Skip to content

Commit 88241b9

Browse files
cpuguy83cpuguy83
authored
Merge pull request #41108 from thaJeztah/containerd_userns
use containerd/sys to detect UserNamespaces
2 parents aaf470e + 66bb1c4 commit 88241b9

15 files changed

Lines changed: 33 additions & 33 deletions

File tree

‎daemon/daemon.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ import (
2727
"github.com/containerd/containerd/defaults"
2828
"github.com/containerd/containerd/pkg/dialer"
2929
"github.com/containerd/containerd/remotes/docker"
30+
"github.com/containerd/containerd/sys"
3031
"github.com/docker/docker/api/types"
3132
containertypes "github.com/docker/docker/api/types/container"
3233
"github.com/docker/docker/api/types/swarm"
@@ -42,7 +43,6 @@ import (
4243
"github.com/docker/docker/errdefs"
4344
bkconfig "github.com/moby/buildkit/cmd/buildkitd/config"
4445
"github.com/moby/buildkit/util/resolver"
45-
rsystem "github.com/opencontainers/runc/libcontainer/system"
4646
"github.com/sirupsen/logrus"
4747

4848
// register graph drivers
@@ -1040,7 +1040,7 @@ func NewDaemon(ctx context.Context, config *config.Config, pluginStore *plugin.S
10401040
sysInfo := d.RawSysInfo(false)
10411041
// Check if Devices cgroup is mounted, it is hard requirement for container security,
10421042
// on Linux.
1043-
if runtime.GOOS == "linux" && !sysInfo.CgroupDevicesEnabled && !rsystem.RunningInUserNS() {
1043+
if runtime.GOOS == "linux" && !sysInfo.CgroupDevicesEnabled && !sys.RunningInUserNS() {
10441044
return nil, errors.New("Devices cgroup isn't mounted")
10451045
}
10461046

‎daemon/daemon_unix.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818

1919
statsV1 "github.com/containerd/cgroups/stats/v1"
2020
statsV2 "github.com/containerd/cgroups/v2/stats"
21+
"github.com/containerd/containerd/sys"
2122
"github.com/docker/docker/api/types"
2223
"github.com/docker/docker/api/types/blkiodev"
2324
pblkiodev "github.com/docker/docker/api/types/blkiodev"
@@ -44,7 +45,6 @@ import (
4445
lntypes "github.com/docker/libnetwork/types"
4546
"github.com/moby/sys/mount"
4647
"github.com/opencontainers/runc/libcontainer/cgroups"
47-
rsystem "github.com/opencontainers/runc/libcontainer/system"
4848
specs "github.com/opencontainers/runtime-spec/specs-go"
4949
"github.com/opencontainers/selinux/go-selinux/label"
5050
"github.com/pkg/errors"
@@ -1668,7 +1668,7 @@ func setMayDetachMounts() error {
16681668
// Setting may_detach_mounts does not work in an
16691669
// unprivileged container. Ignore the error, but log
16701670
// it if we appear not to be in that situation.
1671-
if !rsystem.RunningInUserNS() {
1671+
if !sys.RunningInUserNS() {
16721672
logrus.Debugf("Permission denied writing %q to /proc/sys/fs/may_detach_mounts", "1")
16731673
}
16741674
return nil
@@ -1688,7 +1688,7 @@ func setupOOMScoreAdj(score int) error {
16881688
// Setting oom_score_adj does not work in an
16891689
// unprivileged container. Ignore the error, but log
16901690
// it if we appear not to be in that situation.
1691-
if !rsystem.RunningInUserNS() {
1691+
if !sys.RunningInUserNS() {
16921692
logrus.Debugf("Permission denied writing %q to /proc/self/oom_score_adj", stringScore)
16931693
}
16941694
return nil

‎daemon/graphdriver/aufs/aufs.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ import (
3535
"strings"
3636
"sync"
3737

38+
"github.com/containerd/containerd/sys"
3839
"github.com/docker/docker/daemon/graphdriver"
3940
"github.com/docker/docker/pkg/archive"
4041
"github.com/docker/docker/pkg/chrootarchive"
@@ -44,7 +45,6 @@ import (
4445
"github.com/docker/docker/pkg/locker"
4546
"github.com/docker/docker/pkg/system"
4647
"github.com/moby/sys/mount"
47-
rsystem "github.com/opencontainers/runc/libcontainer/system"
4848
"github.com/opencontainers/selinux/go-selinux/label"
4949
"github.com/pkg/errors"
5050
"github.com/sirupsen/logrus"
@@ -177,7 +177,7 @@ func supportsAufs() error {
177177
// proc/filesystems for when aufs is supported
178178
exec.Command("modprobe", "aufs").Run()
179179

