summaryrefslogtreecommitdiffhomepage
path: root/runsc/boot
diff options
context:
space:
mode:
Diffstat (limited to 'runsc/boot')
-rw-r--r--runsc/boot/BUILD2
-rw-r--r--runsc/boot/controller.go139
-rw-r--r--runsc/boot/events.go2
-rw-r--r--runsc/boot/filter/config.go4
-rw-r--r--runsc/boot/filter/config_amd64.go1
-rw-r--r--runsc/boot/filter/config_arm64.go1
-rw-r--r--runsc/boot/filter/config_profile.go3
-rw-r--r--runsc/boot/filter/extra_filters.go1
-rw-r--r--runsc/boot/filter/extra_filters_msan.go1
-rw-r--r--runsc/boot/filter/extra_filters_race.go1
-rw-r--r--runsc/boot/fs.go16
-rw-r--r--runsc/boot/loader.go36
-rw-r--r--runsc/boot/loader_test.go6
-rw-r--r--runsc/boot/pprof/pprof.go3
-rw-r--r--runsc/boot/vfs.go18
15 files changed, 128 insertions, 106 deletions
diff --git a/runsc/boot/BUILD b/runsc/boot/BUILD
index a79afbdc4..c9d2b3eff 100644
--- a/runsc/boot/BUILD
+++ b/runsc/boot/BUILD
@@ -32,6 +32,7 @@ go_library(
"//pkg/control/server",
"//pkg/coverage",
"//pkg/cpuid",
+ "//pkg/errors/linuxerr",
"//pkg/eventchannel",
"//pkg/fd",
"//pkg/flipcall",
@@ -94,7 +95,6 @@ go_library(
"//pkg/sentry/vfs",
"//pkg/sentry/watchdog",
"//pkg/sync",
- "//pkg/syserror",
"//pkg/tcpip",
"//pkg/tcpip/link/fdbased",
"//pkg/tcpip/link/loopback",
diff --git a/runsc/boot/controller.go b/runsc/boot/controller.go
index d52cf5a00..e5b0ec3ae 100644
--- a/runsc/boot/controller.go
+++ b/runsc/boot/controller.go
@@ -18,6 +18,7 @@ import (
"errors"
"fmt"
"os"
+ gtime "time"
specs "github.com/opencontainers/runtime-spec/specs-go"
"golang.org/x/sys/unix"
@@ -40,80 +41,74 @@ import (
)
const (
- // ContainerCheckpoint checkpoints a container.
- ContainerCheckpoint = "containerManager.Checkpoint"
+ // ContMgrCheckpoint checkpoints a container.
+ ContMgrCheckpoint = "containerManager.Checkpoint"
- // ContainerCreate creates a container.
- ContainerCreate = "containerManager.Create"
+ // ContMgrCreateSubcontainer creates a sub-container.
+ ContMgrCreateSubcontainer = "containerManager.CreateSubcontainer"
- // ContainerDestroy is used to stop a non-root container and free all
+ // ContMgrDestroySubcontainer is used to stop a sub-container and free all
// associated resources in the sandbox.
- ContainerDestroy = "containerManager.Destroy"
+ ContMgrDestroySubcontainer = "containerManager.DestroySubcontainer"
- // ContainerEvent is the URPC endpoint for getting stats about the
- // container used by "runsc events".
- ContainerEvent = "containerManager.Event"
+ // ContMgrEvent gets stats about the container used by "runsc events".
+ ContMgrEvent = "containerManager.Event"
- // ContainerExecuteAsync is the URPC endpoint for executing a command in a
- // container.
- ContainerExecuteAsync = "containerManager.ExecuteAsync"
+ // ContMgrExecuteAsync executes a command in a container.
+ ContMgrExecuteAsync = "containerManager.ExecuteAsync"
- // ContainerPause pauses the container.
- ContainerPause = "containerManager.Pause"
+ // ContMgrPause pauses the sandbox (note that individual containers cannot be
+ // paused).
