Refactor device handling code

We now have one place that keeps track of (most) devices that are allowed and created within the container.  That place is pkg/libcontainer/devices/devices.go

This fixes several inconsistencies between which devices were created in the lxc backend and the native backend.  It also fixes inconsistencies between wich devices were created and which were allowed.  For example, /dev/full was being created but it was not allowed within the cgroup.  It also declares the file modes and permissions of the default devices, rather than copying them from the host.  This is in line with docker's philosphy of not being host dependent.

Docker-DCO-1.1-Signed-off-by: Timothy Hobbs <timothyhobbs@seznam.cz> (github: https://github.com/timthelion)
This commit is contained in:
Timothy Hobbs 2014-02-17 15:14:30 -08:00 committed by Timothy
parent c8a8176936
commit 193f9894c0
11 changed files with 377 additions and 144 deletions

View file

@ -2,6 +2,8 @@ package cgroups
import ( import (
"errors" "errors"
"github.com/dotcloud/docker/pkg/libcontainer/devices"
) )
var ( var (
@ -10,17 +12,18 @@ var (
type Cgroup struct { type Cgroup struct {
Name string `json:"name,omitempty"` Name string `json:"name,omitempty"`
Parent string `json:"parent,omitempty"` Parent string `json:"parent,omitempty"` // name of parent cgroup or slice
DeviceAccess bool `json:"device_access,omitempty"` // name of parent cgroup or slice AllowAllDevices bool `json:"allow_all_devices,omitempty"` // If this is true allow access to any kind of device within the container. If false, allow access only to devices explicitly listed in the allowed_devices list.
Memory int64 `json:"memory,omitempty"` // Memory limit (in bytes) AllowedDevices []devices.Device `json:"allowed_devices,omitempty"`
MemoryReservation int64 `json:"memory_reservation,omitempty"` // Memory reservation or soft_limit (in bytes) Memory int64 `json:"memory,omitempty"` // Memory limit (in bytes)
MemorySwap int64 `json:"memory_swap,omitempty"` // Total memory usage (memory + swap); set `-1' to disable swap MemoryReservation int64 `json:"memory_reservation,omitempty"` // Memory reservation or soft_limit (in bytes)
CpuShares int64 `json:"cpu_shares,omitempty"` // CPU shares (relative weight vs. other containers) MemorySwap int64 `json:"memory_swap,omitempty"` // Total memory usage (memory + swap); set `-1' to disable swap
CpuQuota int64 `json:"cpu_quota,omitempty"` // CPU hardcap limit (in usecs). Allowed cpu time in a given period. CpuShares int64 `json:"cpu_shares,omitempty"` // CPU shares (relative weight vs. other containers)
CpuPeriod int64 `json:"cpu_period,omitempty"` // CPU period to be used for hardcapping (in usecs). 0 to use system default. CpuQuota int64 `json:"cpu_quota,omitempty"` // CPU hardcap limit (in usecs). Allowed cpu time in a given period.
CpusetCpus string `json:"cpuset_cpus,omitempty"` // CPU to use CpuPeriod int64 `json:"cpu_period,omitempty"` // CPU period to be used for hardcapping (in usecs). 0 to use system default.
Freezer string `json:"freezer,omitempty"` // set the freeze value for the process CpusetCpus string `json:"cpuset_cpus,omitempty"` // CPU to use
Freezer string `json:"freezer,omitempty"` // set the freeze value for the process
Slice string `json:"slice,omitempty"` // Parent slice to use for systemd Slice string `json:"slice,omitempty"` // Parent slice to use for systemd
} }

