2018-10-19 23:34:09 +00:00
|
|
|
// Copyright 2018 Google LLC
|
2018-04-27 17:37:02 +00:00
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
|
|
|
package boot
|
|
|
|
|
2018-05-15 17:17:19 +00:00
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"strconv"
|
|
|
|
"strings"
|
2018-06-28 16:45:52 +00:00
|
|
|
|
|
|
|
"gvisor.googlesource.com/gvisor/pkg/sentry/watchdog"
|
2018-05-15 17:17:19 +00:00
|
|
|
)
|
2018-04-27 17:37:02 +00:00
|
|
|
|
|
|
|
// PlatformType tells which platform to use.
|
|
|
|
type PlatformType int
|
|
|
|
|
|
|
|
const (
|
2018-06-25 17:40:24 +00:00
|
|
|
// PlatformPtrace runs the sandbox with the ptrace platform.
|
2018-04-27 17:37:02 +00:00
|
|
|
PlatformPtrace PlatformType = iota
|
|
|
|
|
2018-06-25 17:40:24 +00:00
|
|
|
// PlatformKVM runs the sandbox with the KVM platform.
|
2018-04-27 17:37:02 +00:00
|
|
|
PlatformKVM
|
|
|
|
)
|
|
|
|
|
|
|
|
// MakePlatformType converts type from string.
|
|
|
|
func MakePlatformType(s string) (PlatformType, error) {
|
|
|
|
switch s {
|
|
|
|
case "ptrace":
|
|
|
|
return PlatformPtrace, nil
|
|
|
|
case "kvm":
|
|
|
|
return PlatformKVM, nil
|
|
|
|
default:
|
|
|
|
return 0, fmt.Errorf("invalid platform type %q", s)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (p PlatformType) String() string {
|
|
|
|
switch p {
|
|
|
|
case PlatformPtrace:
|
|
|
|
return "ptrace"
|
|
|
|
case PlatformKVM:
|
|
|
|
return "kvm"
|
|
|
|
default:
|
|
|
|
return fmt.Sprintf("unknown(%d)", p)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// FileAccessType tells how the filesystem is accessed.
|
|
|
|
type FileAccessType int
|
|
|
|
|
|
|
|
const (
|
2018-09-07 19:27:44 +00:00
|
|
|
// FileAccessShared sends IO requests to a Gofer process that validates the
|
2018-04-27 17:37:02 +00:00
|
|
|
// requests and forwards them to the host.
|
2018-09-07 19:27:44 +00:00
|
|
|
FileAccessShared FileAccessType = iota
|
2018-04-27 17:37:02 +00:00
|
|
|
|
2018-09-07 19:27:44 +00:00
|
|
|
// FileAccessExclusive is the same as FileAccessShared, but enables
|
runsc: Change cache policy for root fs and volume mounts.
Previously, gofer filesystems were configured with the default "fscache"
policy, which caches filesystem metadata and contents aggressively. While this
setting is best for performance, it means that changes from inside the sandbox
may not be immediately propagated outside the sandbox, and vice-versa.
This CL changes volumes and the root fs configuration to use a new
"remote-revalidate" cache policy which tries to retain as much caching as
possible while still making fs changes visible across the sandbox boundary.
This cache policy is enabled by default for the root filesystem. The default
value for the "--file-access" flag is still "proxy", but the behavior is
changed to use the new cache policy.
A new value for the "--file-access" flag is added, called "proxy-exclusive",
which turns on the previous aggressive caching behavior. As the name implies,
this flag should be used when the sandbox has "exclusive" access to the
filesystem.
All volume mounts are configured to use the new cache policy, since it is
safest and most likely to be correct. There is not currently a way to change
this behavior, but it's possible to add such a mechanism in the future. The
configurability is a smaller issue for volumes, since most of the expensive
application fs operations (walking + stating files) will likely served by the
root fs.