180-
if rsystem.RunningInUserNS() {
180+
if sys.RunningInUserNS() {
181181
return ErrAufsNested
182182
}
183183

‎daemon/graphdriver/copy/copy.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ import (
1111
"syscall"
1212
"time"
1313

14+
"github.com/containerd/containerd/sys"
1415
"github.com/docker/docker/pkg/pools"
1516
"github.com/docker/docker/pkg/system"
16-
rsystem "github.com/opencontainers/runc/libcontainer/system"
1717
"golang.org/x/sys/unix"
1818
)
1919

@@ -184,7 +184,7 @@ func DirCopy(srcDir, dstDir string, copyMode Mode, copyXattrs bool) error {
184184
}
185185

186186
case mode&os.ModeDevice != 0:
187-
if rsystem.RunningInUserNS() {
187+
if sys.RunningInUserNS() {
188188
// cannot create a device if running in user namespace
189189
return nil
190190
}

‎daemon/graphdriver/fuse-overlayfs/fuseoverlayfs.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"path/filepath"
1515
"strings"
1616

17+
"github.com/containerd/containerd/sys"
1718
"github.com/docker/docker/daemon/graphdriver"
1819
"github.com/docker/docker/daemon/graphdriver/overlayutils"
1920
"github.com/docker/docker/pkg/archive"
@@ -25,7 +26,6 @@ import (
2526
"github.com/docker/docker/pkg/parsers/kernel"
2627
"github.com/docker/docker/pkg/system"
2728
"github.com/moby/sys/mount"
28-
rsystem "github.com/opencontainers/runc/libcontainer/system"
2929
"github.com/opencontainers/selinux/go-selinux/label"
3030
"github.com/pkg/errors"
3131
"github.com/sirupsen/logrus"
@@ -475,7 +475,7 @@ func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64
475475
GIDMaps: d.gidMaps,
476476
// Use AUFS whiteout format: https://github.com/containers/storage/blob/39a8d5ed9843844eafb5d2ba6e6a7510e0126f40/drivers/overlay/overlay.go#L1084-L1089
477477
WhiteoutFormat: archive.AUFSWhiteoutFormat,
478-
InUserNS: rsystem.RunningInUserNS(),
478+
InUserNS: sys.RunningInUserNS(),
479479
}); err != nil {
480480
return 0, err
481481
}

‎daemon/graphdriver/overlay2/overlay.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ import (
1515
"strings"
1616
"sync"
1717

18+
"github.com/containerd/containerd/sys"
1819
"github.com/docker/docker/daemon/graphdriver"
1920
"github.com/docker/docker/daemon/graphdriver/overlayutils"
2021
"github.com/docker/docker/daemon/graphdriver/quota"
@@ -29,7 +30,6 @@ import (
2930
"github.com/docker/docker/pkg/system"
3031
units "github.com/docker/go-units"
3132
"github.com/moby/sys/mount"
32-
rsystem "github.com/opencontainers/runc/libcontainer/system"
3333
"github.com/opencontainers/selinux/go-selinux/label"
3434
"github.com/sirupsen/logrus"
3535
"golang.org/x/sys/unix"
@@ -683,7 +683,7 @@ func (d *Driver) ApplyDiff(id string, parent string, diff io.Reader) (size int64
683683
UIDMaps: d.uidMaps,
684684
GIDMaps: d.gidMaps,
685685
WhiteoutFormat: archive.OverlayWhiteoutFormat,
686-
InUserNS: rsystem.RunningInUserNS(),
686+
InUserNS: sys.RunningInUserNS(),
687687
}); err != nil {
688688
return 0, err
689689
}

‎daemon/graphdriver/quota/projectquota.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ import (
5757
"path/filepath"
5858
"unsafe"
5959

60-
rsystem "github.com/opencontainers/runc/libcontainer/system"
60+
"github.com/containerd/containerd/sys"
6161
"github.com/pkg/errors"
6262
"github.com/sirupsen/logrus"
6363
"golang.org/x/sys/unix"
@@ -90,7 +90,7 @@ func NewControl(basePath string) (*Control, error) {
9090
// If we are running in a user namespace quota won't be supported for
9191
// now since makeBackingFsDev() will try to mknod().
9292
//
93-
if rsystem.RunningInUserNS() {
93+
if sys.RunningInUserNS() {
9494
return nil, ErrQuotaNotSupported
9595
}
9696