View file

@ -9,41 +9,13 @@ func (s *devicesGroup) Set(d *data) error {
return err return err
} }
if !d.c.DeviceAccess { if !d.c.AllowAllDevices {
if err := writeFile(dir, "devices.deny", "a"); err != nil { if err := writeFile(dir, "devices.deny", "a"); err != nil {
return err return err
} }
allow := []string{ for _, dev := range d.c.AllowedDevices {
// allow mknod for any device if err := writeFile(dir, "devices.allow", dev.GetCgroupAllowString()); err != nil {
"c *:* m",
"b *:* m",
// /dev/null, zero, full
"c 1:3 rwm",
"c 1:5 rwm",
"c 1:7 rwm",
// consoles
"c 5:1 rwm",
"c 5:0 rwm",
"c 4:0 rwm",
"c 4:1 rwm",
// /dev/urandom,/dev/random
"c 1:9 rwm",
"c 1:8 rwm",
// /dev/pts/ - pts namespaces are "coming soon"
"c 136:* rwm",
"c 5:2 rwm",
// tuntap
"c 10:200 rwm",
}
for _, val := range allow {
if err := writeFile(dir, "devices.allow", val); err != nil {
return err return err
} }
} }

View file

@ -21,11 +21,6 @@ type systemdCgroup struct {
cleanupDirs []string cleanupDirs []string
} }
type DeviceAllow struct {
Node string
Permissions string
}
var ( var (
connLock sync.Mutex connLock sync.Mutex
theConn *systemd1.Conn theConn *systemd1.Conn
@ -116,24 +111,9 @@ func Apply(c *cgroups.Cgroup, pid int) (cgroups.ActiveCgroup, error) {
systemd1.Property{"PIDs", dbus.MakeVariant([]uint32{uint32(pid)})}, systemd1.Property{"PIDs", dbus.MakeVariant([]uint32{uint32(pid)})},
) )
if !c.DeviceAccess { if !c.AllowAllDevices {
properties = append(properties, properties = append(properties,
systemd1.Property{"DevicePolicy", dbus.MakeVariant("strict")}, systemd1.Property{"DevicePolicy", dbus.MakeVariant("strict")})
systemd1.Property{"DeviceAllow", dbus.MakeVariant([]DeviceAllow{
{"/dev/null", "rwm"},
{"/dev/zero", "rwm"},
{"/dev/full", "rwm"},
{"/dev/random", "rwm"},
{"/dev/urandom", "rwm"},
{"/dev/tty", "rwm"},
{"/dev/console", "rwm"},
{"/dev/tty0", "rwm"},
{"/dev/tty1", "rwm"},
{"/dev/pts/ptmx", "rwm"},
// There is no way to add /dev/pts/* here atm, so we hack this manually below
// /dev/pts/* (how to add this?)
// Same with tuntap, which doesn't exist as a node most of the time
})})
} }
// Always enable accounting, this gets us the same behaviour as the fs implementation, // Always enable accounting, this gets us the same behaviour as the fs implementation,
@ -167,28 +147,16 @@ func Apply(c *cgroups.Cgroup, pid int) (cgroups.ActiveCgroup, error) {
cgroup := props["ControlGroup"].(string) cgroup := props["ControlGroup"].(string)
if !c.DeviceAccess { if !c.AllowAllDevices {
mountpoint, err := cgroups.FindCgroupMountpoint("devices") mountpoint, err := cgroups.FindCgroupMountpoint("devices")
if err != nil { if err != nil {
return nil, err return nil, err
} }
path := filepath.Join(mountpoint, cgroup) dir := filepath.Join(mountpoint, cgroup)
// We use the same method of allowing devices as in the fs backend. This needs to be changed to use DBUS as soon as possible. However, that change has to wait untill http://cgit.freedesktop.org/systemd/systemd/commit/?id=90060676c442604780634c0a993e3f9c3733f8e6 has been applied in most commonly used systemd versions.
allow := []string{ for _, dev := range c.AllowedDevices {
// allow mknod for any device if err := writeFile(dir, "devices.allow", dev.GetCgroupAllowString()); err != nil {
"c *:* m",
"b *:* m",
// /dev/pts/ - pts namespaces are "coming soon"
"c 136:* rwm",
// tuntap
"c 10:200 rwm",
}
for _, val := range allow {
if err := ioutil.WriteFile(filepath.Join(path, "devices.allow"), []byte(val), 0700); err != nil {
return nil, err return nil, err
} }
} }
@ -295,6 +263,10 @@ func Apply(c *cgroups.Cgroup, pid int) (cgroups.ActiveCgroup, error) {
return &res, nil return &res, nil
} }
func writeFile(dir, file, data string) error {
return ioutil.WriteFile(filepath.Join(dir, file), []byte(data), 0700)
}
func (c *systemdCgroup) Cleanup() error { func (c *systemdCgroup) Cleanup() error {
// systemd cleans up, we don't need to do much // systemd cleans up, we don't need to do much

