cmd/containerd-shim: require unix socket credentials

Signed-off-by: Stephen J Day <stephen.day@docker.com>

cmd/containerd-shim/main_unix.go

@@ -5,7 +5,6 @@ package main
 import (
 	"bytes"
 	"context"
-	"errors"
 	"flag"
 	"fmt"
 	"net"
@@ -25,6 +24,7 @@ import (
 	"github.com/containerd/containerd/reaper"
 	"github.com/containerd/typeurl"
 	ptypes "github.com/gogo/protobuf/types"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"github.com/stevvooe/ttrpc"
 	"golang.org/x/sys/unix"
@@ -88,7 +88,10 @@ func executeShim() error {
 	if err != nil {
 		return err
 	}
-	server := newServer()
+	server, err := newServer()
+	if err != nil {
+		return errors.Wrap(err, "failed creating server")
+	}
 	sv, err := shim.NewService(
 		shim.Config{
 			Path:          path,

cmd/containerd-shim/shim_darwin.go

@@ -0,0 +1,30 @@
+// +build darwin
+
+package main
+
+import (
+	"os"
+	"os/signal"
+
+	"github.com/containerd/containerd/reaper"
+	runc "github.com/containerd/go-runc"
+	"github.com/stevvooe/ttrpc"
+)
+
+// setupSignals creates a new signal handler for all signals and sets the shim as a
+// sub-reaper so that the container processes are reparented
+func setupSignals() (chan os.Signal, error) {
+	signals := make(chan os.Signal, 2048)
+	signal.Notify(signals)
+	// make sure runc is setup to use the monitor
+	// for waiting on processes
+	runc.Monitor = reaper.Default
+	return signals, nil
+}
+
+func newServer() (*ttrpc.Server, error) {
+	// for darwin, we omit the socket credentials because these syscalls are
+	// slightly different. since we don't have darwin support yet, this can be
+	// implemented later and the build can continue without issue.
+	return ttrpc.NewServer()
+}

cmd/containerd-shim/shim_linux.go

@@ -26,6 +26,6 @@ func setupSignals() (chan os.Signal, error) {
 	return signals, nil
 }
 
-func newServer() *ttrpc.Server {
-	return ttrpc.NewServer()
+func newServer() (*ttrpc.Server, error) {
+	return ttrpc.NewServer(ttrpc.WithServerHandshaker(ttrpc.UnixSocketRequireSameUser()))
 }

cmd/containerd-shim/shim_unix.go

@@ -1,4 +1,4 @@
-// +build !linux,!windows
+// +build !linux,!windows,!darwin
 
 package main
 
@@ -22,6 +22,6 @@ func setupSignals() (chan os.Signal, error) {
 	return signals, nil
 }
 
-func newServer() *ttrpc.Server {
-	return ttrpc.NewServer()
+func newServer() (*ttrpc.Server, error) {
+	return ttrpc.NewServer(ttrpc.WithServerHandshaker(ttrpc.UnixSocketRequireSameUser()))
 }