summaryrefslogtreecommitdiffhomepage
path: root/runsc/boot
diff options
context:
space:
mode:
Diffstat (limited to 'runsc/boot')
-rw-r--r--runsc/boot/BUILD1
-rw-r--r--runsc/boot/controller.go124
-rw-r--r--runsc/boot/events.go2
-rw-r--r--runsc/boot/filter/config.go8
-rw-r--r--runsc/boot/filter/config_amd64.go1
-rw-r--r--runsc/boot/filter/config_arm64.go1
-rw-r--r--runsc/boot/filter/config_profile.go3
-rw-r--r--runsc/boot/filter/extra_filters.go1
-rw-r--r--runsc/boot/filter/extra_filters_msan.go1
-rw-r--r--runsc/boot/filter/extra_filters_race.go1
-rw-r--r--runsc/boot/fs.go8
-rw-r--r--runsc/boot/loader.go63
-rw-r--r--runsc/boot/loader_test.go4
-rw-r--r--runsc/boot/pprof/pprof.go3
-rw-r--r--runsc/boot/vfs.go3
15 files changed, 121 insertions, 103 deletions
diff --git a/runsc/boot/BUILD b/runsc/boot/BUILD
index c7b26746b..c9d2b3eff 100644
--- a/runsc/boot/BUILD
+++ b/runsc/boot/BUILD
@@ -95,7 +95,6 @@ go_library(
"//pkg/sentry/vfs",
"//pkg/sentry/watchdog",
"//pkg/sync",
- "//pkg/syserror",
"//pkg/tcpip",
"//pkg/tcpip/link/fdbased",
"//pkg/tcpip/link/loopback",
diff --git a/runsc/boot/controller.go b/runsc/boot/controller.go
index 132973e6b..e5b0ec3ae 100644
--- a/runsc/boot/controller.go
+++ b/runsc/boot/controller.go
@@ -41,80 +41,74 @@ import (
)
const (
- // ContainerCheckpoint checkpoints a container.
- ContainerCheckpoint = "containerManager.Checkpoint"
+ // ContMgrCheckpoint checkpoints a container.
+ ContMgrCheckpoint = "containerManager.Checkpoint"
- // ContainerCreate creates a container.
- ContainerCreate = "containerManager.Create"
+ // ContMgrCreateSubcontainer creates a sub-container.
+ ContMgrCreateSubcontainer = "containerManager.CreateSubcontainer"
- // ContainerDestroy is used to stop a non-root container and free all
+ // ContMgrDestroySubcontainer is used to stop a sub-container and free all
// associated resources in the sandbox.
- ContainerDestroy = "containerManager.Destroy"
+ ContMgrDestroySubcontainer = "containerManager.DestroySubcontainer"
- // ContainerEvent is the URPC endpoint for getting stats about the
- // container used by "runsc events".
- ContainerEvent = "containerManager.Event"
+ // ContMgrEvent gets stats about the container used by "runsc events".
+ ContMgrEvent = "containerManager.Event"
- // ContainerExecuteAsync is the URPC endpoint for executing a command in a
- // container.
- ContainerExecuteAsync = "containerManager.ExecuteAsync"
+ // ContMgrExecuteAsync executes a command in a container.
+ ContMgrExecuteAsync = "containerManager.ExecuteAsync"
- // ContainerPause pauses the container.
- ContainerPause = "containerManager.Pause"
+ // ContMgrPause pauses the sandbox (note that individual containers cannot be
+ // paused).
+ ContMgrPause = "containerManager.Pause"
- // ContainerProcesses is the URPC endpoint for getting the list of
- // processes running in a container.
- ContainerProcesses = "containerManager.Processes"
+ // ContMgrProcesses lists processes running in a container.
+ ContMgrProcesses = "containerManager.Processes"
- // ContainerRestore restores a container from a statefile.
- ContainerRestore = "containerManager.Restore"
+ // ContMgrRestore restores a container from a statefile.
+ ContMgrRestore = "containerManager.Restore"
- // ContainerResume unpauses the paused container.