View file

@ -2,6 +2,7 @@ package libcontainer
import ( import (
"github.com/dotcloud/docker/pkg/libcontainer/cgroups" "github.com/dotcloud/docker/pkg/libcontainer/cgroups"
"github.com/dotcloud/docker/pkg/libcontainer/devices"
) )
// Context is a generic key value pair that allows arbatrary data to be sent // Context is a generic key value pair that allows arbatrary data to be sent
@ -60,13 +61,8 @@ type Container struct {
// rootfs and mount namespace if specified // rootfs and mount namespace if specified
Mounts Mounts `json:"mounts,omitempty"` Mounts Mounts `json:"mounts,omitempty"`
// RequiredDeviceNodes are a list of device nodes that will be mknod into the container's rootfs at /dev // The device nodes that should be automatically created within the container upon container start. Note, make sure that the node is marked as allowed in the cgroup as well!
// If the host system does not support the device that the container requests an error is returned DeviceNodes []devices.Device `json:"device_nodes,omitempty"`
RequiredDeviceNodes []string `json:"required_device_nodes,omitempty"`
// OptionalDeviceNodes are a list of device nodes that will be mknod into the container's rootfs at /dev
// If the host system does not support the device that the container requests the error is ignored
OptionalDeviceNodes []string `json:"optional_device_nodes,omitempty"`
} }
// Network defines configuration for a container's networking stack // Network defines configuration for a container's networking stack

View file

@ -44,12 +44,54 @@
"type": "devtmpfs" "type": "devtmpfs"
} }
], ],
"required_device_nodes": [ "device_nodes": [
"/dev/null", {
"/dev/zero", "path": "/dev/null",
"/dev/full", "type": 99,
"/dev/random", "major_number": 1,
"/dev/urandom", "minor_number": 3,
"/dev/tty" "cgroup_permissions": "rwm",
"file_mode": 438
},
{
"path": "/dev/zero",
"type": 99,
"major_number": 1,
"minor_number": 5,
"cgroup_permissions": "rwm",
"file_mode": 438
},
{
"path": "/dev/full",
"type": 99,
"major_number": 1,
"minor_number": 7,
"cgroup_permissions": "rwm",
"file_mode": 438
},
{
"path": "/dev/tty",
"type": 99,
"major_number": 5,
"minor_number": 0,
"cgroup_permissions": "rwm",
"file_mode": 438
},
{
"path": "/dev/urandom",
"type": 99,
"major_number": 1,
"minor_number": 9,
"cgroup_permissions": "rwm",
"file_mode": 438
},
{
"path": "/dev/random",
"type": 99,
"major_number": 1,
"minor_number": 8,
"cgroup_permissions": "rwm",
"file_mode": 438
}
] ]
} }

View file

@ -4,8 +4,6 @@ import (
"encoding/json" "encoding/json"
"os" "os"
"testing" "testing"
"github.com/dotcloud/docker/pkg/libcontainer/mount/nodes"
) )
// Checks whether the expected capability is specified in the capabilities. // Checks whether the expected capability is specified in the capabilities.
@ -63,11 +61,4 @@ func TestContainerJsonFormat(t *testing.T) {
t.Log("capabilities mask should not contain SYS_CHROOT") t.Log("capabilities mask should not contain SYS_CHROOT")
t.Fail() t.Fail()
} }
for _, n := range nodes.DefaultNodes {
if !contains(n, container.RequiredDeviceNodes) {
t.Logf("devices should contain %s", n)
t.Fail()
}
}
} }

View file

@ -0,0 +1,239 @@
package devices
import (
"fmt"
"os"
"syscall"
)
const (
Wildcard = -1
)
type Device struct {
Type rune `json:"type,omitempty"`
Path string `json:"path,omitempty"` // It is fine if this is an empty string in the case that you are using Wildcards
MajorNumber int64 `json:"major_number,omitempty"` // Use the wildcard constant for wildcards.
MinorNumber int64 `json:"minor_number,omitempty"` // Use the wildcard constant for wildcards.
CgroupPermissions string `json:"cgroup_permissions,omitempty"` // Typically just "rwm"
FileMode os.FileMode `json:"file_mode,omitempty"` // The permission bits of the file's mode
}
func GetDeviceNumberString(deviceNumber int64) string {
if deviceNumber == Wildcard {
return "*"
} else {
return fmt.Sprintf("%d", deviceNumber)
}
}
func (device Device) GetCgroupAllowString() string {
return fmt.Sprintf("%c %s:%s %s", device.Type, GetDeviceNumberString(device.MajorNumber), GetDeviceNumberString(device.MinorNumber), device.CgroupPermissions)
}
// Given the path to a device and it's cgroup_permissions(which cannot be easilly queried) look up the information about a linux device and return that information as a Device struct.
func GetDevice(path string, cgroupPermissions string) (Device, error) {
var (
err error
fileInfo os.FileInfo
mode os.FileMode
fileModePermissionBits os.FileMode
devType rune
devNumber int
stat_t *syscall.Stat_t
ok bool
device Device
)
fileInfo, err = os.Stat(path)
if err != nil {
return Device{}, err
}
mode = fileInfo.Mode()
fileModePermissionBits = os.FileMode.Perm(mode)
switch {
case (mode & os.ModeDevice) == 0:
return Device{}, fmt.Errorf("%s is not a device", path)
case (mode & os.ModeCharDevice) != 0:
fileModePermissionBits |= syscall.S_IFCHR
devType = 'c'
default:
fileModePermissionBits |= syscall.S_IFBLK
devType = 'b'
}
stat_t, ok = fileInfo.Sys().(*syscall.Stat_t)
if !ok {
return Device{}, fmt.Errorf("cannot determine the device number for device %s", path)
}
devNumber = int(stat_t.Rdev)
device = Device{
Type: devType,
Path: path,
MajorNumber: Major(devNumber),
MinorNumber: Minor(devNumber),
CgroupPermissions: cgroupPermissions,
FileMode: fileModePermissionBits,
}
return device, nil
}
var (
// These are devices that are to be both allowed and created.
DefaultSimpleDevices = []Device{
// /dev/null and zero
{
Path: "/dev/null",
Type: 'c',
MajorNumber: 1,
MinorNumber: 3,
CgroupPermissions: "rwm",
FileMode: 0666,
},
{
Path: "/dev/zero",
Type: 'c',
MajorNumber: 1,
MinorNumber: 5,
CgroupPermissions: "rwm",
FileMode: 0666,
},
{
Path: "/dev/full",
Type: 'c',
MajorNumber: 1,
MinorNumber: 7,
CgroupPermissions: "rwm",
FileMode: 0666,
},
// consoles and ttys
{
Path: "/dev/tty",
Type: 'c',
MajorNumber: 5,
MinorNumber: 0,
CgroupPermissions: "rwm",
FileMode: 0666,
},
// /dev/urandom,/dev/random
{
Path: "/dev/urandom",
Type: 'c',
MajorNumber: 1,
MinorNumber: 9,
CgroupPermissions: "rwm",
FileMode: 0666,
},
{
Path: "/dev/random",
Type: 'c',
MajorNumber: 1,
MinorNumber: 8,
CgroupPermissions: "rwm",
FileMode: 0666,
},
}
DefaultAllowedDevices = append([]Device{
// allow mknod for any device
{
Type: 'c',
MajorNumber: Wildcard,
MinorNumber: Wildcard,
CgroupPermissions: "m",
},
{
Type: 'b',
MajorNumber: Wildcard,
MinorNumber: Wildcard,
CgroupPermissions: "m",
},
{
Path: "/dev/console",
Type: 'c',
MajorNumber: 5,
MinorNumber: 1,
CgroupPermissions: "rwm",
},
{
Path: "/dev/tty0",
Type: 'c',
MajorNumber: 4,
MinorNumber: 0,
CgroupPermissions: "rwm",
},
{
Path: "/dev/tty1",
Type: 'c',
MajorNumber: 4,
MinorNumber: 1,
CgroupPermissions: "rwm",
},
// /dev/pts/ - pts namespaces are "coming soon"
{
Path: "",
Type: 'c',
MajorNumber: 136,
MinorNumber: Wildcard,
CgroupPermissions: "rwm",
},
{
Path: "",
Type: 'c',
MajorNumber: 5,
MinorNumber: 2,
CgroupPermissions: "rwm",
},
// tuntap
{
Path: "",
Type: 'c',
MajorNumber: 10,
MinorNumber: 200,
CgroupPermissions: "rwm",
},
/*// fuse
{
Path: "",
Type: 'c',
MajorNumber: 10,
MinorNumber: 229,
CgroupPermissions: "rwm",
},
// rtc
{
Path: "",
Type: 'c',
MajorNumber: 254,
MinorNumber: 0,
CgroupPermissions: "rwm",
},
*/
}, DefaultSimpleDevices...)
DefaultAutoCreatedDevices = append([]Device{
{
// /dev/fuse is created but not allowed.
// This is to allow java to work. Because java
// Insists on there being a /dev/fuse
// https://github.com/dotcloud/docker/issues/514
// https://github.com/dotcloud/docker/issues/2393
//
Path: "/dev/fuse",
Type: 'c',
MajorNumber: 10,
MinorNumber: 229,
CgroupPermissions: "rwm",
},
}, DefaultSimpleDevices...)
)