PiperOrigin-RevId: 208735037
Change-Id: Ife048fab1948205f6665df8563434dbc6ca8cfc9
2018-08-14 23:24:46 +00:00
|
|
|
// extra caching for improved performance. It should only be used if
|
|
|
|
// the sandbox has exclusive access to the filesystem.
|
2018-09-07 19:27:44 +00:00
|
|
|
FileAccessExclusive
|
2018-04-27 17:37:02 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// MakeFileAccessType converts type from string.
|
|
|
|
func MakeFileAccessType(s string) (FileAccessType, error) {
|
|
|
|
switch s {
|
2018-09-07 19:27:44 +00:00
|
|
|
case "shared":
|
|
|
|
return FileAccessShared, nil
|
|
|
|
case "exclusive":
|
|
|
|
return FileAccessExclusive, nil
|
2018-04-27 17:37:02 +00:00
|
|
|
default:
|
|
|
|
return 0, fmt.Errorf("invalid file access type %q", s)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (f FileAccessType) String() string {
|
|
|
|
switch f {
|
2018-09-07 19:27:44 +00:00
|
|
|
case FileAccessShared:
|
|
|
|
return "shared"
|
|
|
|
case FileAccessExclusive:
|
|
|
|
return "exclusive"
|
2018-04-27 17:37:02 +00:00
|
|
|
default:
|
|
|
|
return fmt.Sprintf("unknown(%d)", f)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// NetworkType tells which network stack to use.
|
|
|
|
type NetworkType int
|
|
|
|
|
|
|
|
const (
|
|
|
|
// NetworkSandbox uses internal network stack, isolated from the host.
|
|
|
|
NetworkSandbox NetworkType = iota
|
|
|
|
|
|
|
|
// NetworkHost redirects network related syscalls to the host network.
|
|
|
|
NetworkHost
|
|
|
|
|
|
|
|
// NetworkNone sets up just loopback using netstack.
|
|
|
|
NetworkNone
|
|
|
|
)
|
|
|
|
|
|
|
|
// MakeNetworkType converts type from string.
|
|
|
|
func MakeNetworkType(s string) (NetworkType, error) {
|
|
|
|
switch s {
|
|
|
|
case "sandbox":
|
|
|
|
return NetworkSandbox, nil
|
|
|
|
case "host":
|
|
|
|
return NetworkHost, nil
|
|
|
|
case "none":
|
|
|
|
return NetworkNone, nil
|
|
|
|
default:
|
|
|
|
return 0, fmt.Errorf("invalid network type %q", s)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (n NetworkType) String() string {
|
|
|
|
switch n {
|
|
|
|
case NetworkSandbox:
|
|
|
|
return "sandbox"
|
|
|
|
case NetworkHost:
|
|
|
|
return "host"
|
|
|
|
case NetworkNone:
|
|
|
|
return "none"
|
|
|
|
default:
|
|
|
|
return fmt.Sprintf("unknown(%d)", n)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-06-28 16:45:52 +00:00
|
|
|
// MakeWatchdogAction converts type from string.
|
|
|
|
func MakeWatchdogAction(s string) (watchdog.Action, error) {
|
|
|
|
switch strings.ToLower(s) {
|
|
|
|
case "log", "logwarning":
|
|
|
|
return watchdog.LogWarning, nil
|
|
|
|
case "panic":
|
|
|
|
return watchdog.Panic, nil
|
|
|
|
default:
|
|
|
|
return 0, fmt.Errorf("invalid watchdog action %q", s)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-04-27 17:37:02 +00:00
|
|
|
// Config holds configuration that is not part of the runtime spec.
|
|
|
|
type Config struct {
|
|
|
|
// RootDir is the runtime root directory.
|
|
|
|
RootDir string
|
|
|
|
|
2018-05-15 17:17:19 +00:00
|
|
|
// Debug indicates that debug logging should be enabled.
|
|
|
|
Debug bool
|
|
|
|
|
|
|
|
// LogFilename is the filename to log to, if not empty.
|
|
|
|
LogFilename string
|
|
|
|
|
2018-11-02 00:43:50 +00:00
|
|
|
// LogFormat is the log format.
|
2018-05-15 17:17:19 +00:00
|
|
|
LogFormat string
|
|
|
|
|
2018-10-11 21:28:15 +00:00
|
|
|
// DebugLog is the path to log debug information to, if not empty.
|
|
|
|
DebugLog string
|
2018-05-15 17:17:19 +00:00
|
|
|
|
2018-11-02 00:43:50 +00:00
|
|
|
// DebugLogFormat is the log format for debug.
|
|
|
|
DebugLogFormat string
|
|
|
|
|
2018-04-27 17:37:02 +00:00
|
|
|
// FileAccess indicates how the filesystem is accessed.
|
|
|
|
FileAccess FileAccessType
|
|
|
|
|
|
|
|
// Overlay is whether to wrap the root filesystem in an overlay.
|
|
|
|
Overlay bool
|
|
|
|
|
|
|
|
// Network indicates what type of network to use.
