158 lines
6.1 KiB
Diff
158 lines
6.1 KiB
Diff
|
From 6ab61ac93e534aec1ea4d16e77c1c355c8286e64 Mon Sep 17 00:00:00 2001
|
||
|
From: Daan De Meyer <daan.j.demeyer@gmail.com>
|
||
|
Date: Thu, 27 Oct 2022 13:14:12 +0200
|
||
|
Subject: [PATCH] namespace: Add hidepid/subset support check
|
||
|
|
||
|
Using fsopen()/fsconfig(), we can check if hidepid/subset are supported to
|
||
|
avoid the noisy logs from the kernel if they aren't supported. This works
|
||
|
on centos/redhat 8 as well since they've backported fsopen()/fsconfig().
|
||
|
|
||
|
(cherry picked from commit 1c265fcd5963603d338233840129ecad8d9c1420)
|
||
|
|
||
|
Related #2138081
|
||
|
---
|
||
|
meson.build | 2 ++
|
||
|
src/basic/missing_syscall.h | 40 +++++++++++++++++++++++++++++++
|
||
|
src/core/namespace.c | 47 ++++++++++++++++++++++++++++++++-----
|
||
|
3 files changed, 83 insertions(+), 6 deletions(-)
|
||
|
|
||
|
diff --git a/meson.build b/meson.build
|
||
|
index 76ad51d3fb..7750534466 100644
|
||
|
--- a/meson.build
|
||
|
+++ b/meson.build
|
||
|
@@ -606,6 +606,8 @@ foreach ident : [
|
||
|
['mount_setattr', '''#include <sys/mount.h>'''],
|
||
|
['move_mount', '''#include <sys/mount.h>'''],
|
||
|
['open_tree', '''#include <sys/mount.h>'''],
|
||
|
+ ['fsopen', '''#include <sys/mount.h>'''],
|
||
|
+ ['fsconfig', '''#include <sys/mount.h>'''],
|
||
|
['getdents64', '''#include <dirent.h>'''],
|
||
|
]
|
||
|
|
||
|
diff --git a/src/basic/missing_syscall.h b/src/basic/missing_syscall.h
|
||
|
index 793d111c55..d54e59fdf9 100644
|
||
|
--- a/src/basic/missing_syscall.h
|
||
|
+++ b/src/basic/missing_syscall.h
|
||
|
@@ -593,6 +593,46 @@ static inline int missing_move_mount(
|
||
|
|
||
|
/* ======================================================================= */
|
||
|
|
||
|
+#if !HAVE_FSOPEN
|
||
|
+
|
||
|
+#ifndef FSOPEN_CLOEXEC
|
||
|
+#define FSOPEN_CLOEXEC 0x00000001
|
||
|
+#endif
|
||
|
+
|
||
|
+static inline int missing_fsopen(const char *fsname, unsigned flags) {
|
||
|
+# if defined __NR_fsopen && __NR_fsopen >= 0
|
||
|
+ return syscall(__NR_fsopen, fsname, flags);
|
||
|
+# else
|
||
|
+ errno = ENOSYS;
|
||
|
+ return -1;
|
||
|
+# endif
|
||
|
+}
|
||
|
+
|
||
|
+# define fsopen missing_fsopen
|
||
|
+#endif
|
||
|
+
|
||
|
+/* ======================================================================= */
|
||
|
+
|
||
|
+#if !HAVE_FSCONFIG
|
||
|
+
|
||
|
+#ifndef FSCONFIG_SET_STRING
|
||
|
+#define FSCONFIG_SET_STRING 1 /* Set parameter, supplying a string value */
|
||
|
+#endif
|
||
|
+
|
||
|
+static inline int missing_fsconfig(int fd, unsigned cmd, const char *key, const void *value, int aux) {
|
||
|
+# if defined __NR_fsconfig && __NR_fsconfig >= 0
|
||
|
+ return syscall(__NR_fsconfig, fd, cmd, key, value, aux);
|
||
|
+# else
|
||
|
+ errno = ENOSYS;
|
||
|
+ return -1;
|
||
|
+# endif
|
||
|
+}
|
||
|
+
|
||
|
+# define fsconfig missing_fsconfig
|
||
|
+#endif
|
||
|
+
|
||
|
+/* ======================================================================= */
|
||
|
+
|
||
|
#if !HAVE_GETDENTS64
|
||
|
|
||
|
static inline ssize_t missing_getdents64(int fd, void *buffer, size_t length) {
|
||
|
diff --git a/src/core/namespace.c b/src/core/namespace.c
|
||
|
index c3cced7410..852be3bdde 100644