+ ContMgrPause = "containerManager.Pause"
- // ContainerProcesses is the URPC endpoint for getting the list of
- // processes running in a container.
- ContainerProcesses = "containerManager.Processes"
+ // ContMgrProcesses lists processes running in a container.
+ ContMgrProcesses = "containerManager.Processes"
- // ContainerRestore restores a container from a statefile.
- ContainerRestore = "containerManager.Restore"
+ // ContMgrRestore restores a container from a statefile.
+ ContMgrRestore = "containerManager.Restore"
- // ContainerResume unpauses the paused container.
- ContainerResume = "containerManager.Resume"
+ // ContMgrResume unpauses the paused sandbox (note that individual containers
+ // cannot be resumed).
+ ContMgrResume = "containerManager.Resume"
- // ContainerSignal is used to send a signal to a container.
- ContainerSignal = "containerManager.Signal"
+ // ContMgrSignal sends a signal to a container.
+ ContMgrSignal = "containerManager.Signal"
- // ContainerSignalProcess is used to send a signal to a particular
- // process in a container.
- ContainerSignalProcess = "containerManager.SignalProcess"
+ // ContMgrStartSubcontainer starts a sub-container inside a running sandbox.
+ ContMgrStartSubcontainer = "containerManager.StartSubcontainer"
- // ContainerStart is the URPC endpoint for running a non-root container
- // within a sandbox.
- ContainerStart = "containerManager.Start"
+ // ContMgrWait waits on the init process of the container and returns its
+ // ExitStatus.
+ ContMgrWait = "containerManager.Wait"
- // ContainerWait is used to wait on the init process of the container
- // and return its ExitStatus.
- ContainerWait = "containerManager.Wait"
+ // ContMgrWaitPID waits on a process with a certain PID in the sandbox and
+ // return its ExitStatus.
+ ContMgrWaitPID = "containerManager.WaitPID"
- // ContainerWaitPID is used to wait on a process with a certain PID in
- // the sandbox and return its ExitStatus.
- ContainerWaitPID = "containerManager.WaitPID"
+ // ContMgrRootContainerStart starts a new sandbox with a root container.
+ ContMgrRootContainerStart = "containerManager.StartRoot"
+)
- // NetworkCreateLinksAndRoutes is the URPC endpoint for creating links
- // and routes in a network stack.
+const (
+ // NetworkCreateLinksAndRoutes creates links and routes in a network stack.
NetworkCreateLinksAndRoutes = "Network.CreateLinksAndRoutes"
- // RootContainerStart is the URPC endpoint for starting a new sandbox
- // with root container.
- RootContainerStart = "containerManager.StartRoot"
-
- // SandboxStacks collects sandbox stacks for debugging.
- SandboxStacks = "debug.Stacks"
+ // DebugStacks collects sandbox stacks for debugging.
+ DebugStacks = "debug.Stacks"
)
// Profiling related commands (see pprof.go for more details).
const (
- CPUProfile = "Profile.CPU"
- HeapProfile = "Profile.Heap"
- BlockProfile = "Profile.Block"
- MutexProfile = "Profile.Mutex"
- Trace = "Profile.Trace"
+ ProfileCPU = "Profile.CPU"
+ ProfileHeap = "Profile.Heap"
+ ProfileBlock = "Profile.Block"
+ ProfileMutex = "Profile.Mutex"
+ ProfileTrace = "Profile.Trace"
)
// Logging related commands (see logging.go for more details).
const (
- ChangeLogging = "Logging.Change"
+ LoggingChange = "Logging.Change"
)
// ControlSocketAddr generates an abstract unix socket name for the given ID.
@@ -165,8 +160,11 @@ func newController(fd int, l *Loader) (*controller, error) {
return ctrl, nil
}
+// stopRPCTimeout is the time for clients to complete ongoing RPCs.
+const stopRPCTimeout = 15 * gtime.Second
+
func (c *controller) stop() {
- c.srv.Stop()
+ c.srv.Stop(stopRPCTimeout)
}
// containerManager manages sandbox containers.
