Commit Graph

5 Commits

Author SHA1 Message Date
Kenfe-Mickael Laventure
587a811d09
Check credentials when connecting to shim
NewUnixSocketCredentials was actually never invoked before.

Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>
2017-08-11 09:34:29 -07:00
Tobias Klauser
4a6a2b9db0 Switch from package syscall to golang.org/x/sys
The syscall package is locked down and the comment in [1] advises to
switch code to use the corresponding package from golang.org/x/sys. Do
so and replace usage of package syscall with package
golang.org/x/sys/{unix,windows} where applicable.

  [1] https://github.com/golang/go/blob/master/src/syscall/syscall.go#L21-L24

This will also allow to get updates and fixes for syscall wrappers
without having to use a new go version.

Errno, Signal and SysProcAttr aren't changed as they haven't been
implemented in x/sys/. Stat_t from syscall is used if standard library
packages (e.g. os) require it. syscall.ENOTSUP, syscall.SIGKILL and
syscall.SIGTERM are used for cross-platform files.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
2017-08-09 13:41:16 +02:00
Ian Campbell
8b365117a2 containerd-shim: Do not remount root MS_SLAVE
Mounting as MS_SLAVE here breaks use cases which want to use
rootPropagation=shared in order to expose mounts to the host (and other
containers binding the same subtree), mounting as e.g. MS_SHARED is pointless
in this context so just remove.

Having done this we also need to arrange to manually clean up the mounts on
delete, so do so.

Note that runc will also setup root as required by rootPropagation, defaulting
to MS_PRIVATE.

Fixes #1132.

Signed-off-by: Ian Campbell <ian.campbell@docker.com>
2017-07-20 10:50:08 +01:00
Kenfe-Mickael Laventure
d3e7af2c0a
containerd-shim: Refuse connection from uid/gid different from the shim process
Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com>
2017-06-23 17:50:13 -07:00
Justin Cormack
6a571ecd40 Portability fixes for containerd shim
Update go-runc to master with portability fixes.

Subreaper only exists on Linux, and only Linux runs the shim in a
mount namespace.

With these changes the shim compiles on Darwin, which means the
whole build compiles without errors now.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-05-16 17:13:32 +01:00