forked from MetaCubeX/gvisor
-
Notifications
You must be signed in to change notification settings - Fork 0
/
namespace.go
243 lines (219 loc) · 6.83 KB
/
namespace.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
// Copyright 2023 The gVisor Authors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package vfs
import (
"github.com/MerlinKodo/gvisor/pkg/context"
"github.com/MerlinKodo/gvisor/pkg/errors/linuxerr"
"github.com/MerlinKodo/gvisor/pkg/refs"
"github.com/MerlinKodo/gvisor/pkg/sentry/kernel/auth"
)
// A MountNamespace is a collection of Mounts.//
// MountNamespaces are reference-counted. Unless otherwise specified, all
// MountNamespace methods require that a reference is held.
//
// MountNamespace is analogous to Linux's struct mnt_namespace.
//
// +stateify savable
type MountNamespace struct {
// Refs is the reference count for this mount namespace.
Refs refs.TryRefCounter
// Owner is the usernamespace that owns this mount namespace.
Owner *auth.UserNamespace
// root is the MountNamespace's root mount.
root *Mount
// mountpoints maps all Dentries which are mount points in this namespace
// to the number of Mounts for which they are mount points. mountpoints is
// protected by VirtualFilesystem.mountMu.
//
// mountpoints is used to determine if a Dentry can be moved or removed
// (which requires that the Dentry is not a mount point in the calling
// namespace).
//
// mountpoints is maintained even if there are no references held on the
// MountNamespace; this is required to ensure that
// VFS.PrepareDeleteDentry() and VFS.PrepareRemoveDentry() operate
// correctly on unreferenced MountNamespaces.
mountpoints map[*Dentry]uint32
// mounts is the total number of mounts in this mount namespace.
mounts uint32
}
// Namespace is the namespace interface.
type Namespace interface {
Type() string
Destroy(ctx context.Context)
}
// NewMountNamespace returns a new mount namespace with a root filesystem
// configured by the given arguments. A reference is taken on the returned
// MountNamespace.
//
// If nsfs is nil, the default reference counter is used.
func (vfs *VirtualFilesystem) NewMountNamespace(
ctx context.Context,
creds *auth.Credentials,
source, fsTypeName string,
opts *MountOptions,
nsfs NamespaceInodeGetter,
) (*MountNamespace, error) {
rft := vfs.getFilesystemType(fsTypeName)
if rft == nil {
ctx.Warningf("Unknown filesystem type: %s", fsTypeName)
return nil, linuxerr.ENODEV
}
fs, root, err := rft.fsType.GetFilesystem(ctx, vfs, creds, source, opts.GetFilesystemOptions)
if err != nil {
return nil, err
}
return vfs.NewMountNamespaceFrom(ctx, creds, fs, root, opts, nsfs), nil
}
type namespaceDefaultRefs struct {
namespaceRefs
destroy func(ctx context.Context)
}
func (r *namespaceDefaultRefs) DecRef(ctx context.Context) {
r.namespaceRefs.DecRef(
func() {
r.destroy(ctx)
},
)
}
// NewMountNamespaceFrom constructs a new mount namespace from an existing
// filesystem and its root dentry. This is similar to NewMountNamespace, but
// uses an existing filesystem instead of constructing a new one.