@@ -210,9 +208,9 @@ type CreateArgs struct {
urpc.FilePayload
}
-// Create creates a container within a sandbox.
-func (cm *containerManager) Create(args *CreateArgs, _ *struct{}) error {
- log.Debugf("containerManager.Create: %s", args.CID)
+// CreateSubcontainer creates a container within a sandbox.
+func (cm *containerManager) CreateSubcontainer(args *CreateArgs, _ *struct{}) error {
+ log.Debugf("containerManager.CreateSubcontainer: %s", args.CID)
if len(args.Files) > 1 {
return fmt.Errorf("start arguments must have at most 1 files for TTY")
@@ -225,7 +223,7 @@ func (cm *containerManager) Create(args *CreateArgs, _ *struct{}) error {
return fmt.Errorf("error dup'ing TTY file: %w", err)
}
}
- return cm.l.createContainer(args.CID, tty)
+ return cm.l.createSubcontainer(args.CID, tty)
}
// StartArgs contains arguments to the Start method.
@@ -245,13 +243,13 @@ type StartArgs struct {
urpc.FilePayload
}
-// Start runs a created container within a sandbox.
-func (cm *containerManager) Start(args *StartArgs, _ *struct{}) error {
+// StartSubcontainer runs a created container within a sandbox.
+func (cm *containerManager) StartSubcontainer(args *StartArgs, _ *struct{}) error {
// Validate arguments.
if args == nil {
return errors.New("start missing arguments")
}
- log.Debugf("containerManager.Start, cid: %s, args: %+v", args.CID, args)
+ log.Debugf("containerManager.StartSubcontainer, cid: %s, args: %+v", args.CID, args)
if args.Spec == nil {
return errors.New("start arguments missing spec")
}
@@ -299,19 +297,19 @@ func (cm *containerManager) Start(args *StartArgs, _ *struct{}) error {
}
}()
- if err := cm.l.startContainer(args.Spec, args.Conf, args.CID, stdios, goferFDs); err != nil {
- log.Debugf("containerManager.Start failed, cid: %s, args: %+v, err: %v", args.CID, args, err)
+ if err := cm.l.startSubcontainer(args.Spec, args.Conf, args.CID, stdios, goferFDs); err != nil {
+ log.Debugf("containerManager.StartSubcontainer failed, cid: %s, args: %+v, err: %v", args.CID, args, err)
return err
}
log.Debugf("Container started, cid: %s", args.CID)
return nil
}
-// Destroy stops a container if it is still running and cleans up its
-// filesystem.
-func (cm *containerManager) Destroy(cid *string, _ *struct{}) error {
- log.Debugf("containerManager.destroy, cid: %s", *cid)
- return cm.l.destroyContainer(*cid)
+// DestroySubcontainer stops a container if it is still running and cleans up
+// its filesystem.
+func (cm *containerManager) DestroySubcontainer(cid *string, _ *struct{}) error {
+ log.Debugf("containerManager.DestroySubcontainer, cid: %s", *cid)
+ return cm.l.destroySubcontainer(*cid)
}
// ExecuteAsync starts running a command on a created or running sandbox. It
@@ -330,6 +328,11 @@ func (cm *containerManager) ExecuteAsync(args *control.ExecArgs, pid *int32) err
// Checkpoint pauses a sandbox and saves its state.
func (cm *containerManager) Checkpoint(o *control.SaveOpts, _ *struct{}) error {
log.Debugf("containerManager.Checkpoint")
+ // TODO(gvisor.dev/issues/6243): save/restore not supported w/ hostinet
+ if cm.l.root.conf.Network == config.NetworkHost {
+ return errors.New("checkpoint not supported when using hostinet")
+ }
+
state := control.State{
Kernel: cm.l.k,
Watchdog: cm.l.watchdog,
@@ -337,9 +340,13 @@ func (cm *containerManager) Checkpoint(o *control.SaveOpts, _ *struct{}) error {
return state.Save(o, nil)
}
-// Pause suspends a container.