- ContainerResume = "containerManager.Resume"
+ // ContMgrResume unpauses the paused sandbox (note that individual containers
+ // cannot be resumed).
+ ContMgrResume = "containerManager.Resume"
- // ContainerSignal is used to send a signal to a container.
- ContainerSignal = "containerManager.Signal"
+ // ContMgrSignal sends a signal to a container.
+ ContMgrSignal = "containerManager.Signal"
- // ContainerSignalProcess is used to send a signal to a particular
- // process in a container.
- ContainerSignalProcess = "containerManager.SignalProcess"
+ // ContMgrStartSubcontainer starts a sub-container inside a running sandbox.
+ ContMgrStartSubcontainer = "containerManager.StartSubcontainer"
- // ContainerStart is the URPC endpoint for running a non-root container
- // within a sandbox.
- ContainerStart = "containerManager.Start"
+ // ContMgrWait waits on the init process of the container and returns its
+ // ExitStatus.
+ ContMgrWait = "containerManager.Wait"
- // ContainerWait is used to wait on the init process of the container
- // and return its ExitStatus.
- ContainerWait = "containerManager.Wait"
+ // ContMgrWaitPID waits on a process with a certain PID in the sandbox and
+ // return its ExitStatus.
+ ContMgrWaitPID = "containerManager.WaitPID"
- // ContainerWaitPID is used to wait on a process with a certain PID in
- // the sandbox and return its ExitStatus.
- ContainerWaitPID = "containerManager.WaitPID"
+ // ContMgrRootContainerStart starts a new sandbox with a root container.
+ ContMgrRootContainerStart = "containerManager.StartRoot"
+)
- // NetworkCreateLinksAndRoutes is the URPC endpoint for creating links
- // and routes in a network stack.
+const (
+ // NetworkCreateLinksAndRoutes creates links and routes in a network stack.
NetworkCreateLinksAndRoutes = "Network.CreateLinksAndRoutes"
- // RootContainerStart is the URPC endpoint for starting a new sandbox
- // with root container.
- RootContainerStart = "containerManager.StartRoot"
-
- // SandboxStacks collects sandbox stacks for debugging.
- SandboxStacks = "debug.Stacks"
+ // DebugStacks collects sandbox stacks for debugging.
+ DebugStacks = "debug.Stacks"
)
// Profiling related commands (see pprof.go for more details).
const (
- CPUProfile = "Profile.CPU"
- HeapProfile = "Profile.Heap"
- BlockProfile = "Profile.Block"
- MutexProfile = "Profile.Mutex"
- Trace = "Profile.Trace"
+ ProfileCPU = "Profile.CPU"
+ ProfileHeap = "Profile.Heap"
+ ProfileBlock = "Profile.Block"
+ ProfileMutex = "Profile.Mutex"
+ ProfileTrace = "Profile.Trace"
)
// Logging related commands (see logging.go for more details).
const (
- ChangeLogging = "Logging.Change"
+ LoggingChange = "Logging.Change"
)
// ControlSocketAddr generates an abstract unix socket name for the given ID.
@@ -214,9 +208,9 @@ type CreateArgs struct {
urpc.FilePayload
}
-// Create creates a container within a sandbox.
-func (cm *containerManager) Create(args *CreateArgs, _ *struct{}) error {
- log.Debugf("containerManager.Create: %s", args.CID)
+// CreateSubcontainer creates a container within a sandbox.
+func (cm *containerManager) CreateSubcontainer(args *CreateArgs, _ *struct{}) error {
+ log.Debugf("containerManager.CreateSubcontainer: %s", args.CID)
if len(args.Files) > 1 {
return fmt.Errorf("start arguments must have at most 1 files for TTY")
@@ -229,7 +223,7 @@ func (cm *containerManager) Create(args *CreateArgs, _ *struct{}) error {
return fmt.Errorf("error dup'ing TTY file: %w", err)
}
}
- return cm.l.createContainer(args.CID, tty)
+ return cm.l.createSubcontainer(args.CID, tty)
}
// StartArgs contains arguments to the Start method.