func (vfs *VirtualFilesystem) NewMountNamespaceFrom(
ctx context.Context,
creds *auth.Credentials,
fs *Filesystem,
root *Dentry,
opts *MountOptions,
nsfs NamespaceInodeGetter,
) *MountNamespace {
mntns := &MountNamespace{
Owner: creds.UserNamespace,
mountpoints: make(map[*Dentry]uint32),
}
if nsfs == nil {
refs := &namespaceDefaultRefs{destroy: mntns.Destroy}
refs.InitRefs()
mntns.Refs = refs
} else {
mntns.Refs = nsfs.GetNamespaceInode(ctx, mntns)
}
mntns.root = newMount(vfs, fs, root, mntns, opts)
return mntns
}
type cloneEntry struct {
prevMount *Mount
parentMount *Mount
}
// +checklocks:vfs.mountMu
func (vfs *VirtualFilesystem) updateRootAndCWD(ctx context.Context, root *VirtualDentry, cwd *VirtualDentry, src *Mount, dst *Mount) {
if root.mount == src {
vfs.delayDecRef(root.mount)
root.mount = dst
root.mount.IncRef()
}
if cwd.mount == src {
vfs.delayDecRef(cwd.mount)
cwd.mount = dst
cwd.mount.IncRef()
}
for srcChild := range src.children {
dstChild := vfs.mounts.Lookup(dst, srcChild.point())
vfs.updateRootAndCWD(ctx, root, cwd, srcChild, dstChild)
}
}
// NamespaceInodeGetter is an interface that provides the GetNamespaceInode method.
type NamespaceInodeGetter interface {
GetNamespaceInode(ctx context.Context, ns Namespace) refs.TryRefCounter
}
// CloneMountNamespace makes a copy of the specified mount namespace.
//
// If `root` or `cwd` have mounts in the old namespace, they will be replaced
// with proper mounts from the new namespace.
func (vfs *VirtualFilesystem) CloneMountNamespace(
ctx context.Context,
creds *auth.Credentials,
ns *MountNamespace,
root *VirtualDentry,
cwd *VirtualDentry,
nsfs NamespaceInodeGetter,
) (*MountNamespace, error) {
newns := &MountNamespace{
Owner: creds.UserNamespace,
mountpoints: make(map[*Dentry]uint32),
}
newns.Refs = nsfs.GetNamespaceInode(ctx, newns)
vfs.lockMounts()
defer vfs.unlockMounts(ctx)
newRoot, err := vfs.cloneMountTree(ctx, ns.root, ns.root.root)
if err != nil {
newns.DecRef(ctx)
vfs.abortTree(ctx, newRoot)
return nil, err
}
newns.root = newRoot
newns.root.ns = newns
vfs.commitPendingTree(ctx, newRoot)
vfs.updateRootAndCWD(ctx, root, cwd, ns.root, newns.root)
return newns, nil
}
// Destroy implements nsfs.Namespace.Destroy.
func (mntns *MountNamespace) Destroy(ctx context.Context) {
vfs := mntns.root.fs.VirtualFilesystem()
vfs.lockMounts()
vfs.mounts.seq.BeginWrite()
vfs.umountRecursiveLocked(mntns.root, &umountRecursiveOptions{
disconnectHierarchy: true,
})
vfs.mounts.seq.EndWrite()
vfs.unlockMounts(ctx)
}
// Type implements nsfs.Namespace.Type.
func (mntns *MountNamespace) Type() string {
return "mnt"
}
// IncRef increments mntns' refcount.
func (mntns *MountNamespace) IncRef() {
mntns.Refs.IncRef()
}
// DecRef decrements mntns' reference count.
func (mntns *MountNamespace) DecRef(ctx context.Context) {
mntns.Refs.DecRef(ctx)
}
// TryIncRef attempts to increment mntns' reference count.
func (mntns *MountNamespace) TryIncRef() bool {
return mntns.Refs.TryIncRef()
}
// Root returns mntns' root. If the root is over-mounted, it returns the top
// mount.
func (mntns *MountNamespace) Root(ctx context.Context) VirtualDentry {
vfs := mntns.root.fs.VirtualFilesystem()
vd := VirtualDentry{
mount: mntns.root,
dentry: mntns.root.root,
}
vd.IncRef()
if !vd.dentry.isMounted() {
return vd
}
m := vfs.getMountAt(ctx, vd.mount, vd.dentry)
if m == nil {
return vd
}
vd.DecRef(ctx)
vd.mount = m
vd.dentry = m.root
vd.dentry.IncRef()
return vd
}