+// Pause suspends a sandbox.
func (cm *containerManager) Pause(_, _ *struct{}) error {
log.Debugf("containerManager.Pause")
+ // TODO(gvisor.dev/issues/6243): save/restore not supported w/ hostinet
+ if cm.l.root.conf.Network == config.NetworkHost {
+ return errors.New("pause not supported when using hostinet")
+ }
cm.l.k.Pause()
return nil
}
@@ -475,7 +482,7 @@ func (cm *containerManager) Restore(o *RestoreOpts, _ *struct{}) error {
return nil
}
-// Resume unpauses a container.
+// Resume unpauses a sandbox.
func (cm *containerManager) Resume(_, _ *struct{}) error {
log.Debugf("containerManager.Resume")
cm.l.k.Unpause()
diff --git a/runsc/boot/events.go b/runsc/boot/events.go
index 0814b2a69..65137de8a 100644
--- a/runsc/boot/events.go
+++ b/runsc/boot/events.go
@@ -91,7 +91,7 @@ func (cm *containerManager) Event(_ *struct{}, out *EventOut) error {
// Memory usage.
// TODO(gvisor.dev/issue/172): Per-container accounting.
mem := cm.l.k.MemoryFile()
- mem.UpdateUsage()
+ _ = mem.UpdateUsage() // best effort to update.
_, totalUsage := usage.MemoryAccounting.Copy()
out.Event.Data.Memory.Usage = MemoryEntry{
Usage: totalUsage,
diff --git a/runsc/boot/filter/config.go b/runsc/boot/filter/config.go
index 752fea0e1..33e738efc 100644
--- a/runsc/boot/filter/config.go
+++ b/runsc/boot/filter/config.go
@@ -459,6 +459,10 @@ func hostInetFilters() seccomp.SyscallRules {
seccomp.MatchAny{},
seccomp.EqualTo(unix.TIOCINQ),
},
+ {
+ seccomp.MatchAny{},
+ seccomp.EqualTo(unix.SIOCGIFFLAGS),
+ },
},
unix.SYS_LISTEN: {},
unix.SYS_READV: {},
diff --git a/runsc/boot/filter/config_amd64.go b/runsc/boot/filter/config_amd64.go
index 42cb8ed3a..8015a0e52 100644
--- a/runsc/boot/filter/config_amd64.go
+++ b/runsc/boot/filter/config_amd64.go
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build amd64
// +build amd64
package filter
diff --git a/runsc/boot/filter/config_arm64.go b/runsc/boot/filter/config_arm64.go
index f162f87ff..9f44379b4 100644
--- a/runsc/boot/filter/config_arm64.go
+++ b/runsc/boot/filter/config_arm64.go
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build arm64
// +build arm64
package filter
diff --git a/runsc/boot/filter/config_profile.go b/runsc/boot/filter/config_profile.go
index 89b66a6da..214bf8b1d 100644
--- a/runsc/boot/filter/config_profile.go
+++ b/runsc/boot/filter/config_profile.go
@@ -12,6 +12,9 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build go1.1
+// +build go1.1
+
package filter
import (
diff --git a/runsc/boot/filter/extra_filters.go b/runsc/boot/filter/extra_filters.go
index e28d4b8d6..5442add95 100644
--- a/runsc/boot/filter/extra_filters.go
+++ b/runsc/boot/filter/extra_filters.go
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build !msan && !race
// +build !msan,!race
package filter
diff --git a/runsc/boot/filter/extra_filters_msan.go b/runsc/boot/filter/extra_filters_msan.go
index 41baa78cd..8873f9cf9 100644
--- a/runsc/boot/filter/extra_filters_msan.go
+++ b/runsc/boot/filter/extra_filters_msan.go
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build msan
// +build msan
package filter
diff --git a/runsc/boot/filter/extra_filters_race.go b/runsc/boot/filter/extra_filters_race.go
index 79b2104f0..046b39014 100644
--- a/runsc/boot/filter/extra_filters_race.go
+++ b/runsc/boot/filter/extra_filters_race.go
@@ -12,6 +12,7 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build race
// +build race
package filter
diff --git a/runsc/boot/fs.go b/runsc/boot/fs.go
index c4590aab1..40cf2a3df 100644
--- a/runsc/boot/fs.go
+++ b/runsc/boot/fs.go
@@ -25,6 +25,7 @@ import (
"golang.org/x/sys/unix"
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/context"
+ "gvisor.dev/gvisor/pkg/errors/linuxerr"
"gvisor.dev/gvisor/pkg/fd"
"gvisor.dev/gvisor/pkg/log"
"gvisor.dev/gvisor/pkg/sentry/fs"
@@ -41,7 +42,6 @@ import (
"gvisor.dev/gvisor/pkg/sentry/kernel"
"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
"gvisor.dev/gvisor/pkg/sentry/vfs"
- "gvisor.dev/gvisor/pkg/syserror"
"gvisor.dev/gvisor/runsc/config"
"gvisor.dev/gvisor/runsc/specutils"
@@ -69,7 +69,7 @@ const (
// tmpfs has some extra supported options that we must pass through.