@@ -249,13 +243,13 @@ type StartArgs struct {
urpc.FilePayload
}
-// Start runs a created container within a sandbox.
-func (cm *containerManager) Start(args *StartArgs, _ *struct{}) error {
+// StartSubcontainer runs a created container within a sandbox.
+func (cm *containerManager) StartSubcontainer(args *StartArgs, _ *struct{}) error {
// Validate arguments.
if args == nil {
return errors.New("start missing arguments")
}
- log.Debugf("containerManager.Start, cid: %s, args: %+v", args.CID, args)
+ log.Debugf("containerManager.StartSubcontainer, cid: %s, args: %+v", args.CID, args)
if args.Spec == nil {
return errors.New("start arguments missing spec")
}
@@ -303,19 +297,19 @@ func (cm *containerManager) Start(args *StartArgs, _ *struct{}) error {
}
}()
- if err := cm.l.startContainer(args.Spec, args.Conf, args.CID, stdios, goferFDs); err != nil {
- log.Debugf("containerManager.Start failed, cid: %s, args: %+v, err: %v", args.CID, args, err)
+ if err := cm.l.startSubcontainer(args.Spec, args.Conf, args.CID, stdios, goferFDs); err != nil {
+ log.Debugf("containerManager.StartSubcontainer failed, cid: %s, args: %+v, err: %v", args.CID, args, err)
return err
}
log.Debugf("Container started, cid: %s", args.CID)
return nil
}
-// Destroy stops a container if it is still running and cleans up its
-// filesystem.
-func (cm *containerManager) Destroy(cid *string, _ *struct{}) error {
- log.Debugf("containerManager.destroy, cid: %s", *cid)
- return cm.l.destroyContainer(*cid)
+// DestroySubcontainer stops a container if it is still running and cleans up
+// its filesystem.
+func (cm *containerManager) DestroySubcontainer(cid *string, _ *struct{}) error {
+ log.Debugf("containerManager.DestroySubcontainer, cid: %s", *cid)
+ return cm.l.destroySubcontainer(*cid)
}
// ExecuteAsync starts running a command on a created or running sandbox. It
@@ -346,7 +340,7 @@ func (cm *containerManager) Checkpoint(o *control.SaveOpts, _ *struct{}) error {
return state.Save(o, nil)
}
-// Pause suspends a container.
+// Pause suspends a sandbox.
func (cm *containerManager) Pause(_, _ *struct{}) error {
log.Debugf("containerManager.Pause")
// TODO(gvisor.dev/issues/6243): save/restore not supported w/ hostinet
@@ -488,7 +482,7 @@ func (cm *containerManager) Restore(o *RestoreOpts, _ *struct{}) error {
return nil
}
-// Resume unpauses a container.
+// Resume unpauses a sandbox.
func (cm *containerManager) Resume(_, _ *struct{}) error {
log.Debugf("containerManager.Resume")
cm.l.k.Unpause()
diff --git a/runsc/boot/events.go b/runsc/boot/events.go
index 0814b2a69..65137de8a 100644
--- a/runsc/boot/events.go
+++ b/runsc/boot/events.go
@@ -91,7 +91,7 @@ func (cm *containerManager) Event(_ *struct{}, out *EventOut) error {
// Memory usage.
// TODO(gvisor.dev/issue/172): Per-container accounting.
mem := cm.l.k.MemoryFile()
- mem.UpdateUsage()
+ _ = mem.UpdateUsage() // best effort to update.
