Skip to content

Commit c4b23ff

Browse files
xibzxibz
committed
fixup! Adding runc jailing
Signed-off-by: xibz <[email protected]>
1 parent b39da6d commit c4b23ff

File tree

6 files changed

+43
-98
lines changed

6 files changed

+43
-98
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
.idea/
22
bin/
3+
runtime/logs
34
*stamp

‎proto/firecracker.proto‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ message CreateVMRequest {
3333
// Whether the VM should exit after all tasks running in it have been deleted.
3434
bool ExitAfterAllTasksDeleted = 9;
3535

36-
JailerConfig JailerConfig = 10;
36+
JailerConfig JailerConfig = 10;
3737
}
3838

3939
message StopVMRequest {
@@ -58,10 +58,10 @@ message SetVMMetadataRequest {
5858
}
5959

6060
message JailerConfig {
61-
// Determines whether or not the jailer should be disabled.
62-
//
63-
// Valid values are "ON", "OFF"
64-
string State = 1;
65-
uint32 UID = 2;
66-
uint32 GID = 3;
61+
// Determines whether or not the jailer should be disabled.
62+
//
63+
// Valid values are "ON", "OFF"
64+
string State = 1;
65+
uint32 UID = 2;
66+
uint32 GID = 3;
6767
}

‎runtime/firecracker-runc-config.json.example‎

Lines changed: 15 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"gid": 0
88
},
99
"env": [
10-
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
10+
"PATH=/usr/local/bin"
1111
],
1212
"cwd": "/",
1313
"capabilities": {
@@ -48,41 +48,6 @@
4848
"type": "proc",
4949
"source": "proc"
5050
},
51-
{
52-
"destination": "/dev/pts",
53-
"type": "devpts",
54-
"source": "devpts",
55-
"options": [
56-
"nosuid",
57-
"noexec",
58-
"newinstance",
59-
"ptmxmode=0666",
60-
"mode=0620",
61-
"gid=5"
62-
]
63-
},
64-
{
65-
"destination": "/dev/shm",
66-
"type": "tmpfs",
67-
"source": "shm",
68-
"options": [
69-
"nosuid",
70-
"noexec",
71-
"nodev",
72-
"mode=1777",
73-
"size=65536k"
74-
]
75-
},
76-
{
77-
"destination": "/dev/mqueue",
78-
"type": "mqueue",
79-
"source": "mqueue",
80-
"options": [
81-
"nosuid",
82-
"noexec",
83-
"nodev"
84-
]
85-
},
8651
{
8752
"destination": "/sys",
8853
"type": "sysfs",
@@ -141,6 +106,20 @@
141106
"devices": [
142107
{
143108
"allow": true,
109+
"major": 10,
110+
"minor": 232,
111+
"access": "rwm"
112+
},
113+
{
114+
"allow": true,
115+
"major": 10,
116+
"minor": 200,
117+
"access": "rwm"
118+
},
119+
{
120+
"allow": true,
121+
"major": 10,
122+
"minor": 241,
144123
"access": "rwm"
145124
}
146125
]

‎runtime/jailer.go‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -123,27 +123,28 @@ func (j *jailer) BuildHandler(logger *logrus.Entry, cfg *Config, socketPath *str
123123
return firecracker.Handler{
124124
Name: jailerHandlerName,
125125
Fn: func(ctx context.Context, m *firecracker.Machine) error {
126+
mode := os.FileMode(0700)
126127
// Create the proper paths needed for the runc jailer
127128
logger.Debugf("Creating root drive path %v", rootPath)
128-
if err := os.MkdirAll(rootPath, 0777); err != nil {
129+
if err := os.MkdirAll(rootPath, mode); err != nil {
129130
return errors.Wrapf(err, "failed to create root path: %v", rootPath)
130131
}
131132