var tmpfsAllowedData = []string{"mode", "uid", "gid"}
-func addOverlay(ctx context.Context, conf *config.Config, lower *fs.Inode, name string, lowerFlags fs.MountSourceFlags) (*fs.Inode, error) {
+func addOverlay(ctx context.Context, lower *fs.Inode, name string, lowerFlags fs.MountSourceFlags) (*fs.Inode, error) {
// Upper layer uses the same flags as lower, but it must be read-write.
upperFlags := lowerFlags
upperFlags.ReadOnly = false
@@ -744,7 +744,7 @@ func (c *containerMounter) mountSharedMaster(ctx context.Context, conf *config.C
if useOverlay {
log.Debugf("Adding overlay on top of shared mount %q", hint.name)
- inode, err = addOverlay(ctx, conf, inode, hint.mount.Type, mf)
+ inode, err = addOverlay(ctx, inode, hint.mount.Type, mf)
if err != nil {
return nil, err
}
@@ -785,7 +785,7 @@ func (c *containerMounter) createRootMount(ctx context.Context, conf *config.Con
if conf.Overlay && !c.root.Readonly {
log.Debugf("Adding overlay on top of root mount")
// Overlay a tmpfs filesystem on top of the root.
- rootInode, err = addOverlay(ctx, conf, rootInode, "root-overlay-upper", mf)
+ rootInode, err = addOverlay(ctx, rootInode, "root-overlay-upper", mf)
if err != nil {
return nil, err
}
@@ -901,7 +901,7 @@ func (c *containerMounter) mountSubmount(ctx context.Context, conf *config.Confi
if useOverlay {
log.Debugf("Adding overlay on top of mount %q", m.Destination)
- inode, err = addOverlay(ctx, conf, inode, m.Type, mf)
+ inode, err = addOverlay(ctx, inode, m.Type, mf)
if err != nil {
return err
}
@@ -1039,8 +1039,8 @@ func (c *containerMounter) mountTmp(ctx context.Context, conf *config.Config, mn
maxTraversals := uint(0)
tmp, err := mns.FindInode(ctx, root, root, "tmp", &maxTraversals)
- switch err {
- case nil:
+ switch {
+ case err == nil:
// Found '/tmp' in filesystem, check if it's empty.
defer tmp.DecRef(ctx)
f, err := tmp.Inode.GetFile(ctx, tmp, fs.FileFlags{Read: true, Directory: true})
@@ -1061,7 +1061,7 @@ func (c *containerMounter) mountTmp(ctx context.Context, conf *config.Config, mn
log.Infof("Mounting internal tmpfs on top of empty %q", "/tmp")
fallthrough
- case syserror.ENOENT:
+ case linuxerr.Equals(linuxerr.ENOENT, err):
// No '/tmp' found (or fallthrough from above). Safe to mount internal
// tmpfs.
tmpMount := specs.Mount{
diff --git a/runsc/boot/loader.go b/runsc/boot/loader.go
index 8d71d7447..898692219 100644
--- a/runsc/boot/loader.go
+++ b/runsc/boot/loader.go
@@ -633,8 +633,8 @@ func (l *Loader) run() error {
return l.k.Start()
}
-// createContainer creates a new container inside the sandbox.
