diff --git a/Makefile.am b/Makefile.am index 2198d7fb54..6905f5fa2e 100644 --- a/Makefile.am +++ b/Makefile.am @@ -69,6 +69,7 @@ libcrun_SOURCES = src/libcrun/utils.c \ src/libcrun/seccomp.c \ src/libcrun/seccomp_notify.c \ src/libcrun/signals.c \ + src/libcrun/spec.c \ src/libcrun/status.c \ src/libcrun/net_device.c \ src/libcrun/terminal.c @@ -181,7 +182,7 @@ EXTRA_DIST = COPYING COPYING.libcrun README.md NEWS SECURITY.md rpm/crun.spec au src/libcrun/linux.h src/libcrun/utils.h src/libcrun/error.h src/libcrun/criu.h \ src/libcrun/scheduler.h src/libcrun/mempolicy.h src/libcrun/status.h src/libcrun/terminal.h \ src/libcrun/mount_flags.h src/libcrun/intelrdt.h src/libcrun/ring_buffer.h src/libcrun/string_map.h \ - src/libcrun/net_device.h \ + src/libcrun/net_device.h src/libcrun/spec.h \ src/libcrun/syscalls.h \ crun.1.md crun.1 libcrun.lds \ krun.1.md krun.1 \ diff --git a/src/libcrun/container.c b/src/libcrun/container.c index 98c1b7f42e..84e308d8b8 100644 --- a/src/libcrun/container.c +++ b/src/libcrun/container.c @@ -182,200 +182,6 @@ static char *mempolicy_flags[] = { "MPOL_F_STATIC_NODES" }; -static const char spec_file[] = "\ -{\n\ - \"ociVersion\": \"1.0.0\",\n\ - \"process\": {\n\ - \"terminal\": true,\n\ - \"user\": {\n\ - \"uid\": 0,\n\ - \"gid\": 0\n\ - },\n\ - \"args\": [\n\ - \"sh\"\n\ - ],\n\ - \"env\": [\n\ - \"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\",\n\ - \"TERM=xterm\"\n\ - ],\n\ - \"cwd\": \"/\",\n\ - \"capabilities\": {\n\ - \"bounding\": [\n\ - \"CAP_AUDIT_WRITE\",\n\ - \"CAP_KILL\",\n\ - \"CAP_NET_BIND_SERVICE\"\n\ - ],\n\ - \"effective\": [\n\ - \"CAP_AUDIT_WRITE\",\n\ - \"CAP_KILL\",\n\ - \"CAP_NET_BIND_SERVICE\"\n\ - ],\n\ - \"inheritable\": [\n\ - ],\n\ - \"permitted\": [\n\ - \"CAP_AUDIT_WRITE\",\n\ - \"CAP_KILL\",\n\ - \"CAP_NET_BIND_SERVICE\"\n\ - ],\n\ - \"ambient\": [\n\ - \"CAP_AUDIT_WRITE\",\n\ - \"CAP_KILL\",\n\ - \"CAP_NET_BIND_SERVICE\"\n\ - ]\n\ - },\n\ - \"rlimits\": [\n\ - {\n\ - \"type\": \"RLIMIT_NOFILE\",\n\ - \"hard\": 1024,\n\ - \"soft\": 1024\n\ - }\n\ - ],\n\ - \"noNewPrivileges\": true\n\ - },\n\ - \"root\": {\n\ - \"path\": \"rootfs\",\n\ - \"readonly\": true\n\ - },\n\ - \"hostname\": \"crun\",\n\ - \"mounts\": [\n\ - {\n\ - \"destination\": \"/proc\",\n\ - \"type\": \"proc\",\n\ - \"source\": \"proc\"\n\ - },\n\ - {\n\ - \"destination\": \"/dev\",\n\ - \"type\": \"tmpfs\",\n\ - \"source\": \"tmpfs\",\n\ - \"options\": [\n\ - \"nosuid\",\n\ - \"strictatime\",\n\ - \"mode=755\",\n\ - \"size=65536k\"\n\ - ]\n\ - },\n\ - {\n\ - \"destination\": \"/dev/pts\",\n\ - \"type\": \"devpts\",\n\ - \"source\": \"devpts\",\n\ - \"options\": [\n\ - \"nosuid\",\n\ - \"noexec\",\n\ - \"newinstance\",\n\ - \"ptmxmode=0666\",\n\ - \"mode=0620\"\ -%s\ - ]\n\ - },\n\ - {\n\ - \"destination\": \"/dev/shm\",\n\ - \"type\": \"tmpfs\",\n\ - \"source\": \"shm\",\n\ - \"options\": [\n\ - \"nosuid\",\n\ - \"noexec\",\n\ - \"nodev\",\n\ - \"mode=1777\",\n\ - \"size=65536k\"\n\ - ]\n\ - },\n\ - {\n\ - \"destination\": \"/dev/mqueue\",\n\ - \"type\": \"mqueue\",\n\ - \"source\": \"mqueue\",\n\ - \"options\": [\n\ - \"nosuid\",\n\ - \"noexec\",\n\ - \"nodev\"\n\ - ]\n\ - },\n\ - {\n\ - \"destination\": \"/sys\",\n\ - \"type\": \"sysfs\",\n\ - \"source\": \"sysfs\",\n\ - \"options\": [\n\ - \"nosuid\",\n\ - \"noexec\",\n\ - \"nodev\",\n\ - \"ro\"\n\ - ]\n\ - },\n\ - {\n\ - \"destination\": \"/sys/fs/cgroup\",\n\ - \"type\": \"cgroup\",\n\ - \"source\": \"cgroup\",\n\ - \"options\": [\n\ - \"nosuid\",\n\ - \"noexec\",\n\ - \"nodev\",\n\ - \"relatime\",\n\ - \"ro\"\n\ - ]\n\ - }\n\ - ],\n\ - \"linux\": {\n\ - \"resources\": {\n\ - \"devices\": [\n\ - {\n\ - \"allow\": false,\n\ - \"access\": \"rwm\"\n\ - }\n\ - ]\n\ - },\n\ - \"namespaces\": [\n\ - {\n\ - \"type\": \"pid\"\n\ - },\n\ - {\n\ - \"type\": \"network\"\n\ - },\n\ - {\n\ - \"type\": \"ipc\"\n\ - },\n\ - {\n\ - \"type\": \"uts\"\n\ - },\n\ -%s\ -%s\ - {\n\ - \"type\": \"mount\"\n\ - }\n\ - ],\n\ - \"maskedPaths\": [\n\ - \"/proc/acpi\",\n\ - \"/proc/asound\",\n\ - \"/proc/kcore\",\n\ - \"/proc/keys\",\n\ - \"/proc/latency_stats\",\n\ - \"/proc/timer_list\",\n\ - \"/proc/timer_stats\",\n\ - \"/proc/sched_debug\",\n\ - \"/sys/firmware\",\n\ - \"/proc/scsi\"\n\ - ],\n\ - \"readonlyPaths\": [\n\ - \"/proc/bus\",\n\ - \"/proc/fs\",\n\ - \"/proc/irq\",\n\ - \"/proc/sys\",\n\ - \"/proc/sysrq-trigger\"\n\ - ]\n\ - }\n\ -}\n"; - -static const char *spec_pts_tty_group = ",\n\ - \"gid=5\"\n"; - -static const char *spec_user = "\ - {\n\ - \"type\": \"user\"\n\ - },\n"; - -static const char *spec_cgroupns = "\ - {\n\ - \"type\": \"cgroup\"\n\ - },\n"; - static char *potentially_unsafe_annotations[] = { "module.wasm.image/variant", "io.kubernetes.cri.container-type", @@ -4498,26 +4304,6 @@ libcrun_container_get_features (libcrun_context_t *context, struct features_info return 0; } -int -libcrun_container_spec (bool root, FILE *out, libcrun_error_t *err) -{ - int ret; - int cgroup_mode; - - cgroup_mode = libcrun_get_cgroup_mode (err); - if (UNLIKELY (cgroup_mode < 0)) - return cgroup_mode; - - ret = fprintf (out, spec_file, - root ? spec_pts_tty_group : "\n", - root ? "" : spec_user, - cgroup_mode == CGROUP_MODE_UNIFIED ? spec_cgroupns : ""); - if (UNLIKELY (ret < 0)) - return crun_make_error (err, errno, "fprintf failed"); - - return ret; -} - int libcrun_container_pause (libcrun_context_t *context, const char *id, libcrun_error_t *err) { diff --git a/src/libcrun/container.h b/src/libcrun/container.h index f0d9a463db..e1ea6151c3 100644 --- a/src/libcrun/container.h +++ b/src/libcrun/container.h @@ -298,8 +298,6 @@ LIBCRUN_PUBLIC int libcrun_container_update_intel_rdt (libcrun_context_t *contex LIBCRUN_PUBLIC int libcrun_container_get_features (libcrun_context_t *context, struct features_info_s **info, libcrun_error_t *err); -LIBCRUN_PUBLIC