Skip to content

Commit 0635041

Browse files
robertswieckirobertswiecki
committed
nsjail.h+all: move nsjail::NsJailConfig into struct nsj_t to avoid parameter duplicaiton. Now nsjail::NsJailConfig is the source of configuration truth for jails
1 parent b24be32 commit 0635041

31 files changed

+810
-1054
lines changed

‎Makefile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,3 +127,6 @@ uts.o: uts.h nsjail.h logs.h
127127
user.o: user.h nsjail.h logs.h macros.h subproc.h util.h
128128
util.o: util.h nsjail.h logs.h macros.h
129129
config.pb.o: config.pb.h
130+
131+
# Ensure protobuf header is generated before any object compilation
132+
$(OBJS): $(SRCS_PB_H)

‎caps.cc‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@ static bool initNsKeepCaps(cap_user_data_t cap_data) {
212212
return true;
213213
}
214214

215-
bool initNs(nsjconf_t* nsjconf) {
215+
bool initNs(nsj_t* nsj) {
216216
cap_user_data_t cap_data = getCaps();
217217
if (cap_data == nullptr) {
218218
return false;
@@ -228,14 +228,14 @@ bool initNs(nsjconf_t* nsjconf) {
228228
PLOG_W("prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL)");
229229
}
230230

231-
if (nsjconf->keep_caps) {
231+
if (nsj->njc.keep_caps()) {
232232
return initNsKeepCaps(cap_data);
233233
}
234234

235235
/* Set all requested caps in the inheritable set if these are present in the permitted set
236236
*/
237237
std::string dbgmsg;
238-
for (const auto& cap : nsjconf->caps) {
238+
for (const auto& cap : nsj->caps) {
239239
if (!getPermitted(cap_data, cap)) {
240240
LOG_W("Capability %s is not permitted in the namespace",
241241
capToStr(cap).c_str());
@@ -277,7 +277,7 @@ bool initNs(nsjconf_t* nsjconf) {
277277

278278
/* Make sure inheritable set is preserved across execve via the modified ambient set */
279279
dbgmsg.clear();
280-
for (const auto& cap : nsjconf->caps) {
280+
for (const auto& cap : nsj->caps) {
281281
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, (unsigned long)cap, 0UL, 0UL) ==
282282
-1) {
283283
PLOG_W("prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, %s)",

‎caps.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
namespace caps {
3131

3232
int nameToVal(const char* name);
33-
bool initNs(nsjconf_t* nsjconf);
33+
bool initNs(nsj_t* nsj);
3434

3535
} // namespace caps
3636

‎cgroup.cc‎

Lines changed: 50 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -64,18 +64,19 @@ static bool addPidToTaskList(const std::string& cgroup_path, pid_t pid) {
6464
return writeToCgroup(tasks_path, pid_str, "'" + tasks_path + "' task list");
6565
}
6666

67-
static bool initNsFromParentMem(nsjconf_t* nsjconf, pid_t pid) {
68-
size_t memsw_max = nsjconf->cgroup_mem_memsw_max;
69-
if (nsjconf->cgroup_mem_swap_max >= (ssize_t)0) {
70-
memsw_max = nsjconf->cgroup_mem_swap_max + nsjconf->cgroup_mem_max;
67+
static bool initNsFromParentMem(nsj_t* nsj, pid_t pid) {
68+
size_t memsw_max = nsj->njc.cgroup_mem_memsw_max();
69+
if (nsj->njc.cgroup_mem_swap_max() >= (ssize_t)0) {
70+
memsw_max = nsj->njc.cgroup_mem_swap_max() + nsj->njc.cgroup_mem_max();
7171
}
7272

73-
if (nsjconf->cgroup_mem_max == (size_t)0 && memsw_max == (size_t)0) {
73+
if (nsj->njc.cgroup_mem_max() == (size_t)0 && memsw_max == (size_t)0) {
7474
return true;
7575
}
7676

77-
std::string mem_cgroup_path = nsjconf->cgroup_mem_mount + '/' + nsjconf->cgroup_mem_parent +
78-
"/NSJAIL." + std::to_string(pid);
77+
std::string mem_cgroup_path = nsj->njc.cgroup_mem_mount() + '/' +
78+
nsj->njc.cgroup_mem_parent() + "/NSJAIL." +
79+
std::to_string(pid);
7980
RETURN_ON_FAILURE(createCgroup(mem_cgroup_path, pid));
8081

8182
/*
@@ -84,8 +85,8 @@ static bool initNsFromParentMem(nsjconf_t* nsjconf, pid_t pid) {
8485
RETURN_ON_FAILURE(writeToCgroup(
8586
mem_cgroup_path + "/memory.oom_control", "0", "memory cgroup oom control"));
8687

