Skip to content

cmd/containerd-shim: require unix socket credentials#1849

Merged
AkihiroSuda merged 1 commit intocontainerd:masterfrom
stevvooe:unix-socket-credentials
Dec 1, 2017
Merged

cmd/containerd-shim: require unix socket credentials#1849
AkihiroSuda merged 1 commit intocontainerd:masterfrom
stevvooe:unix-socket-credentials

Conversation

@stevvooe
Copy link
Copy Markdown
Member

@stevvooe stevvooe commented Dec 1, 2017

Signed-off-by: Stephen J Day [email protected]

@stevvooe stevvooe added this to the 1.0.0 milestone Dec 1, 2017
@crosbymichael
Copy link
Copy Markdown
Member

LGTM

Copy link
Copy Markdown
Contributor

@mlaventure mlaventure left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, looks like staticcheck is confused by go tip though, let's restart it to see if it was a fluke

@stevvooe
Copy link
Copy Markdown
Member Author

stevvooe commented Dec 1, 2017

@mlaventure There is a problem with the darwin build. It gets folded into "unix", but doesn't implement unix.Ucred, unix.GetsockoptUcred and unix.SO_PEERCRED. Pushing a fix to exclude these from the "darwin shim", which isn't really supported, but we build anyways.

Fixing now.

@stevvooe stevvooe force-pushed the unix-socket-credentials branch from 6cb98c0 to ce48514 Compare December 1, 2017 01:40
@AkihiroSuda
Copy link
Copy Markdown
Member

user.Current segfaults when statically build, due to a glibc issue that won't be fixed: moby/moby#29478

So I suggest using getuid syscall.

@mlaventure
Copy link
Copy Markdown
Contributor

Oh, that's a nasty one 😱

@AkihiroSuda
Copy link
Copy Markdown
Member

p.s. As described in golang/go#13470 (comment), the segfault issue does not happen when only single goroutine is running.
So the issue might not be critical for our shim, but we should not rely on the number of goroutines, I think.

@stevvooe
Copy link
Copy Markdown
Member Author

stevvooe commented Dec 1, 2017

user.Current segfaults when statically build, due to a glibc issue that won't be fixed

Seems to run just fine. What version is affected? I am running glibc 2.24 locally but it seems 2.21 is affected.

Tried the example in golang/go#13470. The compiler seems to complain:

$ gcc -static -pthread -o cboom f.c
/tmp/ccZURPLs.o: In function `thread':
f.c:(.text+0x53): warning: Using 'getpwuid_r' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking

While that is a warning and not a compile error is insane. How can this be called statically linked if it requires the shared library? Madness.

@stevvooe
Copy link
Copy Markdown
Member Author

stevvooe commented Dec 1, 2017

Filed containerd/ttrpc#13.

@stevvooe stevvooe force-pushed the unix-socket-credentials branch from ce48514 to 2d966df Compare December 1, 2017 04:34
@stevvooe
Copy link
Copy Markdown
Member Author

stevvooe commented Dec 1, 2017

Updated, PTAL.

@AkihiroSuda
Copy link
Copy Markdown
Member

opened containerd/ttrpc#14

@codecov-io
Copy link
Copy Markdown

Codecov Report

Merging #1849 into master will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master    #1849   +/-   ##
=======================================
  Coverage   49.13%   49.13%           
=======================================
  Files          86       86           
  Lines        8245     8245           
=======================================
  Hits         4051     4051           
  Misses       3524     3524           
  Partials      670      670
Flag Coverage Δ
#linux 52.53% <ø> (ø) ⬆️
#windows 44.25% <ø> (ø) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update efe9e28...2d966df. Read the comment docs.

@AkihiroSuda AkihiroSuda merged commit c9c36d4 into containerd:master Dec 1, 2017
@stevvooe
Copy link
Copy Markdown
Member Author

stevvooe commented Dec 1, 2017

Filed golang/go#22953

@stevvooe stevvooe deleted the unix-socket-credentials branch December 1, 2017 05:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants