mirror of
https://github.com/NixOS/nix.git
synced 2025-11-16 15:32:43 +01:00
e4f62e4608
* It is tough to contribute to a project that doesn't use a formatter, * It is extra hard to contribute to a project which has configured the formatter, but ignores it for some files * Code formatting makes it harder to hide obscure / weird bugs by accident or on purpose, Let's rip the bandaid off? Note that PRs currently in flight should be able to be merged relatively easily by applying `clang-format` to their tip prior to merge.
135 lines
4.1 KiB
C++
135 lines
4.1 KiB
C++
#include "nix/util/linux-namespaces.hh"
|
|
#include "nix/util/current-process.hh"
|
|
#include "nix/util/util.hh"
|
|
#include "nix/util/finally.hh"
|
|
#include "nix/util/file-system.hh"
|
|
#include "nix/util/processes.hh"
|
|
#include "nix/util/signals.hh"
|
|
|
|
#include <mutex>
|
|
#include <sys/resource.h>
|
|
#include "nix/util/cgroup.hh"
|
|
|
|
#include <sys/mount.h>
|
|
|
|
namespace nix {
|
|
|
|
bool userNamespacesSupported()
|
|
{
|
|
static auto res = [&]() -> bool {
|
|
if (!pathExists("/proc/self/ns/user")) {
|
|
debug("'/proc/self/ns/user' does not exist; your kernel was likely built without CONFIG_USER_NS=y");
|
|
return false;
|
|
}
|
|
|
|
Path maxUserNamespaces = "/proc/sys/user/max_user_namespaces";
|
|
if (!pathExists(maxUserNamespaces) || trim(readFile(maxUserNamespaces)) == "0") {
|
|
debug("user namespaces appear to be disabled; check '/proc/sys/user/max_user_namespaces'");
|
|
return false;
|
|
}
|
|
|
|
Path procSysKernelUnprivilegedUsernsClone = "/proc/sys/kernel/unprivileged_userns_clone";
|
|
if (pathExists(procSysKernelUnprivilegedUsernsClone)
|
|
&& trim(readFile(procSysKernelUnprivilegedUsernsClone)) == "0") {
|
|
debug("user namespaces appear to be disabled; check '/proc/sys/kernel/unprivileged_userns_clone'");
|
|
return false;
|
|
}
|
|
|
|
try {
|
|
Pid pid = startProcess([&]() { _exit(0); }, {.cloneFlags = CLONE_NEWUSER});
|
|
|
|
auto r = pid.wait();
|
|
assert(!r);
|
|
} catch (SysError & e) {
|
|
debug("user namespaces do not work on this system: %s", e.msg());
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}();
|
|
return res;
|
|
}
|
|
|
|
bool mountAndPidNamespacesSupported()
|
|
{
|
|
static auto res = [&]() -> bool {
|
|
try {
|
|
|
|
Pid pid = startProcess(
|
|
[&]() {
|
|
/* Make sure we don't remount the parent's /proc. */
|
|
if (mount(0, "/", 0, MS_PRIVATE | MS_REC, 0) == -1)
|
|
_exit(1);
|
|
|
|
/* Test whether we can remount /proc. The kernel disallows
|
|
this if /proc is not fully visible, i.e. if there are
|
|
filesystems mounted on top of files inside /proc. See
|
|
https://lore.kernel.org/lkml/87tvsrjai0.fsf@xmission.com/T/. */
|
|
if (mount("none", "/proc", "proc", 0, 0) == -1)
|
|
_exit(2);
|
|
|
|
_exit(0);
|
|
},
|
|
{.cloneFlags = CLONE_NEWNS | CLONE_NEWPID | (userNamespacesSupported() ? CLONE_NEWUSER : 0)});
|
|
|
|
if (pid.wait()) {
|
|
debug("PID namespaces do not work on this system: cannot remount /proc");
|
|
return false;
|
|
}
|
|
|
|
} catch (SysError & e) {
|
|
debug("mount namespaces do not work on this system: %s", e.msg());
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}();
|
|
return res;
|
|
}
|
|
|
|
//////////////////////////////////////////////////////////////////////
|
|
|
|
static AutoCloseFD fdSavedMountNamespace;
|
|
static AutoCloseFD fdSavedRoot;
|
|
|
|
void saveMountNamespace()
|
|
{
|
|
static std::once_flag done;
|
|
std::call_once(done, []() {
|
|
fdSavedMountNamespace = open("/proc/self/ns/mnt", O_RDONLY);
|
|
if (!fdSavedMountNamespace)
|
|
throw SysError("saving parent mount namespace");
|
|
|
|
fdSavedRoot = open("/proc/self/root", O_RDONLY);
|
|
});
|
|
}
|
|
|
|
void restoreMountNamespace()
|
|
{
|
|
try {
|
|
auto savedCwd = std::filesystem::current_path();
|
|
|
|
if (fdSavedMountNamespace && setns(fdSavedMountNamespace.get(), CLONE_NEWNS) == -1)
|
|
throw SysError("restoring parent mount namespace");
|
|
|
|
if (fdSavedRoot) {
|
|
if (fchdir(fdSavedRoot.get()))
|
|
throw SysError("chdir into saved root");
|
|
if (chroot("."))
|
|
throw SysError("chroot into saved root");
|
|
}
|
|
|
|
if (chdir(savedCwd.c_str()) == -1)
|
|
throw SysError("restoring cwd");
|
|
} catch (Error & e) {
|
|
debug(e.msg());
|
|
}
|
|
}
|
|
|
|
void tryUnshareFilesystem()
|
|
{
|
|
if (unshare(CLONE_FS) != 0 && errno != EPERM && errno != ENOSYS)
|
|
throw SysError("unsharing filesystem state");
|
|
}
|
|
|
|
} // namespace nix
|