|
|
|
|
Network NetworkType
|
|
|
|
|
|
|
|
// LogPackets indicates that all network packets should be logged.
|
|
|
|
LogPackets bool
|
|
|
|
|
|
|
|
// Platform is the platform to run on.
|
|
|
|
Platform PlatformType
|
|
|
|
|
|
|
|
// Strace indicates that strace should be enabled.
|
|
|
|
Strace bool
|
|
|
|
|
|
|
|
// StraceSyscalls is the set of syscalls to trace. If StraceEnable is
|
|
|
|
// true and this list is empty, then all syscalls will be traced.
|
|
|
|
StraceSyscalls []string
|
|
|
|
|
|
|
|
// StraceLogSize is the max size of data blobs to display.
|
|
|
|
StraceLogSize uint
|
|
|
|
|
|
|
|
// DisableSeccomp indicates whether seccomp syscall filters should be
|
|
|
|
// disabled. Pardon the double negation, but default to enabled is important.
|
|
|
|
DisableSeccomp bool
|
2018-06-25 19:07:50 +00:00
|
|
|
|
2018-08-28 03:35:00 +00:00
|
|
|
// WatchdogAction sets what action the watchdog takes when triggered.
|
2018-06-28 16:45:52 +00:00
|
|
|
WatchdogAction watchdog.Action
|
2018-08-28 03:35:00 +00:00
|
|
|
|
2018-12-12 00:11:53 +00:00
|
|
|
// PanicSignal registers signal handling that panics. Usually set to
|
2018-08-28 03:35:00 +00:00
|
|
|
// SIGUSR2(12) to troubleshoot hangs. -1 disables it.
|
|
|
|
PanicSignal int
|
2018-09-05 03:31:52 +00:00
|
|
|
|
2018-09-07 17:15:34 +00:00
|
|
|
// TestOnlyAllowRunAsCurrentUserWithoutChroot should only be used in
|
|
|
|
// tests. It allows runsc to start the sandbox process as the current
|
|
|
|
// user, and without chrooting the sandbox process. This can be
|
|
|
|
// necessary in test environments that have limited capabilities.
|
|
|
|
TestOnlyAllowRunAsCurrentUserWithoutChroot bool
|
2018-05-15 17:17:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// ToFlags returns a slice of flags that correspond to the given Config.
|
|
|
|
func (c *Config) ToFlags() []string {
|
2018-12-18 01:34:09 +00:00
|
|
|
f := []string{
|
2018-05-15 17:17:19 +00:00
|
|
|
"--root=" + c.RootDir,
|
|
|
|
"--debug=" + strconv.FormatBool(c.Debug),
|
|
|
|
"--log=" + c.LogFilename,
|
|
|
|
"--log-format=" + c.LogFormat,
|
2018-10-11 21:28:15 +00:00
|
|
|
"--debug-log=" + c.DebugLog,
|
2018-11-02 00:43:50 +00:00
|
|
|
"--debug-log-format=" + c.DebugLogFormat,
|
2018-05-15 17:17:19 +00:00
|
|
|
"--file-access=" + c.FileAccess.String(),
|
|
|
|
"--overlay=" + strconv.FormatBool(c.Overlay),
|
|
|
|
"--network=" + c.Network.String(),
|
|
|
|
"--log-packets=" + strconv.FormatBool(c.LogPackets),
|
|
|
|
"--platform=" + c.Platform.String(),
|
|
|
|
"--strace=" + strconv.FormatBool(c.Strace),
|
|
|
|
"--strace-syscalls=" + strings.Join(c.StraceSyscalls, ","),
|
|
|
|
"--strace-log-size=" + strconv.Itoa(int(c.StraceLogSize)),
|
2018-06-28 16:45:52 +00:00
|
|
|
"--watchdog-action=" + c.WatchdogAction.String(),
|
2018-08-28 03:35:00 +00:00
|
|
|
"--panic-signal=" + strconv.Itoa(c.PanicSignal),
|
2018-05-15 17:17:19 +00:00
|
|
|
}
|
2018-12-18 01:34:09 +00:00
|
|
|
if c.TestOnlyAllowRunAsCurrentUserWithoutChroot {
|
|
|
|
// Only include if set since it is never to be used by users.
|
|
|
|
f = append(f, "-TESTONLY-unsafe-nonroot=true")
|
|
|
|
}
|
|
|
|
return f
|
2018-04-27 17:37:02 +00:00
|
|
|
}
|