[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH for-5.1 3/3] virtiofsd: probe unshare(CLONE_FS) and print an erro
From: |
Stefan Hajnoczi |
Subject: |
[PATCH for-5.1 3/3] virtiofsd: probe unshare(CLONE_FS) and print an error |
Date: |
Wed, 22 Jul 2020 14:02:06 +0100 |
An assertion failure is raised during request processing if
unshare(CLONE_FS) fails. Implement a probe at startup so the problem can
be detected right away.
Unfortunately Docker/Moby does not include unshare in the seccomp.json
list unless CAP_SYS_ADMIN is given. Other seccomp.json lists always
include unshare (e.g. podman is unaffected):
https://raw.githubusercontent.com/seccomp/containers-golang/master/seccomp.json
Use "docker run --security-opt seccomp=path/to/seccomp.json ..." if the
default seccomp.json is missing unshare.
Cc: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
tools/virtiofsd/fuse_virtio.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c
index 3b6d16a041..ebeb352514 100644
--- a/tools/virtiofsd/fuse_virtio.c
+++ b/tools/virtiofsd/fuse_virtio.c
@@ -949,6 +949,19 @@ int virtio_session_mount(struct fuse_session *se)
{
int ret;
+ /*
+ * Test that unshare(CLONE_FS) works. fv_queue_worker() will need it. It's
+ * an unprivileged system call but some Docker/Moby versions are known to
+ * reject it via seccomp when CAP_SYS_ADMIN is not given.
+ */
+ ret = unshare(CLONE_FS);
+ if (ret == -1 && errno == EPERM) {
+ fuse_log(FUSE_LOG_ERR, "unshare(CLONE_FS) failed with EPERM. If "
+ "running in a container please check that the container "
+ "runtime seccomp policy allows unshare.\n");
+ return -1;
+ }
+
ret = fv_create_listen_socket(se);
if (ret < 0) {
return ret;
--
2.26.2
- Re: [PATCH for-5.1 2/3] virtiofsd: add container-friendly -o chroot sandboxing option, (continued)
Re: [Virtio-fs] [PATCH for-5.1 2/3] virtiofsd: add container-friendly -o chroot sandboxing option, Vivek Goyal, 2020/07/22
Re: [PATCH for-5.1 2/3] virtiofsd: add container-friendly -o chroot sandboxing option, Dr. David Alan Gilbert, 2020/07/22
[PATCH for-5.1 3/3] virtiofsd: probe unshare(CLONE_FS) and print an error,
Stefan Hajnoczi <=
Re: [Virtio-fs] [PATCH for-5.1 0/3] virtiofsd: allow virtiofsd to run in a container, Vivek Goyal, 2020/07/22