87-
if (nsjconf->cgroup_mem_max > (size_t)0) {
88-
std::string mem_max_str = std::to_string(nsjconf->cgroup_mem_max);
88+
if (nsj->njc.cgroup_mem_max() > (size_t)0) {
89+
std::string mem_max_str = std::to_string(nsj->njc.cgroup_mem_max());
8990
RETURN_ON_FAILURE(writeToCgroup(mem_cgroup_path + "/memory.limit_in_bytes",
9091
mem_max_str, "memory cgroup max limit"));
9192
}
@@ -99,37 +100,37 @@ static bool initNsFromParentMem(nsjconf_t* nsjconf, pid_t pid) {
99100
return addPidToTaskList(mem_cgroup_path, pid);
100101
}
101102

102-
static bool initNsFromParentPids(nsjconf_t* nsjconf, pid_t pid) {
103-
if (nsjconf->cgroup_pids_max == 0U) {
103+
static bool initNsFromParentPids(nsj_t* nsj, pid_t pid) {
104+
if (nsj->njc.cgroup_pids_max() == 0U) {
104105
return true;
105106
}
106107

107-
std::string pids_cgroup_path = nsjconf->cgroup_pids_mount + '/' +
108-
nsjconf->cgroup_pids_parent + "/NSJAIL." +
108+
std::string pids_cgroup_path = nsj->njc.cgroup_pids_mount() + '/' +
109+
nsj->njc.cgroup_pids_parent() + "/NSJAIL." +
109110
std::to_string(pid);
110111
RETURN_ON_FAILURE(createCgroup(pids_cgroup_path, pid));
111112

112-
std::string pids_max_str = std::to_string(nsjconf->cgroup_pids_max);
113+
std::string pids_max_str = std::to_string(nsj->njc.cgroup_pids_max());
113114
RETURN_ON_FAILURE(
114115
writeToCgroup(pids_cgroup_path + "/pids.max", pids_max_str, "pids cgroup max limit"));
115116

116117
return addPidToTaskList(pids_cgroup_path, pid);
117118
}
118119

119-
static bool initNsFromParentNetCls(nsjconf_t* nsjconf, pid_t pid) {
120-
if (nsjconf->cgroup_net_cls_classid == 0U) {
120+
static bool initNsFromParentNetCls(nsj_t* nsj, pid_t pid) {
121+
if (nsj->njc.cgroup_net_cls_classid() == 0U) {
121122
return true;
122123
}
123124

124-
std::string net_cls_cgroup_path = nsjconf->cgroup_net_cls_mount + '/' +
125-
nsjconf->cgroup_net_cls_parent + "/NSJAIL." +
125+
std::string net_cls_cgroup_path = nsj->njc.cgroup_net_cls_mount() + '/' +
126+
nsj->njc.cgroup_net_cls_parent() + "/NSJAIL." +
126127
std::to_string(pid);
127128
RETURN_ON_FAILURE(createCgroup(net_cls_cgroup_path, pid));
128129

129130
std::string net_cls_classid_str;
130131
{
131132
std::stringstream ss;
132-
ss << "0x" << std::hex << nsjconf->cgroup_net_cls_classid;
133+
ss << "0x" << std::hex << nsj->njc.cgroup_net_cls_classid();
133134
net_cls_classid_str = ss.str();
134135
}
135136
RETURN_ON_FAILURE(writeToCgroup(net_cls_cgroup_path + "/net_cls.classid",
@@ -138,30 +139,31 @@ static bool initNsFromParentNetCls(nsjconf_t* nsjconf, pid_t pid) {
138139
return addPidToTaskList(net_cls_cgroup_path, pid);
139140
}
140141

141-
static bool initNsFromParentCpu(nsjconf_t* nsjconf, pid_t pid) {
142-
if (nsjconf->cgroup_cpu_ms_per_sec == 0U) {
142+
static bool initNsFromParentCpu(nsj_t* nsj, pid_t pid) {
143+
if (nsj->njc.cgroup_cpu_ms_per_sec() == 0U) {
143144
return true;
144145
}
145146

146-
std::string cpu_cgroup_path = nsjconf->cgroup_cpu_mount + '/' + nsjconf->cgroup_cpu_parent +
147-
"/NSJAIL." + std::to_string(pid);
147+
std::string cpu_cgroup_path = nsj->njc.cgroup_cpu_mount() + '/' +
148+
nsj->njc.cgroup_cpu_parent() + "/NSJAIL." +
149+
std::to_string(pid);
148150
RETURN_ON_FAILURE(createCgroup(cpu_cgroup_path, pid));
149151

150152
RETURN_ON_FAILURE(
151153
writeToCgroup(cpu_cgroup_path + "/cpu.cfs_period_us", "1000000", "cpu period"));
152154

153-
std::string cpu_ms_per_sec_str = std::to_string(nsjconf->cgroup_cpu_ms_per_sec * 1000U);
155+
std::string cpu_ms_per_sec_str = std::to_string(nsj->njc.cgroup_cpu_ms_per_sec() * 1000U);
154156
RETURN_ON_FAILURE(
155157
writeToCgroup(cpu_cgroup_path + "/cpu.cfs_quota_us", cpu_ms_per_sec_str, "cpu quota"));
156158

