-
Notifications
You must be signed in to change notification settings - Fork 18.6k
/
image_snapshot_unix.go
157 lines (131 loc) · 4.03 KB
/
image_snapshot_unix.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
//go:build !windows
package containerd
import (
"context"
"fmt"
"os"
"path/filepath"
"syscall"
"github.com/containerd/containerd/mount"
"github.com/containerd/containerd/snapshots"
"github.com/containerd/continuity/fs"
"github.com/containerd/continuity/sysx"
"github.com/docker/docker/pkg/idtools"
)
const (
// Values based on linux/include/uapi/linux/capability.h
xattrCapsSz2 = 20
versionOffset = 3
vfsCapRevision2 = 2
vfsCapRevision3 = 3
remapSuffix = "-remap"
)
func (i *ImageService) remapSnapshot(ctx context.Context, snapshotter snapshots.Snapshotter, id string, parentSnapshot string) error {
_, err := snapshotter.Prepare(ctx, id, parentSnapshot)
if err != nil {
return err
}
mounts, err := snapshotter.Mounts(ctx, id)
if err != nil {
return err
}
if err := i.remapRootFS(ctx, mounts); err != nil {
return err
}
return err
}
func (i *ImageService) remapRootFS(ctx context.Context, mounts []mount.Mount) error {
return mount.WithTempMount(ctx, mounts, func(root string) error {
return filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
if err != nil {
return err
}
stat := info.Sys().(*syscall.Stat_t)
if stat == nil {
return fmt.Errorf("cannot get underlying data for %s", path)
}
ids, err := i.idMapping.ToHost(idtools.Identity{UID: int(stat.Uid), GID: int(stat.Gid)})
if err != nil {
return err
}
return chownWithCaps(path, ids.UID, ids.GID)
})
})
}
func (i *ImageService) copyAndUnremapRootFS(ctx context.Context, dst, src []mount.Mount) error {
return mount.WithTempMount(ctx, src, func(source string) error {
return mount.WithTempMount(ctx, dst, func(root string) error {
// TODO: Update CopyDir to support remap directly
if err := fs.CopyDir(root, source); err != nil {
return fmt.Errorf("failed to copy: %w", err)
}
return filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
if err != nil {
return err
}
stat := info.Sys().(*syscall.Stat_t)
if stat == nil {
return fmt.Errorf("cannot get underlying data for %s", path)
}
uid, gid, err := i.idMapping.ToContainer(idtools.Identity{UID: int(stat.Uid), GID: int(stat.Gid)})
if err != nil {
return err
}
return chownWithCaps(path, uid, gid)
})
})
})
}
func (i *ImageService) unremapRootFS(ctx context.Context, mounts []mount.Mount) error {
return mount.WithTempMount(ctx, mounts, func(root string) error {
return filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
if err != nil {
return err
}
stat := info.Sys().(*syscall.Stat_t)
if stat == nil {
return fmt.Errorf("cannot get underlying data for %s", path)
}
uid, gid, err := i.idMapping.ToContainer(idtools.Identity{UID: int(stat.Uid), GID: int(stat.Gid)})
if err != nil {
return err
}
return chownWithCaps(path, uid, gid)
})
})
}
// chownWithCaps will chown path and preserve the extended attributes.
// chowning a file will remove the capabilities, so we need to first get all of
// them, chown the file, and then set the extended attributes
func chownWithCaps(path string, uid int, gid int) error {
xattrKeys, err := sysx.LListxattr(path)
if err != nil {
return err
}
xattrs := make(map[string][]byte, len(xattrKeys))
for _, xattr := range xattrKeys {
data, err := sysx.LGetxattr(path, xattr)
if err != nil {
return err
}
xattrs[xattr] = data
}
if err := os.Lchown(path, uid, gid); err != nil {
return err
}
for xattrKey, xattrValue := range xattrs {
length := len(xattrValue)
// make sure the capabilities are version 2,
// capabilities version 3 also store the root uid of the namespace,
// we don't want this when we are in userns-remap mode
// see: https://github.com/moby/moby/pull/41724
if xattrKey == "security.capability" && xattrValue[versionOffset] == vfsCapRevision3 {
xattrValue[versionOffset] = vfsCapRevision2
length = xattrCapsSz2
}
if err := sysx.LSetxattr(path, xattrKey, xattrValue[:length], 0); err != nil {
return err
}
}
return nil
}