_, totalUsage := usage.MemoryAccounting.Copy()
out.Event.Data.Memory.Usage = MemoryEntry{
Usage: totalUsage,
diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go
index 752fea0e1..703f34827 100644
--- a/runsc/boot/filter/config.go
+++ b/runsc/boot/filter/config.go
@@ -459,6 +459,14 @@ func hostInetFilters() seccomp.SyscallRules {
seccomp.MatchAny{},
seccomp.EqualTo(unix.TIOCINQ),
},
+ {
+ seccomp.MatchAny{},
+ seccomp.EqualTo(unix.SIOCGIFFLAGS),
+ },
+ {
+ seccomp.MatchAny{},
+ seccomp.EqualTo(unix.SIOCGIFCONF),
+ },
},
unix.SYS_LISTEN: {},
unix.SYS_READV: {},
diff --git a/runsc/boot/filter/config_amd64.go b/runsc/boot/filter/config_amd64.go
index 42cb8ed3a..8015a0e52 100644
--- a/runsc/boot/filter/config_amd64.go
+++ b/runsc/boot/filter/config_amd64.go
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build amd64
// +build amd64
package filter
diff --git a/runsc/boot/filter/config_arm64.go b/runsc/boot/filter/config_arm64.go
index f162f87ff..9f44379b4 100644
--- a/runsc/boot/filter/config_arm64.go
+++ b/runsc/boot/filter/config_arm64.go
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build arm64
// +build arm64
package filter
diff --git a/runsc/boot/filter/config_profile.go b/runsc/boot/filter/config_profile.go
index 89b66a6da..214bf8b1d 100644
--- a/runsc/boot/filter/config_profile.go
+++ b/runsc/boot/filter/config_profile.go
@@ -12,6 +12,9 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build go1.1
+// +build go1.1
+
package filter
import (
diff --git a/runsc/boot/filter/extra_filters.go b/runsc/boot/filter/extra_filters.go
index e28d4b8d6..5442add95 100644
--- a/runsc/boot/filter/extra_filters.go
+++ b/runsc/boot/filter/extra_filters.go
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build !msan && !race
// +build !msan,!race
package filter
diff --git a/runsc/boot/filter/extra_filters_msan.go b/runsc/boot/filter/extra_filters_msan.go
index 41baa78cd..8873f9cf9 100644
--- a/runsc/boot/filter/extra_filters_msan.go
+++ b/runsc/boot/filter/extra_filters_msan.go
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build msan
// +build msan
package filter
diff --git a/runsc/boot/filter/extra_filters_race.go b/runsc/boot/filter/extra_filters_race.go
index 79b2104f0..046b39014 100644
--- a/runsc/boot/filter/extra_filters_race.go
+++ b/runsc/boot/filter/extra_filters_race.go
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build race
// +build race
package filter
diff --git a/runsc/boot/fs.go b/runsc/boot/fs.go
index 7fce2b708..40cf2a3df 100644
--- a/runsc/boot/fs.go
+++ b/runsc/boot/fs.go
@@ -69,7 +69,7 @@ const (
// tmpfs has some extra supported options that we must pass through.
var tmpfsAllowedData = []string{"mode", "uid", "gid"}
-func addOverlay(ctx context.Context, conf *config.Config, lower *fs.Inode, name string, lowerFlags fs.MountSourceFlags) (*fs.Inode, error) {
+func addOverlay(ctx context.Context, lower *fs.Inode, name string, lowerFlags fs.MountSourceFlags) (*fs.Inode, error) {
// Upper layer uses the same flags as lower, but it must be read-write.
upperFlags := lowerFlags
upperFlags.ReadOnly = false
@@ -744,7 +744,7 @@ func (c *containerMounter) mountSharedMaster(ctx context.Context, conf *config.C
if useOverlay {
log.Debugf("Adding overlay on top of shared mount %q", hint.name)
- inode, err = addOverlay(ctx, conf, inode, hint.mount.Type, mf)
+ inode, err = addOverlay(ctx, inode, hint.mount.Type, mf)
if err != nil {
return nil, err
}
@@ -785,7 +785,7 @@ func (c *containerMounter) createRootMount(ctx context.Context, conf *config.Con
if conf.Overlay && !c.root.Readonly {
log.Debugf("Adding overlay on top of root mount")
// Overlay a tmpfs filesystem on top of the root.
