Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

lxcfs: tighten policy about write() syscall #630

Merged
merged 4 commits into from
Mar 18, 2024
Merged

lxcfs: tighten policy about write() syscall #630

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ce8e6e9
sysfs: forbid write()
mihalicyn Mar 15, 2024
000b539
lxcfs: introduce new option --enable-cgroup
mihalicyn Mar 15, 2024
6239e4b
tests: use --enable-cgroup for tests
mihalicyn Mar 15, 2024
3517755
github: workaround CI issue with ASAN
mihalicyn Mar 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .github/workflows/tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,12 @@ jobs:
- ubuntu-22.04
runs-on: ${{ matrix.os }}
steps:
# TODO(mihalicyn): Remove once the following is fixed:
# https://github.com/actions/runner-images/issues/9491
- name: Reduce ASLR entropy as a temporary workaround
run: |
sudo sysctl -w vm.mmap_rnd_bits=28

- name: Checkout code
uses: actions/checkout@v2

Expand Down Expand Up @@ -63,6 +69,12 @@ jobs:
- ubuntu-22.04
runs-on: ${{ matrix.os }}
steps:
# TODO(mihalicyn): Remove once the following is fixed:
# https://github.com/actions/runner-images/issues/9491
- name: Reduce ASLR entropy as a temporary workaround
run: |
sudo sysctl -w vm.mmap_rnd_bits=28

- name: Checkout code
uses: actions/checkout@v2

Expand Down
32 changes: 19 additions & 13 deletions src/lxcfs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -661,6 +661,8 @@ static int do_sys_releasedir(const char *path, struct fuse_file_info *fi)
return __sys_releasedir(path, fi);
}

static bool cgroup_is_enabled = false;

#if HAVE_FUSE3
static int lxcfs_getattr(const char *path, struct stat *sb, struct fuse_file_info *fi)
#else
Expand All @@ -681,7 +683,7 @@ static int lxcfs_getattr(const char *path, struct stat *sb)
return 0;
}

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_getattr(path, sb);
down_users();
Expand Down Expand Up @@ -712,7 +714,7 @@ static int lxcfs_opendir(const char *path, struct fuse_file_info *fi)
if (strcmp(path, "/") == 0)
return 0;

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_opendir(path, fi);
down_users();
Expand Down Expand Up @@ -747,13 +749,13 @@ static int lxcfs_readdir(const char *path, void *buf, fuse_fill_dir_t filler,
dir_filler(filler, buf, "..", 0) != 0 ||
dir_filler(filler, buf, "proc", 0) != 0 ||
dir_filler(filler, buf, "sys", 0) != 0 ||
dir_filler(filler, buf, "cgroup", 0) != 0)
(cgroup_is_enabled && dir_filler(filler, buf, "cgroup", 0) != 0))
return -ENOMEM;

return 0;
}

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_readdir(path, buf, filler, offset, fi);
down_users();
Expand Down Expand Up @@ -784,7 +786,7 @@ static int lxcfs_access(const char *path, int mode)
if (strcmp(path, "/") == 0 && (mode & W_OK) == 0)
return 0;

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_access(path, mode);
down_users();
Expand Down Expand Up @@ -846,7 +848,7 @@ static int lxcfs_open(const char *path, struct fuse_file_info *fi)
{
int ret;

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_open(path, fi);
down_users();
Expand Down Expand Up @@ -875,7 +877,7 @@ static int lxcfs_read(const char *path, char *buf, size_t size, off_t offset,
{
int ret;

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_read(path, buf, size, offset, fi);
down_users();
Expand Down Expand Up @@ -904,7 +906,7 @@ int lxcfs_write(const char *path, const char *buf, size_t size, off_t offset,
{
int ret;

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_write(path, buf, size, offset, fi);
down_users();
Expand Down Expand Up @@ -983,7 +985,7 @@ int lxcfs_mkdir(const char *path, mode_t mode)
{
int ret;

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_mkdir(path, mode);
down_users();
Expand All @@ -1001,7 +1003,7 @@ int lxcfs_chown(const char *path, uid_t uid, gid_t gid)
{
int ret;

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_chown(path, uid, gid);
down_users();
Expand All @@ -1028,7 +1030,7 @@ int lxcfs_truncate(const char *path, off_t newsize, struct fuse_file_info *fi)
int lxcfs_truncate(const char *path, off_t newsize)
#endif
{
if (strncmp(path, "/cgroup", 7) == 0)
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0)
return 0;

if (strncmp(path, "/sys", 4) == 0)
Expand All @@ -1041,7 +1043,7 @@ int lxcfs_rmdir(const char *path)
{
int ret;

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_rmdir(path);
down_users();
Expand All @@ -1059,7 +1061,7 @@ int lxcfs_chmod(const char *path, mode_t mode)
{
int ret;

if (strncmp(path, "/cgroup", 7) == 0) {
if (cgroup_is_enabled && strncmp(path, "/cgroup", 7) == 0) {
up_users();
ret = do_cg_chmod(path, mode);
down_users();
Expand Down Expand Up @@ -1190,6 +1192,7 @@ static void usage(void)
lxcfs_info(" -v, --version Print lxcfs version");
lxcfs_info(" --enable-cfs Enable CPU virtualization via CPU shares");
lxcfs_info(" --enable-pidfd Use pidfd for process tracking");
lxcfs_info(" --enable-cgroup Enable cgroup emulation code");
exit(EXIT_FAILURE);
}

Expand Down Expand Up @@ -1238,6 +1241,7 @@ static const struct option long_options[] = {

{"enable-cfs", no_argument, 0, 0 },
{"enable-pidfd", no_argument, 0, 0 },
{"enable-cgroup", no_argument, 0, 0 },

{"pidfile", required_argument, 0, 'p' },
{ },
Expand Down Expand Up @@ -1318,6 +1322,8 @@ int main(int argc, char *argv[])
opts->use_pidfd = true;
else if (strcmp(long_options[idx].name, "enable-cfs") == 0)
opts->use_cfs = true;
else if (strcmp(long_options[idx].name, "enable-cgroup") == 0)
cgroup_is_enabled = true;
else
usage();
break;
Expand Down
6 changes: 1 addition & 5 deletions src/sysfs_fuse.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -307,11 +307,7 @@ __lxcfs_fuse_ops int sys_write(const char *path, const char *buf, size_t size,
if (f->type != LXC_TYPE_SYS_DEVICES_SYSTEM_CPU_SUBFILE)
return -EINVAL;

fd = open(path, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return -errno;

return pwrite(fd, buf, size, offset);
return -EACCES;
}

static int sys_readdir_legacy(const char *path, void *buf, fuse_fill_dir_t filler,
Expand Down
2 changes: 1 addition & 1 deletion tests/main.sh.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ if [ -x ${lxcfs} ]; then
export LD_LIBRARY_PATH="{{LXCFS_BUILD_ROOT}}"
fi
echo "=> Spawning ${lxcfs} ${LXCFSDIR}"
${lxcfs} -p ${pidfile} ${LXCFSDIR} &
${lxcfs} --enable-cgroup -p ${pidfile} ${LXCFSDIR} &
LXCFSPID=$!
else
UNSHARE=0
Expand Down
Loading