-func (l *Loader) createContainer(cid string, tty *fd.FD) error {
+// createSubcontainer creates a new container inside the sandbox.
+func (l *Loader) createSubcontainer(cid string, tty *fd.FD) error {
l.mu.Lock()
defer l.mu.Unlock()
@@ -646,10 +646,10 @@ func (l *Loader) createContainer(cid string, tty *fd.FD) error {
return nil
}
-// startContainer starts a child container. It returns the thread group ID of
+// startSubcontainer starts a child container. It returns the thread group ID of
// the newly created process. Used FDs are either closed or released. It's safe
// for the caller to close any remaining files upon return.
-func (l *Loader) startContainer(spec *specs.Spec, conf *config.Config, cid string, stdioFDs, goferFDs []*fd.FD) error {
+func (l *Loader) startSubcontainer(spec *specs.Spec, conf *config.Config, cid string, stdioFDs, goferFDs []*fd.FD) error {
// Create capabilities.
caps, err := specutils.Capabilities(conf.EnableRaw, spec.Process.Capabilities)
if err != nil {
@@ -715,7 +715,7 @@ func (l *Loader) startContainer(spec *specs.Spec, conf *config.Config, cid strin
return fmt.Errorf("using TTY, stdios not expected: %d", l)
}
if ep.hostTTY == nil {
- return fmt.Errorf("terminal enabled but no TTY provided (--console-socket possibly passed)")
+ return fmt.Errorf("terminal enabled but no TTY provided. Did you set --console-socket on create?")
}
info.stdioFDs = []*fd.FD{ep.hostTTY, ep.hostTTY, ep.hostTTY}
ep.hostTTY = nil
@@ -734,7 +734,7 @@ func (l *Loader) startContainer(spec *specs.Spec, conf *config.Config, cid strin
func (l *Loader) createContainerProcess(root bool, cid string, info *containerInfo) (*kernel.ThreadGroup, *host.TTYFileOperations, *hostvfs2.TTYFileDescription, error) {
// Create the FD map, which will set stdin, stdout, and stderr.
ctx := info.procArgs.NewContext(l.k)
- fdTable, ttyFile, ttyFileVFS2, err := createFDTable(ctx, info.spec.Process.Terminal, info.stdioFDs)
+ fdTable, ttyFile, ttyFileVFS2, err := createFDTable(ctx, info.spec.Process.Terminal, info.stdioFDs, info.spec.Process.User)
if err != nil {
return nil, nil, nil, fmt.Errorf("importing fds: %w", err)
}
@@ -851,9 +851,9 @@ func (l *Loader) startGoferMonitor(cid string, goferFDs []*fd.FD) {
}()
}
-// destroyContainer stops a container if it is still running and cleans up its
-// filesystem.
-func (l *Loader) destroyContainer(cid string) error {
+// destroySubcontainer stops a container if it is still running and cleans up
+// its filesystem.
+func (l *Loader) destroySubcontainer(cid string) error {
l.mu.Lock()
defer l.mu.Unlock()
@@ -980,7 +980,7 @@ func (l *Loader) executeAsync(args *control.ExecArgs) (kernel.ThreadID, error) {
tty: ttyFile,
ttyVFS2: ttyFileVFS2,
}
- log.Debugf("updated processes: %s", l.processes)
+ log.Debugf("updated processes: %v", l.processes)
return tgid, nil
}
@@ -1001,7 +1001,7 @@ func (l *Loader) waitContainer(cid string, waitStatus *uint32) error {
// Check for leaks and write coverage report after the root container has
// exited. This guarantees that the report is written in cases where the
- // sandbox is killed by a signal after the ContainerWait request is completed.