‎daemon/oci_linux.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414

1515
"github.com/containerd/containerd/containers"
1616
coci "github.com/containerd/containerd/oci"
17+
"github.com/containerd/containerd/sys"
1718
containertypes "github.com/docker/docker/api/types/container"
1819
"github.com/docker/docker/container"
1920
daemonconfig "github.com/docker/docker/daemon/config"
@@ -28,7 +29,6 @@ import (
2829
"github.com/opencontainers/runc/libcontainer/apparmor"
2930
"github.com/opencontainers/runc/libcontainer/cgroups"
3031
"github.com/opencontainers/runc/libcontainer/devices"
31-
rsystem "github.com/opencontainers/runc/libcontainer/system"
3232
"github.com/opencontainers/runc/libcontainer/user"
3333
specs "github.com/opencontainers/runtime-spec/specs-go"
3434
"github.com/pkg/errors"
@@ -857,7 +857,7 @@ func WithDevices(daemon *Daemon, c *container.Container) coci.SpecOpts {
857857
var devs []specs.LinuxDevice
858858
devPermissions := s.Linux.Resources.Devices
859859

860-
if c.HostConfig.Privileged && !rsystem.RunningInUserNS() {
860+
if c.HostConfig.Privileged && !sys.RunningInUserNS() {
861861
hostDevices, err := devices.HostDevices()
862862
if err != nil {
863863
return err

‎pkg/archive/archive_linux_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,10 @@ import (
99
"syscall"
1010
"testing"
1111

12+
"github.com/containerd/containerd/sys"
1213
"github.com/docker/docker/pkg/reexec"
1314
"github.com/docker/docker/pkg/system"
1415
"github.com/moby/sys/mount"
15-
rsystem "github.com/opencontainers/runc/libcontainer/system"
1616
"github.com/pkg/errors"
1717
"golang.org/x/sys/unix"
1818
"gotest.tools/v3/assert"
@@ -30,7 +30,7 @@ import (
3030
// └── f1 # whiteout, 0644
3131
func setupOverlayTestDir(t *testing.T, src string) {
3232
skip.If(t, os.Getuid() != 0, "skipping test that requires root")
33-
skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires initial userns (trusted.overlay.opaque xattr cannot be set in userns, even with Ubuntu kernel)")
33+
skip.If(t, sys.RunningInUserNS(), "skipping test that requires initial userns (trusted.overlay.opaque xattr cannot be set in userns, even with Ubuntu kernel)")
3434
// Create opaque directory containing single file and permission 0700
3535
err := os.Mkdir(filepath.Join(src, "d1"), 0700)
3636
assert.NilError(t, err)
@@ -248,7 +248,7 @@ func isOpaque(dir string) error {
248248

249249
func TestReexecUserNSOverlayWhiteoutConverter(t *testing.T) {
250250
skip.If(t, os.Getuid() != 0, "skipping test that requires root")
251-
skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires initial userns")
251+
skip.If(t, sys.RunningInUserNS(), "skipping test that requires initial userns")
252252
if err := supportsUserNSOverlay(); err != nil {
253253
t.Skipf("skipping test that requires kernel support for overlay-in-userns: %v", err)
254254
}

‎pkg/archive/archive_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ import (
1616
"testing"
1717
"time"
1818

19+
"github.com/containerd/containerd/sys"
1920
"github.com/docker/docker/pkg/idtools"
2021
"github.com/docker/docker/pkg/ioutils"
21-
rsystem "github.com/opencontainers/runc/libcontainer/system"
2222
"gotest.tools/v3/assert"
2323
is "gotest.tools/v3/assert/cmp"
2424
"gotest.tools/v3/skip"
@@ -1230,7 +1230,7 @@ func TestReplaceFileTarWrapper(t *testing.T) {
12301230
// version of this package that was built with <=go17 are still readable.
12311231
func TestPrefixHeaderReadable(t *testing.T) {
12321232
skip.If(t, runtime.GOOS != "windows" && os.Getuid() != 0, "skipping test that requires root")
1233-
skip.If(t, rsystem.RunningInUserNS(), "skipping test that requires more than 010000000 UIDs, which is unlikely to be satisfied when running in userns")
1233+
skip.If(t, sys.RunningInUserNS(), "skipping test that requires more than 010000000 UIDs, which is unlikely to be satisfied when running in userns")
12341234
// https://gist.github.com/stevvooe/e2a790ad4e97425896206c0816e1a882#file-out-go
12351235
var testFile = []byte("\x1f\x8b\x08\x08\x44\x21\x68\x59\x00\x03\x74\x2e\x74\x61\x72\x00\x4b\xcb\xcf\x67\xa0\x35\x30\x80\x00\x86\x06\x10\x47\x01\xc1\x37\x40\x00\x54\xb6\xb1\xa1\xa9\x99\x09\x48\x25\x1d\x40\x69\x71\x49\x62\x91\x02\xe5\x76\xa1\x79\x84\x21\x91\xd6\x80\x72\xaf\x8f\x82\x51\x30\x0a\x46\x36\x00\x00\xf0\x1c\x1e\x95\x00\x06\x00\x00")
12361236

0 commit comments

Comments
 (0)