From fd16a329ce0c9fa1e7dd4c0fc1edc201f4c19571 Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Mon, 24 Jun 2019 21:43:14 -0700 Subject: fsgopher: reopen files via /proc/self/fd When we reopen file by path, we can't be sure that we will open exactly the same file. The file can be deleted and another one with the same name can be created. PiperOrigin-RevId: 254898594 --- runsc/cmd/gofer.go | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'runsc/cmd') diff --git a/runsc/cmd/gofer.go b/runsc/cmd/gofer.go index 52609a57a..9faabf494 100644 --- a/runsc/cmd/gofer.go +++ b/runsc/cmd/gofer.go @@ -152,6 +152,10 @@ func (g *Gofer) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) // modes exactly as sent by the sandbox, which will have applied its own umask. syscall.Umask(0) + if err := fsgofer.OpenProcSelfFD(); err != nil { + Fatalf("failed to open /proc/self/fd: %v", err) + } + if err := syscall.Chroot(root); err != nil { Fatalf("failed to chroot to %q: %v", root, err) } -- cgit v1.2.3