157159
return addPidToTaskList(cpu_cgroup_path, pid);
158160
}
159161

160-
bool initNsFromParent(nsjconf_t* nsjconf, pid_t pid) {
161-
RETURN_ON_FAILURE(initNsFromParentMem(nsjconf, pid));
162-
RETURN_ON_FAILURE(initNsFromParentPids(nsjconf, pid));
163-
RETURN_ON_FAILURE(initNsFromParentNetCls(nsjconf, pid));
164-
return initNsFromParentCpu(nsjconf, pid);
162+
bool initNsFromParent(nsj_t* nsj, pid_t pid) {
163+
RETURN_ON_FAILURE(initNsFromParentMem(nsj, pid));
164+
RETURN_ON_FAILURE(initNsFromParentPids(nsj, pid));
165+
RETURN_ON_FAILURE(initNsFromParentNetCls(nsj, pid));
166+
return initNsFromParentCpu(nsj, pid);
165167
}
166168

167169
static void removeCgroup(const std::string& cgroup_path) {
@@ -171,34 +173,39 @@ static void removeCgroup(const std::string& cgroup_path) {
171173
}
172174
}
173175

174-
void finishFromParent(nsjconf_t* nsjconf, pid_t pid) {
175-
if (nsjconf->cgroup_mem_max != (size_t)0 || nsjconf->cgroup_mem_memsw_max != (size_t)0) {
176-
std::string mem_cgroup_path = nsjconf->cgroup_mem_mount + '/' +
177-
nsjconf->cgroup_mem_parent + "/NSJAIL." +
176+
void finishFromParent(nsj_t* nsj, pid_t pid) {
177+
if (nsj->njc.cgroup_mem_max() != (size_t)0 ||
178+
nsj->njc.cgroup_mem_memsw_max() != (size_t)0) {
179+
std::string mem_cgroup_path = nsj->njc.cgroup_mem_mount() + '/' +
180+
nsj->njc.cgroup_mem_parent() + "/NSJAIL." +
178181
std::to_string(pid);
179182
removeCgroup(mem_cgroup_path);
180183
}
181-
if (nsjconf->cgroup_pids_max != 0U) {
182-
std::string pids_cgroup_path = nsjconf->cgroup_pids_mount + '/' +
183-
nsjconf->cgroup_pids_parent + "/NSJAIL." +
184+
if (nsj->njc.cgroup_pids_max() != 0U) {
185+
std::string pids_cgroup_path = nsj->njc.cgroup_pids_mount() + '/' +
186+
nsj->njc.cgroup_pids_parent() + "/NSJAIL." +
184187
std::to_string(pid);
185188
removeCgroup(pids_cgroup_path);
186189
}
187-
if (nsjconf->cgroup_net_cls_classid != 0U) {
188-
std::string net_cls_cgroup_path = nsjconf->cgroup_net_cls_mount + '/' +
189-
nsjconf->cgroup_net_cls_parent + "/NSJAIL." +
190+
if (nsj->njc.cgroup_net_cls_classid() != 0U) {
191+
std::string net_cls_cgroup_path = nsj->njc.cgroup_net_cls_mount() + '/' +
192+
nsj->njc.cgroup_net_cls_parent() + "/NSJAIL." +
190193
std::to_string(pid);
191194
removeCgroup(net_cls_cgroup_path);
192195
}
193-
if (nsjconf->cgroup_cpu_ms_per_sec != 0U) {
194-
std::string cpu_cgroup_path = nsjconf->cgroup_cpu_mount + '/' +
195-
nsjconf->cgroup_cpu_parent + "/NSJAIL." +
196+
if (nsj->njc.cgroup_cpu_ms_per_sec() != 0U) {
197+
std::string cpu_cgroup_path = nsj->njc.cgroup_cpu_mount() + '/' +
198+
nsj->njc.cgroup_cpu_parent() + "/NSJAIL." +
196199
std::to_string(pid);
197200
removeCgroup(cpu_cgroup_path);
198201
}
199202
}
200203

201-
bool initNs(void) {
204+
bool initUser(nsj_t* nsj) {
205+
return true;
206+
}
207+
208+
bool initNs() {
202209
return true;
203210
}
204211

‎cgroup.h‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,9 +29,10 @@
2929

3030
namespace cgroup {
3131

32-
bool initNsFromParent(nsjconf_t* nsjconf, pid_t pid);
32+
bool initNsFromParent(nsj_t* nsj, pid_t pid);
3333
bool initNs(void);
34-
void finishFromParent(nsjconf_t* nsjconf, pid_t pid);
34+
bool initUser(nsj_t* nsj);
35+
void finishFromParent(nsj_t* nsj, pid_t pid);
3536

3637
} // namespace cgroup
3738

0 commit comments

Comments
 (0)