+ // sandbox is killed by a signal after the ContMgrWait request is completed.
if l.root.procArgs.ContainerID == cid {
// All sentry-created resources should have been released at this point.
refsvfs2.DoLeakCheck()
@@ -1024,7 +1024,7 @@ func (l *Loader) waitPID(tgid kernel.ThreadID, cid string, waitStatus *uint32) e
l.mu.Lock()
delete(l.processes, eid)
- log.Debugf("updated processes (removal): %s", l.processes)
+ log.Debugf("updated processes (removal): %v", l.processes)
l.mu.Unlock()
return nil
}
@@ -1051,7 +1051,7 @@ func (l *Loader) waitPID(tgid kernel.ThreadID, cid string, waitStatus *uint32) e
// to exit.
func (l *Loader) wait(tg *kernel.ThreadGroup) uint32 {
tg.WaitExited()
- return tg.ExitStatus().Status()
+ return uint32(tg.ExitStatus())
}
// WaitForStartSignal waits for a start signal from the control server.
@@ -1060,7 +1060,7 @@ func (l *Loader) WaitForStartSignal() {
}
// WaitExit waits for the root container to exit, and returns its exit status.
-func (l *Loader) WaitExit() kernel.ExitStatus {
+func (l *Loader) WaitExit() linux.WaitStatus {
// Wait for container.
l.k.WaitExited()
@@ -1092,7 +1092,7 @@ func newRootNetworkNamespace(conf *config.Config, clock tcpip.Clock, uniqueID st
return inet.NewRootNamespace(s, creator), nil
default:
- panic(fmt.Sprintf("invalid network configuration: %d", conf.Network))
+ panic(fmt.Sprintf("invalid network configuration: %v", conf.Network))
}
}
@@ -1212,7 +1212,7 @@ func (l *Loader) signal(cid string, pid, signo int32, mode SignalDeliveryMode) e
return nil
default:
- panic(fmt.Sprintf("unknown signal delivery mode %s", mode))
+ panic(fmt.Sprintf("unknown signal delivery mode %v", mode))
}
}
@@ -1337,14 +1337,14 @@ func (l *Loader) ttyFromIDLocked(key execID) (*host.TTYFileOperations, *hostvfs2
return ep.tty, ep.ttyVFS2, nil
}
-func createFDTable(ctx context.Context, console bool, stdioFDs []*fd.FD) (*kernel.FDTable, *host.TTYFileOperations, *hostvfs2.TTYFileDescription, error) {
+func createFDTable(ctx context.Context, console bool, stdioFDs []*fd.FD, user specs.User) (*kernel.FDTable, *host.TTYFileOperations, *hostvfs2.TTYFileDescription, error) {
if len(stdioFDs) != 3 {
return nil, nil, nil, fmt.Errorf("stdioFDs should contain exactly 3 FDs (stdin, stdout, and stderr), but %d FDs received", len(stdioFDs))
}
k := kernel.KernelFromContext(ctx)
fdTable := k.NewFDTable()
- ttyFile, ttyFileVFS2, err := fdimport.Import(ctx, fdTable, console, stdioFDs)
+ ttyFile, ttyFileVFS2, err := fdimport.Import(ctx, fdTable, console, auth.KUID(user.UID), auth.KGID(user.GID), stdioFDs)
if err != nil {
fdTable.DecRef(ctx)
return nil, nil, nil, err
diff --git a/runsc/boot/loader_test.go b/runsc/boot/loader_test.go
index 93c476971..ac6c26d25 100644
--- a/runsc/boot/loader_test.go
+++ b/runsc/boot/loader_test.go
@@ -188,8 +188,8 @@ func doRun(t *testing.T, vfsEnabled bool) {
}
// Wait for the application to exit. It should succeed.
- if status := l.WaitExit(); status.Code != 0 || status.Signo != 0 {
- t.Errorf("application exited with status %+v, want 0", status)
+ if status := l.WaitExit(); !status.Exited() || status.ExitStatus() != 0 {
+ t.Errorf("application exited with %s, want exit status 0", status)
}
}
@@ -214,7 +214,7 @@ func doStartSignal(t *testing.T, vfsEnabled bool) {
// We aren't going to wait on this application, so the control server
// needs to be shut down manually.