- rootInode, err = addOverlay(ctx, conf, rootInode, "root-overlay-upper", mf)
+ rootInode, err = addOverlay(ctx, rootInode, "root-overlay-upper", mf)
if err != nil {
return nil, err
}
@@ -901,7 +901,7 @@ func (c *containerMounter) mountSubmount(ctx context.Context, conf *config.Confi
if useOverlay {
log.Debugf("Adding overlay on top of mount %q", m.Destination)
- inode, err = addOverlay(ctx, conf, inode, m.Type, mf)
+ inode, err = addOverlay(ctx, inode, m.Type, mf)
if err != nil {
return err
}
diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go
index 8d71d7447..ec9188021 100644
--- a/runsc/boot/loader.go
+++ b/runsc/boot/loader.go
@@ -633,8 +633,8 @@ func (l *Loader) run() error {
return l.k.Start()
}
-// createContainer creates a new container inside the sandbox.
-func (l *Loader) createContainer(cid string, tty *fd.FD) error {
+// createSubcontainer creates a new container inside the sandbox.
+func (l *Loader) createSubcontainer(cid string, tty *fd.FD) error {
l.mu.Lock()
defer l.mu.Unlock()
@@ -646,10 +646,10 @@ func (l *Loader) createContainer(cid string, tty *fd.FD) error {
return nil
}
-// startContainer starts a child container. It returns the thread group ID of
+// startSubcontainer starts a child container. It returns the thread group ID of
// the newly created process. Used FDs are either closed or released. It's safe
// for the caller to close any remaining files upon return.
-func (l *Loader) startContainer(spec *specs.Spec, conf *config.Config, cid string, stdioFDs, goferFDs []*fd.FD) error {
+func (l *Loader) startSubcontainer(spec *specs.Spec, conf *config.Config, cid string, stdioFDs, goferFDs []*fd.FD) error {
// Create capabilities.
caps, err := specutils.Capabilities(conf.EnableRaw, spec.Process.Capabilities)
if err != nil {
@@ -715,7 +715,7 @@ func (l *Loader) startContainer(spec *specs.Spec, conf *config.Config, cid strin
return fmt.Errorf("using TTY, stdios not expected: %d", l)
}
if ep.hostTTY == nil {
- return fmt.Errorf("terminal enabled but no TTY provided (--console-socket possibly passed)")
+ return fmt.Errorf("terminal enabled but no TTY provided. Did you set --console-socket on create?")
}
info.stdioFDs = []*fd.FD{ep.hostTTY, ep.hostTTY, ep.hostTTY}
ep.hostTTY = nil
@@ -734,7 +734,7 @@ func (l *Loader) startContainer(spec *specs.Spec, conf *config.Config, cid strin
func (l *Loader) createContainerProcess(root bool, cid string, info *containerInfo) (*kernel.ThreadGroup, *host.TTYFileOperations, *hostvfs2.TTYFileDescription, error) {
// Create the FD map, which will set stdin, stdout, and stderr.
ctx := info.procArgs.NewContext(l.k)
- fdTable, ttyFile, ttyFileVFS2, err := createFDTable(ctx, info.spec.Process.Terminal, info.stdioFDs)
+ fdTable, ttyFile, ttyFileVFS2, err := createFDTable(ctx, info.spec.Process.Terminal, info.stdioFDs, info.spec.Process.User)
if err != nil {
return nil, nil, nil, fmt.Errorf("importing fds: %w", err)
}
@@ -742,8 +742,11 @@ func (l *Loader) createContainerProcess(root bool, cid string, info *containerIn
// ours either way.
info.procArgs.FDTable = fdTable
- // Setup the child container file system.
- l.startGoferMonitor(cid, info.goferFDs)
+ // Gofer FDs must be ordered and the first FD is always the rootfs.
+ if len(info.goferFDs) < 1 {
+ return nil, nil, nil, fmt.Errorf("rootfs gofer FD not found")
+ }
+ l.startGoferMonitor(cid, int32(info.goferFDs[0].FD()))
mntr := newContainerMounter(info, l.k, l.mountHints, kernel.VFS2Enabled)
if root {
@@ -816,17 +819,21 @@ func (l *Loader) createContainerProcess(root bool, cid string, info *containerIn
}
// startGoferMonitor runs a goroutine to monitor gofer's health. It polls on
-// the gofer FDs looking for disconnects, and kills the container processes if a
-// disconnect occurs in any of the gofer FDs.
