Skip to content

Commit 4865958

Browse files
committed
fixup! Adding runc jailing
Signed-off-by: xibz <[email protected]>
1 parent 59e68dd commit 4865958

14 files changed

+402
-297
lines changed

proto/firecracker.pb.go

Lines changed: 97 additions & 40 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

proto/firecracker.proto

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,7 @@ message CreateVMRequest {
3333
// Whether the VM should exit after all tasks running in it have been deleted.
3434
bool ExitAfterAllTasksDeleted = 9;
3535

36-
// Determines whether or not the jailer should be disabled.
37-
//
38-
// Valid values are "ON", "OFF"
39-
string Jailing = 10;
36+
JailerConfig JailerConfig = 10;
4037
}
4138

4239
message StopVMRequest {
@@ -59,3 +56,12 @@ message SetVMMetadataRequest {
5956
string VMID = 1;
6057
string Metadata = 2;
6158
}
59+
60+
message JailerConfig {
61+
// Determines whether or not the jailer should be disabled.
62+
//
63+
// Valid values are "ON", "OFF"
64+
string State = 1;
65+
uint32 UID = 2;
66+
uint32 GID = 3;
67+
}

runtime/Makefile

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -49,10 +49,6 @@ integ-test:
4949
--volume /dev:/dev \
5050
--volume /run/udev/control:/run/udev/control \
5151
--volume $(CURDIR)/logs:/var/log/firecracker-containerd-test \
52-
--device=/dev/vhost-vsock:/dev/vhost-vsock \
53-
--device=/dev/vsock:/dev/vsock \
54-
--device=/dev/kvm:/dev/kvm \
55-
--device=/dev/loop-control:/dev/loop-control \
5652
--env ENABLE_ISOLATED_TESTS=1 \
5753
--workdir="/firecracker-containerd/runtime" \
5854
--init \

runtime/config.go

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,11 @@ type Config struct {
4848
HtEnabled bool `json:"ht_enabled"`
4949
Debug bool `json:"debug"`
5050

51+
JailerConfig JailerConfig `json:"jailer"`
52+
}
53+
54+
// JailerConfig houses a set of configurable values for jailing
55+
type JailerConfig struct {
5156
DisableJailing bool `json:"disable_jailing"`
5257
UID *int `json:"uid"`
5358
GID *int `json:"gid"`
@@ -87,18 +92,18 @@ var (
8792
// file
8893
ErrNoUIDProvided = fmt.Errorf("no uid provided in configuration")
8994
// ErrNoGIDProvided returns when no GID was specified in the configuration
90-
// file
95+
// filme
9196
ErrNoGIDProvided = fmt.Errorf("no gid provided in configuration")
9297
)
9398

9499
// Validate ensures that the configuration file has valid values
95100
func (c *Config) Validate() error {
96-
if !c.DisableJailing {
97-
if c.UID == nil {
101+
if !c.JailerConfig.DisableJailing {
102+
if c.JailerConfig.UID == nil {
98103
return ErrNoUIDProvided
99104
}
100105

101-
if c.GID == nil {
106+
if c.JailerConfig.GID == nil {
102107
return ErrNoGIDProvided
103108
}
104109
}

runtime/drive_handler.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ func (h *stubDriveHandler) createStubDrive(driveID, path string) error {
111111
h.logger.WithError(err).Errorf("unexpected error during %v close", f.Name())
112112
}
113113
}()
114-
if err := f.Chmod(0666); err != nil {
114+
if err := f.Chmod(0600); err != nil {
115115
return err
116116
}
117117

runtime/firecracker-runc-config.json.example

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,7 @@
77
"gid": 0
88
},
99
"env": [
10-
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
11-
"TERM=xterm"
10+
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
1211
],
1312
"cwd": "/",
1413
"capabilities": {
@@ -109,6 +108,35 @@
109108
}
110109
],
111110
"linux": {
111+
"devices": [
112+
{
113+
"path": "/dev/kvm",
114+
"type": "c",
115+
"major": 10,
116+
"minor": 232,
117+
"fileMode": 438,
118+
"uid": 0,
119+
"gid": 0
120+
},
121+
{
122+
"path": "/dev/net/tun",
123+
"type": "c",
124+
"major": 10,
125+
"minor": 200,
126+
"fileMode": 438,
127+
"uid": 0,
128+
"gid": 0
129+
},
130+
{
131+
"path": "/dev/vhost-vsock",
132+
"type": "c",
133+
"major": 10,
134+
"minor": 241,
135+
"fileMode": 438,
136+
"uid": 0,
137+
"gid": 0
138+
}
139+
],
112140
"resources": {
113141
"devices": [
114142
{

0 commit comments

Comments
 (0)