/
exec.go
125 lines (97 loc) · 2.64 KB
/
exec.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
// Unless explicitly stated otherwise all files in this repository are licensed
// under the Apache License Version 2.0.
// This product includes software developed at Datadog (https://www.datadoghq.com/).
// Copyright 2016-present Datadog, Inc.
//go:build linux
package ptracer
import (
"syscall"
"unsafe"
"golang.org/x/sys/unix"
)
//go:linkname runtimeBeforeFork syscall.runtime_BeforeFork
func runtimeBeforeFork()
//go:linkname runtimeAfterFork syscall.runtime_AfterFork
func runtimeAfterFork()
//go:linkname runtimeAfterForkInChild syscall.runtime_AfterForkInChild
func runtimeAfterForkInChild()
//go:norace
//nolint:unused
func forkExec(argv0 string, argv []string, envv []string, creds Creds, prog *syscall.SockFprog) (int, error) {
argv0p, err := syscall.BytePtrFromString(argv0)
if err != nil {
return 0, err
}
argvp, err := syscall.SlicePtrFromStrings(argv)
if err != nil {
return 0, err
}
envvp, err := syscall.SlicePtrFromStrings(envv)
if err != nil {
return 0, err
}
syscall.ForkLock.Lock()
// no more go runtime calls
runtimeBeforeFork()
pid, _, errno := syscall.RawSyscall6(syscall.SYS_CLONE, uintptr(syscall.SIGCHLD), 0, 0, 0, 0, 0)
if errno != 0 || pid != 0 {
// back to go runtime
runtimeAfterFork()
syscall.ForkLock.Unlock()
if errno != 0 {
err = errno
}
return int(pid), err
}
// in the child, no more go runtime calls
runtimeAfterForkInChild()
pid, _, errno = syscall.RawSyscall(syscall.SYS_GETPID, 0, 0, 0)
if errno != 0 {
exit(errno)
}
_, _, errno = syscall.RawSyscall(syscall.SYS_PTRACE, uintptr(syscall.PTRACE_TRACEME), 0, 0)
if errno != 0 {
exit(errno)
}
_, _, errno = syscall.RawSyscall6(syscall.SYS_PRCTL, unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0, 0)
if errno != 0 {
exit(errno)
}
const (
mode = 1
tsync = 1
)
if prog != nil {
_, _, errno = syscall.RawSyscall(unix.SYS_SECCOMP, mode, tsync, uintptr(unsafe.Pointer(prog)))
if errno != 0 {
exit(errno)
}
}
_, _, errno = syscall.RawSyscall(syscall.SYS_KILL, pid, uintptr(syscall.SIGSTOP), 0)
if errno != 0 {
exit(errno)
}
if creds.GID != nil {
_, _, errno = syscall.RawSyscall(syscall.SYS_SETGID, uintptr(*creds.GID), 0, 0)
if errno != 0 {
exit(errno)
}
}
if creds.UID != nil {
_, _, errno = syscall.RawSyscall(syscall.SYS_SETUID, uintptr(*creds.UID), 0, 0)
if errno != 0 {
exit(errno)
}
}
_, _, err = syscall.RawSyscall(syscall.SYS_EXECVE,
uintptr(unsafe.Pointer(argv0p)),
uintptr(unsafe.Pointer(&argvp[0])),
uintptr(unsafe.Pointer(&envvp[0])))
return 0, err
}
//nolint:unused
func exit(errno syscall.Errno) {
for {
_, _, _ = syscall.RawSyscall(syscall.SYS_EXIT, uintptr(errno), 0, 0)
}
}