-func (l *Loader) startGoferMonitor(cid string, goferFDs []*fd.FD) {
+// the gofer FD looking for disconnects, and kills the container processes if
+// the rootfs FD disconnects.
+//
+// Note that other gofer mounts are allowed to be unmounted and disconnected.
+func (l *Loader) startGoferMonitor(cid string, rootfsGoferFD int32) {
+ if rootfsGoferFD < 0 {
+ panic(fmt.Sprintf("invalid FD: %d", rootfsGoferFD))
+ }
go func() {
log.Debugf("Monitoring gofer health for container %q", cid)
- var events []unix.PollFd
- for _, goferFD := range goferFDs {
- events = append(events, unix.PollFd{
- Fd: int32(goferFD.FD()),
+ events := []unix.PollFd{
+ {
+ Fd: rootfsGoferFD,
Events: unix.POLLHUP | unix.POLLRDHUP,
- })
+ },
}
_, _, err := specutils.RetryEintr(func() (uintptr, uintptr, error) {
// Use ppoll instead of poll because it's already whilelisted in seccomp.
@@ -851,9 +858,9 @@ func (l *Loader) startGoferMonitor(cid string, goferFDs []*fd.FD) {
}()
}
-// destroyContainer stops a container if it is still running and cleans up its
-// filesystem.
-func (l *Loader) destroyContainer(cid string) error {
+// destroySubcontainer stops a container if it is still running and cleans up
+// its filesystem.
+func (l *Loader) destroySubcontainer(cid string) error {
l.mu.Lock()
defer l.mu.Unlock()
@@ -980,7 +987,7 @@ func (l *Loader) executeAsync(args *control.ExecArgs) (kernel.ThreadID, error) {
tty: ttyFile,
ttyVFS2: ttyFileVFS2,
}
- log.Debugf("updated processes: %s", l.processes)
+ log.Debugf("updated processes: %v", l.processes)
return tgid, nil
}
@@ -1001,7 +1008,7 @@ func (l *Loader) waitContainer(cid string, waitStatus *uint32) error {
// Check for leaks and write coverage report after the root container has
// exited. This guarantees that the report is written in cases where the
- // sandbox is killed by a signal after the ContainerWait request is completed.
+ // sandbox is killed by a signal after the ContMgrWait request is completed.
if l.root.procArgs.ContainerID == cid {
// All sentry-created resources should have been released at this point.
refsvfs2.DoLeakCheck()
@@ -1024,7 +1031,7 @@ func (l *Loader) waitPID(tgid kernel.ThreadID, cid string, waitStatus *uint32) e
l.mu.Lock()
delete(l.processes, eid)
- log.Debugf("updated processes (removal): %s", l.processes)
+ log.Debugf("updated processes (removal): %v", l.processes)
l.mu.Unlock()
return nil
}
@@ -1051,7 +1058,7 @@ func (l *Loader) waitPID(tgid kernel.ThreadID, cid string, waitStatus *uint32) e
// to exit.
func (l *Loader) wait(tg *kernel.ThreadGroup) uint32 {
tg.WaitExited()
- return tg.ExitStatus().Status()
+ return uint32(tg.ExitStatus())
}
// WaitForStartSignal waits for a start signal from the control server.
@@ -1060,7 +1067,7 @@ func (l *Loader) WaitForStartSignal() {
}
// WaitExit waits for the root container to exit, and returns its exit status.
