies the flags specified by override map. In case of conflict, flag is overridden.

Postcondition: PrepareArgs() takes ownership of override map.

func ResolveMounts ¶

func ResolveMounts(conf *config.Config, mounts []specs.Mount, root string, mountConfs []specutils.GoferMountConf) ([]specs.Mount, error)

ResolveMounts resolves relative paths and symlinks in mount point destinations. It also adjusts mount options based on the underlying filesystem type.

Note: mount points must already be in place for resolution to work. Otherwise, it may follow symlinks to locations that would be overwritten with another mount point and return the wrong location. In short, make sure SetupMounts() has been called before.

func ResolveSymlinks ¶

func ResolveSymlinks(root, rel string) (string, error)

ResolveSymlinks walks 'rel' having 'root' as the root directory. If there are symlinks, they are evaluated relative to 'root' to ensure the end result is the same as if the process was running inside the container.

func SetCapsAndCallSelf ¶

func SetCapsAndCallSelf(args []string, caps *specs.LinuxCapabilities) error

SetCapsAndCallSelf sets capabilities to the current thread and then execve's itself again with the arguments specified in 'args' to restart the process with the desired capabilities.

func SetupDev ¶

func SetupDev(spec *specs.Spec, conf *config.Config, root, procPath string) error

SetupDev mounts devices from the OCI spec into the gofer's /dev directory.

func SetupMounts ¶

func SetupMounts(conf *config.Config, mounts []specs.Mount, root, procPath string, mountConfs []specutils.GoferMountConf, mountOpener MountOpener) (retErr error)

SetupMounts bind-mounts all mounts specified in the spec in their correct location inside root. It resolves relative paths and symlinks, and creates directories as needed.

mountConfs is indexed such that mountConfs[0] is the root filesystem configuration, and mount iteration starts at index 1. mountOpener is called when the gofer process cannot directly access a mount source. It may be nil if all mounts are directly accessible.

func SetupRootFS ¶

func SetupRootFS(spec *specs.Spec, conf *config.Config, mountConfs []specutils.GoferMountConf, devIoFD int, mountOpener MountOpener, containerID string, bundleDir string) error

SetupRootFS prepares the filesystem the gofer will serve to the sandbox. There are some gVisor-specific quirks:

• The gofer runs with minimal capabilities (see runsc/cmd/gofer.go). However, gofer startup requires more capabilities (for example, pivot_root(2) requires CAP_SYS_ADMIN).
• As a result, the gofer sets up the container rootfs, does pivot_root(2), and then re-executes itself while dropping extra capabilities.
• To re-execute itself, it requires access to `/proc/self/exe` after pivot_root(2).

For this reason, we can't just pivot_root(2) into the container rootfs path (i.e. spec.Root.Path), as it would mean bind-mounting host /proc inside spec.Root.Path, which might be a read-only filesystem.

Furthermore, createContainer hooks from the OCI spec need to run before the pivot_root(2) and expect the container rootfs to be prepared at spec.Root.Path with all the bind-mounts in place.

To satisfy all of these requirements, this is the approach we take:

1. We prepare all the bind-mounts in `spec.Root.Path` and execute the createContainer hooks.
2. We create a new tmpfs mount at /proc/fs.
3. We bind-mount host /proc and spec.Root.Path onto /proc/fs/proc and /proc/fs/root, respectively.
4. We then pivot_root(2) into /proc/fs. Now host procfs is accessible via /proc/ and container rootfs is accessible via /root.
5. We re-exec the gofer binary and drop extra capabilities.
6. We unmount the /proc bind mount.
7. We chroot(2) into /root (note that the gofer runs with CAP_SYS_CHROOT).

This function does steps 1-4.

mountConfs must be indexed such that mountConfs[0] is the root filesystem configuration and subsequent entries correspond to spec mounts with mount configs.

func ShouldExposeNvidiaDevice ¶

func ShouldExposeNvidiaDevice(path string) bool

ShouldExposeNvidiaDevice returns true if path refers to an Nvidia device which should be exposed to the container.

Precondition: nvproxy is enabled.

func ShouldExposeTpuDevice ¶

func ShouldExposeTpuDevice(path string) bool

ShouldExposeTpuDevice returns true if path refers to a TPU device which should be exposed to the container.

Precondition: tpuproxy is enabled.

func ShouldExposeVFIODevice ¶

func ShouldExposeVFIODevice(path string) bool

ShouldExposeVFIODevice returns true if path refers to a VFIO device which should be exposed to the container.

func TrimCaps ¶

func TrimCaps(names []string, setter capability.Capabilities) ([]capability.Cap, error)

TrimCaps filters the named capabilities to only those that are currently permitted by the given Capabilities set.

func UmountProc ¶

func UmountProc(syncFD int)

UmountProc writes to syncFD signalling the process started by ExecProcUmounter() to umount /proc.

func WaitForFD ¶

func WaitForFD(fd int, fdName string) error

WaitForFD waits for the other end of a given FD to be closed. The FD is closed unconditionally after that. This should only be called for actual FDs (i.e. fd >= 0).

func WriteMounts ¶

func WriteMounts(mountsFD int, mounts []specs.Mount) error

WriteMounts serializes the given mounts as JSON and writes them to the given file descriptor.