|
||
|
--- a/src/core/namespace.c
|
||
|
+++ b/src/core/namespace.c
|
||
|
@@ -26,6 +26,7 @@
|
||
|
#include "list.h"
|
||
|
#include "loop-util.h"
|
||
|
#include "loopback-setup.h"
|
||
|
+#include "missing_syscall.h"
|
||
|
#include "mkdir-label.h"
|
||
|
#include "mount-util.h"
|
||
|
#include "mountpoint-util.h"
|
||
|
@@ -1073,6 +1074,27 @@ static int mount_sysfs(const MountEntry *m) {
|
||
|
return 1;
|
||
|
}
|
||
|
|
||
|
+static bool mount_option_supported(const char *fstype, const char *key, const char *value) {
|
||
|
+ _cleanup_close_ int fd = -1;
|
||
|
+ int r;
|
||
|
+
|
||
|
+ /* This function assumes support by default. Only if the fsconfig() call fails with -EINVAL/-EOPNOTSUPP
|
||
|
+ * will it report that the option/value is not supported. */
|
||
|
+
|
||
|
+ fd = fsopen(fstype, FSOPEN_CLOEXEC);
|
||
|
+ if (fd < 0) {
|
||
|
+ if (errno != ENOSYS)
|
||
|
+ log_debug_errno(errno, "Failed to open superblock context for '%s': %m", fstype);
|
||
|
+ return true; /* If fsopen() fails for whatever reason, assume the value is supported. */
|
||
|
+ }
|
||
|
+
|
||
|
+ r = fsconfig(fd, FSCONFIG_SET_STRING, key, value, 0);
|
||
|
+ if (r < 0 && !IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS))
|
||
|
+ log_debug_errno(errno, "Failed to set '%s=%s' on '%s' superblock context: %m", key, value, fstype);
|
||
|
+
|
||
|
+ return r >= 0 || !IN_SET(errno, EINVAL, EOPNOTSUPP);
|
||
|
+}
|
||
|
+
|
||
|
static int mount_procfs(const MountEntry *m, const NamespaceInfo *ns_info) {
|
||
|
_cleanup_free_ char *opts = NULL;
|
||
|
const char *entry_path;
|
||
|
@@ -1090,12 +1112,25 @@ static int mount_procfs(const MountEntry *m, const NamespaceInfo *ns_info) {
|
||
|
* per-instance, we'll exclusively use the textual value for hidepid=, since support was
|
||
|
* added in the same commit: if it's supported it is thus also per-instance. */
|
||
|
|
||
|
- opts = strjoin("hidepid=",
|
||
|
- ns_info->protect_proc == PROTECT_PROC_DEFAULT ? "off" :
|
||
|
- protect_proc_to_string(ns_info->protect_proc),
|
||
|
- ns_info->proc_subset == PROC_SUBSET_PID ? ",subset=pid" : "");
|
||
|
- if (!opts)
|
||
|
- return -ENOMEM;
|
||
|
+ const char *hpv = ns_info->protect_proc == PROTECT_PROC_DEFAULT ?
|
||
|
+ "off" :
|
||
|
+ protect_proc_to_string(ns_info->protect_proc);
|
||
|
+
|
||
|
+ /* hidepid= support was added in 5.8, so we can use fsconfig()/fsopen() (which were added in
|
||
|
+ * 5.2) to check if hidepid= is supported. This avoids a noisy dmesg log by the kernel when
|
||
|
+ * trying to use hidepid= on systems where it isn't supported. The same applies for subset=.
|
||
|
+ * fsopen()/fsconfig() was also backported on some distros which allows us to detect
|
||
|
+ * hidepid=/subset= support in even more scenarios. */
|
||
|
+
|
||
|
+ if (mount_option_supported("proc", "hidepid", hpv)) {
|
||
|
+ opts = strjoin("hidepid=", hpv);
|
||
|
+ if (!opts)
|
||
|
+ return -ENOMEM;
|
||
|
+ }
|
||
|
+
|
||
|
+ if (ns_info->proc_subset == PROC_SUBSET_PID && mount_option_supported("proc", "subset", "pid"))
|
||
|
+ if (!strextend_with_separator(&opts, ",", "subset=pid"))
|
||
|
+ return -ENOMEM;
|
||
|
}
|
||
|
|
||
|
entry_path = mount_entry_path(m);
|
||
|
--
|
||
|
2.38.1
|
||
|
|