-func (l *Loader) WaitExit() kernel.ExitStatus {
+func (l *Loader) WaitExit() linux.WaitStatus {
// Wait for container.
l.k.WaitExited()
@@ -1092,7 +1099,7 @@ func newRootNetworkNamespace(conf *config.Config, clock tcpip.Clock, uniqueID st
return inet.NewRootNamespace(s, creator), nil
default:
- panic(fmt.Sprintf("invalid network configuration: %d", conf.Network))
+ panic(fmt.Sprintf("invalid network configuration: %v", conf.Network))
}
}
@@ -1212,7 +1219,7 @@ func (l *Loader) signal(cid string, pid, signo int32, mode SignalDeliveryMode) e
return nil
default:
- panic(fmt.Sprintf("unknown signal delivery mode %s", mode))
+ panic(fmt.Sprintf("unknown signal delivery mode %v", mode))
}
}
@@ -1337,14 +1344,14 @@ func (l *Loader) ttyFromIDLocked(key execID) (*host.TTYFileOperations, *hostvfs2
return ep.tty, ep.ttyVFS2, nil
}
-func createFDTable(ctx context.Context, console bool, stdioFDs []*fd.FD) (*kernel.FDTable, *host.TTYFileOperations, *hostvfs2.TTYFileDescription, error) {
+func createFDTable(ctx context.Context, console bool, stdioFDs []*fd.FD, user specs.User) (*kernel.FDTable, *host.TTYFileOperations, *hostvfs2.TTYFileDescription, error) {
if len(stdioFDs) != 3 {
return nil, nil, nil, fmt.Errorf("stdioFDs should contain exactly 3 FDs (stdin, stdout, and stderr), but %d FDs received", len(stdioFDs))
}
k := kernel.KernelFromContext(ctx)
fdTable := k.NewFDTable()
- ttyFile, ttyFileVFS2, err := fdimport.Import(ctx, fdTable, console, stdioFDs)
+ ttyFile, ttyFileVFS2, err := fdimport.Import(ctx, fdTable, console, auth.KUID(user.UID), auth.KGID(user.GID), stdioFDs)
if err != nil {
fdTable.DecRef(ctx)
return nil, nil, nil, err
diff --git a/runsc/boot/loader_test.go b/runsc/boot/loader_test.go
index b5e8d08a5..ac6c26d25 100644
--- a/runsc/boot/loader_test.go
+++ b/runsc/boot/loader_test.go
@@ -188,8 +188,8 @@ func doRun(t *testing.T, vfsEnabled bool) {
}
// Wait for the application to exit. It should succeed.
- if status := l.WaitExit(); status.Code != 0 || status.Signo != 0 {
- t.Errorf("application exited with status %+v, want 0", status)
+ if status := l.WaitExit(); !status.Exited() || status.ExitStatus() != 0 {
+ t.Errorf("application exited with %s, want exit status 0", status)
}
}
diff --git a/runsc/boot/pprof/pprof.go b/runsc/boot/pprof/pprof.go
index 1ded20dee..36b78ad86 100644
--- a/runsc/boot/pprof/pprof.go
+++ b/runsc/boot/pprof/pprof.go
@@ -12,6 +12,9 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build go1.1
+// +build go1.1
+
// Package pprof provides a stub to initialize custom profilers.
package pprof
diff --git a/runsc/boot/vfs.go b/runsc/boot/vfs.go
index ca1a86e39..346796d9c 100644
--- a/runsc/boot/vfs.go
+++ b/runsc/boot/vfs.go
@@ -45,7 +45,6 @@ import (
"gvisor.dev/gvisor/pkg/sentry/kernel"
"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
"gvisor.dev/gvisor/pkg/sentry/vfs"
- "gvisor.dev/gvisor/pkg/syserror"
"gvisor.dev/gvisor/runsc/config"
"gvisor.dev/gvisor/runsc/specutils"
)
@@ -663,7 +662,7 @@ func (c *containerMounter) mountTmpVFS2(ctx context.Context, conf *config.Config
err := fd.IterDirents(ctx, vfs.IterDirentsCallbackFunc(func(dirent vfs.Dirent) error {
if dirent.Name != "." && dirent.Name != ".." {
- return syserror.ENOTEMPTY
+ return linuxerr.ENOTEMPTY
}
return nil
}))
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 10:44:14 +0000