[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 8/8] virtiofsd: probe unshare(CLONE_FS) and print an error
From: |
Dr. David Alan Gilbert (git) |
Subject: |
[PULL 8/8] virtiofsd: probe unshare(CLONE_FS) and print an error |
Date: |
Fri, 28 Aug 2020 13:45:09 +0100 |
From: Stefan Hajnoczi <stefanha@redhat.com>
An assertion failure is raised during request processing if
unshare(CLONE_FS) fails. Implement a probe at startup so the problem can
be detected right away.
Unfortunately Docker/Moby does not include unshare in the seccomp.json
list unless CAP_SYS_ADMIN is given. Other seccomp.json lists always
include unshare (e.g. podman is unaffected):
https://raw.githubusercontent.com/seccomp/containers-golang/master/seccomp.json
Use "docker run --security-opt seccomp=path/to/seccomp.json ..." if the
default seccomp.json is missing unshare.
Cc: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20200727190223.422280-4-stefanha@redhat.com>
Reviewed-by: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
tools/virtiofsd/fuse_virtio.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c
index 3b6d16a041..9e5537506c 100644
--- a/tools/virtiofsd/fuse_virtio.c
+++ b/tools/virtiofsd/fuse_virtio.c
@@ -949,6 +949,22 @@ int virtio_session_mount(struct fuse_session *se)
{
int ret;
+ /*
+ * Test that unshare(CLONE_FS) works. fv_queue_worker() will need it. It's
+ * an unprivileged system call but some Docker/Moby versions are known to
+ * reject it via seccomp when CAP_SYS_ADMIN is not given.
+ *
+ * Note that the program is single-threaded here so this syscall has no
+ * visible effect and is safe to make.
+ */
+ ret = unshare(CLONE_FS);
+ if (ret == -1 && errno == EPERM) {
+ fuse_log(FUSE_LOG_ERR, "unshare(CLONE_FS) failed with EPERM. If "
+ "running in a container please check that the container "
+ "runtime seccomp policy allows unshare.\n");
+ return -1;
+ }
+
ret = fv_create_listen_socket(se);
if (ret < 0) {
return ret;
--
2.26.2
- [PULL 0/8] migration and virtiofsd queue, Dr. David Alan Gilbert (git), 2020/08/28
- [PULL 1/8] migration: unify the framework of socket-type channel, Dr. David Alan Gilbert (git), 2020/08/28
- [PULL 2/8] migration: add vsock as data channel support, Dr. David Alan Gilbert (git), 2020/08/28
- [PULL 3/8] migration: improve error reporting of block driver state name, Dr. David Alan Gilbert (git), 2020/08/28
- [PULL 4/8] migration: tls: fix memory leak in migration_tls_get_creds, Dr. David Alan Gilbert (git), 2020/08/28
- [PULL 6/8] virtiofsd: Remove "norace" from cmdline help and docs, Dr. David Alan Gilbert (git), 2020/08/28
- [PULL 5/8] virtiofsd: Disable remote posix locks by default, Dr. David Alan Gilbert (git), 2020/08/28
- [PULL 7/8] virtiofsd: drop CAP_DAC_READ_SEARCH, Dr. David Alan Gilbert (git), 2020/08/28
- [PULL 8/8] virtiofsd: probe unshare(CLONE_FS) and print an error,
Dr. David Alan Gilbert (git) <=
- Re: [PULL 0/8] migration and virtiofsd queue, Peter Maydell, 2020/08/28