View file

@ -0,0 +1,26 @@
package devices
/*
This code provides support for manipulating linux device numbers. It should be replaced by normal syscall functions once http://code.google.com/p/go/issues/detail?id=8106 is solved.
You can read what they are here:
- http://www.makelinux.net/ldd3/chp-3-sect-2
- http://www.linux-tutorial.info/modules.php?name=MContent&pageid=94
Note! These are NOT the same as the MAJOR(dev_t device);, MINOR(dev_t device); and MKDEV(int major, int minor); functions as defined in <linux/kdev_t.h> as the representation of device numbers used by go is different than the one used internally to the kernel! - https://github.com/torvalds/linux/blob/master/include/linux/kdev_t.h#L9
*/
func Major(devNumber int) int64 {
return int64((devNumber >> 8) & 0xfff)
}
func Minor(devNumber int) int64 {
return int64((devNumber & 0xff) | ((devNumber >> 12) & 0xfff00))
}
func Mkdev(majorNumber int64, minorNumber int64) int {
return int((majorNumber << 8) | (minorNumber & 0xff) | ((minorNumber & 0xfff00) << 12))
}

View file

@ -48,11 +48,8 @@ func InitializeMountNamespace(rootfs, console string, container *libcontainer.Co
if err := setupBindmounts(rootfs, container.Mounts); err != nil { if err := setupBindmounts(rootfs, container.Mounts); err != nil {
return fmt.Errorf("bind mounts %s", err) return fmt.Errorf("bind mounts %s", err)
} }
if err := nodes.CopyN(rootfs, container.RequiredDeviceNodes, true); err != nil { if err := nodes.CreateDeviceNodes(rootfs, container.DeviceNodes); err != nil {
return fmt.Errorf("copy required dev nodes %s", err) return fmt.Errorf("create device nodes %s", err)
}
if err := nodes.CopyN(rootfs, container.OptionalDeviceNodes, false); err != nil {
return fmt.Errorf("copy optional dev nodes %s", err)
} }
if err := SetupPtmx(rootfs, console, container.Context["mount_label"]); err != nil { if err := SetupPtmx(rootfs, console, container.Context["mount_label"]); err != nil {
return err return err