132133
binPath := filepath.Join(rootPath, "usr", "local", "bin")
133134
logger.Debugf("Creating /usr/local/bin %v", binPath)
134-
if err := os.MkdirAll(binPath, 0777); err != nil {
135+
if err := os.MkdirAll(binPath, mode); err != nil {
135136
return errors.Wrapf(err, "failed to create /usr/local/bin in root path: %v", binPath)
136137
}
137138

138139
devPath := filepath.Join(rootPath, "dev")
139140
logger.Debugf("Creating /dev/net %v", devPath)
140-
if err := os.MkdirAll(filepath.Join(devPath, "net"), 0777); err != nil {
141+
if err := os.MkdirAll(filepath.Join(devPath, "net"), mode); err != nil {
141142
return errors.Wrapf(err, "failed to create device path: %v", devPath)
142143
}
143144

144145
contentsPath := j.ContentsPath()
145146
logger.Debugf("Creating firecracker contents path %v", contentsPath)
146-
if err := os.MkdirAll(contentsPath, 0777); err != nil {
147+
if err := os.MkdirAll(contentsPath, mode); err != nil {
147148
return errors.Wrapf(err, "failed to create contents path: %v", contentsPath)
148149
}
149150

‎runtime/jailer_test.go‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -45,21 +45,6 @@ func TestCopyFile_invalidPaths(t *testing.T) {
4545
assert.Error(t, err, "copyFile should have returned an error")
4646
}
4747

48-
/*func TestCreateDevices(t *testing.T) {
49-
testPath, err := ioutil.TempDir("./", "TestCreateDevices")
50-
assert.NoError(t, err, "failed to create temp directory")
51-
err = os.MkdirAll(testPath, os.ModePerm)
52-
assert.NoErrorf(t, err, "failed to create %v", testPath)
53-
54-
defer func() {
55-
os.RemoveAll(testPath)
56-
}()
57-
58-
err = createDevices(testPath)
59-
assert.NoError(t, err, "failed to create devices")
60-
// TODO: ensure at least a device is created
61-
}*/
62-
6348
func TestChownR(t *testing.T) {
6449
internal.RequiresRoot(t)
6550

‎tools/docker/firecracker-runc-config.json‎

Lines changed: 15 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"api.socket"
1313
],
1414
"env": [
15-
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
15+
"PATH=/usr/local/bin"
1616
],
1717
"cwd": "/",
1818
"capabilities": {
@@ -50,41 +50,6 @@
5050
"type": "proc",
5151
"source": "proc"
5252
},
53-
{
54-
"destination": "/dev/pts",
55-
"type": "devpts",
56-
"source": "devpts",
57-
"options": [
58-
"nosuid",
59-
"noexec",
60-
"newinstance",
61-
"ptmxmode=0666",
62-
"mode=0620",
63-
"gid=5"
64-
]
65-
},
66-
{
67-
"destination": "/dev/shm",
68-
"type": "tmpfs",
69-
"source": "shm",
70-
"options": [
71-
"nosuid",
72-
"noexec",
73-
"nodev",
74-
"mode=1777",
75-
"size=65536k"
76-
]
77-
},
78-
{
79-
"destination": "/dev/mqueue",
80-
"type": "mqueue",
81-
"source": "mqueue",
82-
"options": [
83-
"nosuid",
84-
"noexec",
85-
"nodev"
86-
]
87-
},
8853
{
8954
"destination": "/sys",
9055
"type": "sysfs",
@@ -143,6 +108,20 @@
143108
"devices": [
144109
{
145110
"allow": true,
111+
"major": 10,
112+
"minor": 232,
113+
"access": "rwm"
114+
},
115+
{
116+
"allow": true,
117+
"major": 10,
118+
"minor": 200,
119+
"access": "rwm"
120+
},
121+
{
122+
"allow": true,
123+
"major": 10,
124+
"minor": 241,
146125
"access": "rwm"
147126
}
148127
]

0 commit comments

Comments
 (0)