int libcrun_container_spec (bool root, FILE *out, libcrun_error_t *err); - LIBCRUN_PUBLIC int libcrun_container_pause (libcrun_context_t *context, const char *id, libcrun_error_t *err); LIBCRUN_PUBLIC int libcrun_container_unpause (libcrun_context_t *context, const char *id, libcrun_error_t *err); diff --git a/src/libcrun/spec.c b/src/libcrun/spec.c new file mode 100644 index 0000000000..5511ad5efb --- /dev/null +++ b/src/libcrun/spec.c @@ -0,0 +1,241 @@ +/* + * crun - OCI runtime written in C + * + * Copyright (C) 2017, 2018, 2019, 2020 Giuseppe Scrivano + * crun is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * crun is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with crun. If not, see . + */ +#define _GNU_SOURCE + +#include +#include +#include +#include +#include "spec.h" +#include "utils.h" +#include "cgroup.h" +#include "cgroup-utils.h" + +static const char spec_file[] = "\ +{\n\ + \"ociVersion\": \"1.0.0\",\n\ + \"process\": {\n\ + \"terminal\": true,\n\ + \"user\": {\n\ + \"uid\": 0,\n\ + \"gid\": 0\n\ + },\n\ + \"args\": [\n\ + \"sh\"\n\ + ],\n\ + \"env\": [\n\ + \"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\",\n\ + \"TERM=xterm\"\n\ + ],\n\ + \"cwd\": \"/\",\n\ + \"capabilities\": {\n\ + \"bounding\": [\n\ + \"CAP_AUDIT_WRITE\",\n\ + \"CAP_KILL\",\n\ + \"CAP_NET_BIND_SERVICE\"\n\ + ],\n\ + \"effective\": [\n\ + \"CAP_AUDIT_WRITE\",\n\ + \"CAP_KILL\",\n\ + \"CAP_NET_BIND_SERVICE\"\n\ + ],\n\ + \"inheritable\": [\n\ + ],\n\ + \"permitted\": [\n\ + \"CAP_AUDIT_WRITE\",\n\ + \"CAP_KILL\",\n\ + \"CAP_NET_BIND_SERVICE\"\n\ + ],\n\ + \"ambient\": [\n\ + \"CAP_AUDIT_WRITE\",\n\ + \"CAP_KILL\",\n\ + \"CAP_NET_BIND_SERVICE\"\n\ + ]\n\ + },\n\ + \"rlimits\": [\n\ + {\n\ + \"type\": \"RLIMIT_NOFILE\",\n\ + \"hard\": 1024,\n\ + \"soft\": 1024\n\ + }\n\ + ],\n\ + \"noNewPrivileges\": true\n\ + },\n\ + \"root\": {\n\ + \"path\": \"rootfs\",\n\ + \"readonly\": true\n\ + },\n\ + \"hostname\": \"crun\",\n\ + \"mounts\": [\n\ + {\n\ + \"destination\": \"/proc\",\n\ + \"type\": \"proc\",\n\ + \"source\": \"proc\"\n\ + },\n\ + {\n\ + \"destination\": \"/dev\",\n\ + \"type\": \"tmpfs\",\n\ + \"source\": \"tmpfs\",\n\ + \"options\": [\n\ + \"nosuid\",\n\ + \"strictatime\",\n\ + \"mode=755\",\n\ + \"size=65536k\"\n\ + ]\n\ + },\n\ + {\n\ + \"destination\": \"/dev/pts\",\n\ + \"type\": \"devpts\",\n\ + \"source\": \"devpts\",\n\ + \"options\": [\n\ + \"nosuid\",\n\ + \"noexec\",\n\ + \"newinstance\",\n\ + \"ptmxmode=0666\",\n\ + \"mode=0620\"\ +%s\ + ]\n\ + },\n\ + {\n\ + \"destination\": \"/dev/shm\",\n\ + \"type\": \"tmpfs\",\n\ + \"source\": \"shm\",\n\ + \"options\": [\n\ + \"nosuid\",\n\ + \"noexec\",\n\ + \"nodev\",\n\ + \"mode=1777\",\n\ + \"size=65536k\"\n\ + ]\n\ + },\n\ + {\n\ + \"destination\": \"/dev/mqueue\",\n\ + \"type\": \"mqueue\",\n\ + \"source\": \"mqueue\",\n\ + \"options\": [\n\ + \"nosuid\",\n\ + \"noexec\",\n\ + \"nodev\"\n\ + ]\n\ + },\n\ + {\n\ + \"destination\": \"/sys\",\n\ + \"type\": \"sysfs\",\n\ + \"source\": \"sysfs\",\n\ + \"options\": [\n\ + \"nosuid\",\n\ + \"noexec\",\n\ + \"nodev\",\n\ + \"ro\"\n\ + ]\n\ + },\n\ + {\n\ + \"destination\": \"/sys/fs/cgroup\",\n\ + \"type\": \"cgroup\",\n\ + \"source\": \"cgroup\",\n\ + \"options\": [\n\ + \"nosuid\",\n\ + \"noexec\",\n\ + \"nodev\",\n\ + \"relatime\",\n\ + \"ro\"\n\ + ]\n\ + }\n\ + ],\n\ + \"linux\": {\n\ + \"resources\": {\n\ + \"devices\": [\n\ + {\n\ + \"allow\": false,\n\ + \"access\": \"rwm\"\n\ + }\n\ + ]\n\ + },\n\ + \"namespaces\": [\n\ + {\n\ + \"type\": \"pid\"\n\ + },\n\ + {\n\ + \"type\": \"network\"\n\ + },\n\ + {\n\ + \"type\": \"ipc\"\n\ + },\n\ + {\n\ + \"type\": \"uts\"\n\ + },\n\ +%s\ +%s\ + {\n\ + \"type\": \"mount\"\n\ + }\n\ + ],\n\ + \"maskedPaths\": [\n\ + \"/proc/acpi\",\n\ + \"/proc/asound\",\n\ + \"/proc/kcore\",\n\ + \"/proc/keys\",\n\ + \"/proc/latency_stats\",\n\ + \"/proc/timer_list\",\n\ + \"/proc/timer_stats\",\n\ + \"/proc/sched_debug\",\n\ + \"/sys/firmware\",\n\ + \"/proc/scsi\"\n\ + ],\n\ + \"readonlyPaths\": [\n\ + \"/proc/bus\",\n\ + \"/proc/fs\",\n\ + \"/proc/irq\",\n\ + \"/proc/sys\",\n\ + \"/proc/sysrq-trigger\"\n\ + ]\n\ + }\n\ +}\n"; + +static const char *spec_pts_tty_group = ",\n\ + \"gid=5\"\n"; + +static const char *spec_user = "\ + {\n\ + \"type\": \"user\"\n\ + },\n"; + +static const char *spec_cgroupns = "\ + {\n\ + \"type\": \"cgroup\"\n\ + },\n"; + +int +libcrun_container_spec (bool root, FILE *out, libcrun_error_t *err) +{ + int ret; + int cgroup_mode; + + cgroup_mode = libcrun_get_cgroup_mode (err); + if (UNLIKELY (cgroup_mode < 0)) + return cgroup_mode; + + ret = fprintf (out, spec_file, + root ? spec_pts_tty_group : "\n", + root ? "" : spec_user, + cgroup_mode == CGROUP_MODE_UNIFIED ? spec_cgroupns : ""); + if (UNLIKELY (ret < 0)) + return crun_make_error (err, errno, "fprintf failed"); + + return ret; +} diff --git a/src/libcrun/spec.h b/src/libcrun/spec.h new file mode 100644 index 0000000000..a67a79f571 --- /dev/null +++ b/src/libcrun/spec.h @@ -0,0 +1,28 @@ +/* + * crun - OCI runtime written in C + * + * Copyright (C) 2017, 2018, 2019, 2020 Giuseppe Scrivano + * crun is free software; you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation; either version 2.1 of the License, or + * (at your option) any later version. + * + * crun is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with crun. If not, see . + */ +#ifndef SPEC_H +#define SPEC_H + +#include +#include +#include +#include "error.h" + +LIBCRUN_PUBLIC int libcrun_container_spec (bool root, FILE *out, libcrun_error_t *err); + +#endif diff --git a/src/spec.c b/src/spec.c index 3d8c9c9cee..c3b813f451 100644 --- a/src/spec.c +++ b/src/spec.c @@ -26,6 +26,7 @@ #include "crun.h" #include "libcrun/container.h" +#include "libcrun/spec.h" #include "libcrun/utils.h" static char doc[] = "OCI runtime";