View file

@ -9,47 +9,27 @@ import (
"path/filepath" "path/filepath"
"syscall" "syscall"
"github.com/dotcloud/docker/pkg/libcontainer/devices"
"github.com/dotcloud/docker/pkg/system" "github.com/dotcloud/docker/pkg/system"
) )
// Default list of device nodes to copy // Create the device nodes in the container.
var DefaultNodes = []string{ func CreateDeviceNodes(rootfs string, nodesToCreate []devices.Device) error {
"/dev/null",
"/dev/zero",
"/dev/full",
"/dev/random",
"/dev/urandom",
"/dev/tty",
}
// CopyN copies the device node from the host into the rootfs
func CopyN(rootfs string, nodesToCopy []string, shouldExist bool) error {
oldMask := system.Umask(0000) oldMask := system.Umask(0000)
defer system.Umask(oldMask) defer system.Umask(oldMask)
for _, node := range nodesToCopy { for _, node := range nodesToCreate {
if err := Copy(rootfs, node, shouldExist); err != nil { if err := CreateDeviceNode(rootfs, node); err != nil {
return err return err
} }
} }
return nil return nil
} }
// Copy copies the device node into the rootfs. If the node // Creates the device node in the rootfs of the container.
// on the host system does not exist and the boolean flag is passed func CreateDeviceNode(rootfs string, node devices.Device) error {
// an error will be returned
func Copy(rootfs, node string, shouldExist bool) error {
stat, err := os.Stat(node)
if err != nil {
if os.IsNotExist(err) && !shouldExist {
return nil
}
return err
}
var ( var (
dest = filepath.Join(rootfs, node) dest = filepath.Join(rootfs, node.Path)
st = stat.Sys().(*syscall.Stat_t)
parent = filepath.Dir(dest) parent = filepath.Dir(dest)
) )
@ -57,13 +37,23 @@ func Copy(rootfs, node string, shouldExist bool) error {
return err return err
} }
if err := system.Mknod(dest, st.Mode, int(st.Rdev)); err != nil && !os.IsExist(err) { fileMode := node.FileMode
return fmt.Errorf("mknod %s %s", node, err) switch node.Type {
case 'c':
fileMode |= syscall.S_IFCHR
case 'b':
fileMode |= syscall.S_IFBLK
default:
return fmt.Errorf("%c is not a valid device type for device %s", node.Type, node.Path)
}
if err := system.Mknod(dest, uint32(fileMode), devices.Mkdev(node.MajorNumber, node.MinorNumber)); err != nil && !os.IsExist(err) {
return fmt.Errorf("mknod %s %s", node.Path, err)
} }
return nil return nil
} }
func getNodes(path string) ([]string, error) { func getDeviceNodes(path string) ([]string, error) {
out := []string{} out := []string{}
files, err := ioutil.ReadDir(path) files, err := ioutil.ReadDir(path)
if err != nil { if err != nil {
@ -71,7 +61,7 @@ func getNodes(path string) ([]string, error) {
} }
for _, f := range files { for _, f := range files {
if f.IsDir() && f.Name() != "pts" && f.Name() != "shm" { if f.IsDir() && f.Name() != "pts" && f.Name() != "shm" {
sub, err := getNodes(filepath.Join(path, f.Name())) sub, err := getDeviceNodes(filepath.Join(path, f.Name()))
if err != nil { if err != nil {
return nil, err return nil, err
} }
@ -84,5 +74,5 @@ func getNodes(path string) ([]string, error) {
} }
func GetHostDeviceNodes() ([]string, error) { func GetHostDeviceNodes() ([]string, error) {
return getNodes("/dev") return getDeviceNodes("/dev")
} }

View file

@ -2,10 +2,15 @@
package nodes package nodes
import "github.com/dotcloud/docker/pkg/libcontainer" import (
"github.com/dotcloud/docker/pkg/libcontainer"
var DefaultNodes = []string{} "github.com/dotcloud/docker/pkg/libcontainer/devices"
)
func GetHostDeviceNodes() ([]string, error) { func GetHostDeviceNodes() ([]string, error) {
return nil, libcontainer.ErrUnsupported return nil, libcontainer.ErrUnsupported
} }
func CreateDeviceNodes(rootfs string, nodesToCreate []devices.Device) error {
return libcontainer.ErrUnsupported
}