- defer l.ctrl.srv.Stop()
+ defer l.ctrl.srv.Stop(time.Hour)
// Start a goroutine that calls WaitForStartSignal and writes to a
// channel when it returns.
diff --git a/runsc/boot/pprof/pprof.go b/runsc/boot/pprof/pprof.go
index 1ded20dee..36b78ad86 100644
--- a/runsc/boot/pprof/pprof.go
+++ b/runsc/boot/pprof/pprof.go
@@ -12,6 +12,9 @@
// See the License for the specific language governing permissions and
// limitations under the License.
+//go:build go1.1
+// +build go1.1
+
// Package pprof provides a stub to initialize custom profilers.
package pprof
diff --git a/runsc/boot/vfs.go b/runsc/boot/vfs.go
index 52aa33529..346796d9c 100644
--- a/runsc/boot/vfs.go
+++ b/runsc/boot/vfs.go
@@ -24,6 +24,7 @@ import (
"gvisor.dev/gvisor/pkg/abi/linux"
"gvisor.dev/gvisor/pkg/cleanup"
"gvisor.dev/gvisor/pkg/context"
+ "gvisor.dev/gvisor/pkg/errors/linuxerr"
"gvisor.dev/gvisor/pkg/fspath"
"gvisor.dev/gvisor/pkg/log"
"gvisor.dev/gvisor/pkg/sentry/devices/memdev"
@@ -44,7 +45,6 @@ import (
"gvisor.dev/gvisor/pkg/sentry/kernel"
"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
"gvisor.dev/gvisor/pkg/sentry/vfs"
- "gvisor.dev/gvisor/pkg/syserror"
"gvisor.dev/gvisor/runsc/config"
"gvisor.dev/gvisor/runsc/specutils"
)
@@ -656,20 +656,20 @@ func (c *containerMounter) mountTmpVFS2(ctx context.Context, conf *config.Config
Path: fspath.Parse("/tmp"),
}
fd, err := c.k.VFS().OpenAt(ctx, creds, &pop, &vfs.OpenOptions{Flags: linux.O_RDONLY | linux.O_DIRECTORY})
- switch err {
- case nil:
+ switch {
+ case err == nil:
defer fd.DecRef(ctx)
err := fd.IterDirents(ctx, vfs.IterDirentsCallbackFunc(func(dirent vfs.Dirent) error {
if dirent.Name != "." && dirent.Name != ".." {
- return syserror.ENOTEMPTY
+ return linuxerr.ENOTEMPTY
}
return nil
}))
- switch err {
- case nil:
+ switch {
+ case err == nil:
log.Infof(`Mounting internal tmpfs on top of empty "/tmp"`)
- case syserror.ENOTEMPTY:
+ case linuxerr.Equals(linuxerr.ENOTEMPTY, err):
// If more than "." and ".." is found, skip internal tmpfs to prevent
// hiding existing files.
log.Infof(`Skipping internal tmpfs mount for "/tmp" because it's not empty`)
@@ -679,7 +679,7 @@ func (c *containerMounter) mountTmpVFS2(ctx context.Context, conf *config.Config
}
fallthrough
- case syserror.ENOENT:
+ case linuxerr.Equals(linuxerr.ENOENT, err):
// No '/tmp' found (or fallthrough from above). It's safe to mount internal
// tmpfs.
tmpMount := specs.Mount{
@@ -692,7 +692,7 @@ func (c *containerMounter) mountTmpVFS2(ctx context.Context, conf *config.Config
_, err := c.mountSubmountVFS2(ctx, conf, mns, creds, &mountAndFD{mount: &tmpMount})
return err
- case syserror.ENOTDIR:
+ case linuxerr.Equals(linuxerr.ENOTDIR, err):
// Not a dir?! Let it be.
return nil
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-18 22:11:36 +0000