From 8303e82b8797585cbcc03b82b7bae51888ab0c5b Mon Sep 17 00:00:00 2001 From: Euan Kemp Date: Mon, 27 Feb 2017 17:00:47 -0800 Subject: [PATCH] app-emulation/runc: bring back p9 for docker 1.12 --- .../app-emulation/runc/Manifest | 1 + ...nt-set-label-for-mqueue-under-userns.patch | 94 +++++++++++++++++++ .../runc/runc-1.0.0_rc2_p9.ebuild | 62 ++++++++++++ 3 files changed, 157 insertions(+) create mode 100644 sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch create mode 100644 sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/Manifest b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/Manifest index f005a91786..075e3f145f 100644 --- a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/Manifest +++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/Manifest @@ -1 +1,2 @@ DIST runc-1.0.0_rc2_p133.tar.gz 560793 SHA256 11f69923a786efb82b65d9f1eec0ac665a985e631a67f3f4d466dac720efacdd SHA512 8c19a02a55108cef36cbd1ff739a3c8e2962d188c426517fce91483ec525546d39c14072f0a0f2471b6b70a05cf6c1f0e99cfeb5e87203fcbae955bd5f5bd16b WHIRLPOOL 8a1f44234c668aca5c53e401ce80e2c297ad9c7ed0b10d782494e93020f824e6d5e3a00be221f1ff5d039df998c43556228503788181a45256d91278dd005721 +DIST runc-1.0.0_rc2_p9.tar.gz 550963 SHA256 374822cc2895ed3899b7a3a03b566413ea782fccec1307231f27894e9c6d5bea SHA512 0176fc0fd69b298b5cb304388544a45b3805154f635c4a7492daac6e33774b16ad76af2b3008205de169306812834f4299106c89a17b1667168f3ad2ddc2e975 WHIRLPOOL 5015352fe7dc9ddedf93d555cf2750b3e9d72adfda534b1e30a69ac8b6b05e73bfbbe0ba72f543be4e3133f1604a5b42acc3363d30187a75861ca42755dfff81 diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch new file mode 100644 index 0000000000..8653745603 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/files/0002-Dont-set-label-for-mqueue-under-userns.patch @@ -0,0 +1,94 @@ +From 3ce50afe04f102cf28dbb6425773011707bf3ae0 Mon Sep 17 00:00:00 2001 +From: Mrunal Patel +Date: Wed, 12 Oct 2016 16:46:59 -0700 +Subject: [PATCH] Fix setting SELinux label for mqueue when user namespaces are + enabled + +If one tries to user SELinux with user namespaces, then labeling of /dev/mqueue +fails because the IPC namespace belongs to the root in init_user_ns. This +commit fixes that by unsharing IPC namespace after we clone into a new USER +namespace so the IPC namespace is owned by the root inside the new USER +namespace as opposed to init_user_ns. + +Signed-off-by: Mrunal Patel +--- + libcontainer/nsenter/nsexec.c | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c +index b93f827..1e8d4da 100644 +--- a/libcontainer/nsenter/nsexec.c ++++ b/libcontainer/nsenter/nsexec.c +@@ -94,14 +94,20 @@ static int child_func(void *arg) + longjmp(*ca->env, JUMP_VAL); + } + +-static int clone_parent(jmp_buf *env, int flags) __attribute__ ((noinline)); +-static int clone_parent(jmp_buf *env, int flags) ++static int clone_parent(jmp_buf *env, int flags, bool delay_ipc_unshare) __attribute__ ((noinline)); ++static int clone_parent(jmp_buf *env, int flags, bool delay_ipc_unshare) + { + int child; + struct clone_arg ca = { + .env = env, + }; + ++ // Don't clone into NEWIPC at the same time as cloning into NEWUSER. ++ // This way we can ensure that NEWIPC namespace belongs to the root in new user namespace. ++ if (delay_ipc_unshare) { ++ flags &= ~CLONE_NEWIPC; ++ } ++ + child = clone(child_func, ca.stack_ptr, CLONE_PARENT | SIGCHLD | flags, &ca); + + /* +@@ -227,7 +233,7 @@ static void update_gidmap(int pid, char *map, int map_len) + + #define JSON_MAX 4096 + +-static void start_child(int pipenum, jmp_buf *env, int syncpipe[2], struct nlconfig_t *config) ++static void start_child(int pipenum, jmp_buf *env, int syncpipe[2], struct nlconfig_t *config, bool delay_ipc_unshare) + { + int len, childpid; + char buf[JSON_MAX]; +@@ -239,7 +245,7 @@ static void start_child(int pipenum, jmp_buf *env, int syncpipe[2], struct nlcon + * (the bootstrap process). Also so we don't need to forward the + * child's exit code or resend its death signal. + */ +- childpid = clone_parent(env, config->cloneflags); ++ childpid = clone_parent(env, config->cloneflags, delay_ipc_unshare); + if (childpid < 0) + bail("unable to fork"); + +@@ -415,6 +421,9 @@ void nsexec(void) + if (config.cloneflags == -1) + bail("missing clone_flags"); + ++ bool delay_ipc_unshare = ((config.cloneflags & CLONE_NEWUSER) == CLONE_NEWUSER) ++ && ((config.cloneflags & CLONE_NEWIPC) == CLONE_NEWIPC); ++ + /* Pipe so we can tell the child when we've finished setting up. */ + if (pipe(syncpipe) < 0) + bail("failed to setup sync pipe between parent and child"); +@@ -447,6 +456,12 @@ void nsexec(void) + if (setgroups(0, NULL) < 0) + bail("setgroups failed"); + ++ if (delay_ipc_unshare) { ++ if (unshare(CLONE_NEWIPC)) { ++ bail("unable to unshare IPC namespace"); ++ } ++ } ++ + if (consolefd != -1) { + if (ioctl(consolefd, TIOCSCTTY, 0) < 0) + bail("ioctl TIOCSCTTY failed"); +@@ -466,7 +481,7 @@ void nsexec(void) + } + + /* Run the parent code. */ +- start_child(pipenum, &env, syncpipe, &config); ++ start_child(pipenum, &env, syncpipe, &config, delay_ipc_unshare); + + /* Should never be reached. */ + bail("should never be reached"); diff --git a/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild new file mode 100644 index 0000000000..8e992535cb --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/app-emulation/runc/runc-1.0.0_rc2_p9.ebuild @@ -0,0 +1,62 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: $ + +EAPI=5 + +GITHUB_URI="github.com/opencontainers/runc" +COREOS_GO_PACKAGE="${GITHUB_URI}" +COREOS_GO_VERSION="go1.6" +# the commit of runc that docker uses. +# see https://github.com/docker/docker/blob/v1.12.6/Dockerfile#L245 +# Note: this commit is only really present in `docker/runc` in the 'docker/1.12.x' branch +# Update the patch number when this commit is changed (i.e. the _p in the +# ebuild). +# The patch version is arbitrarily the number of commits since the tag version +# spcified in the ebuild name. For example: +# $ git log v1.0.0-rc2..${COMMIT_ID} --oneline | wc -l +COMMIT_ID="50a19c6ff828c58e5dab13830bd3dacde268afe5" + +inherit eutils flag-o-matic coreos-go-depend vcs-snapshot + +DESCRIPTION="runc container cli tools" +HOMEPAGE="http://runc.io" + +SRC_URI="https://${GITHUB_URI}/archive/${COMMIT_ID}.tar.gz -> ${P}.tar.gz" +KEYWORDS="amd64 arm64" + +LICENSE="Apache-2.0" +SLOT="0" +IUSE="apparmor selinux +seccomp" + +DEPEND="" +RDEPEND=" + apparmor? ( sys-libs/libapparmor ) + seccomp? ( sys-libs/libseccomp ) +" + +src_prepare() { + epatch "${FILESDIR}/0001-Makefile-do-not-install-dependencies-of-target.patch" + epatch "${FILESDIR}/0002-Dont-set-label-for-mqueue-under-userns.patch" + + # Work around https://github.com/golang/go/issues/14669 + # Remove after updating to go1.7 + filter-flags -O* + + go_export +} + +src_compile() { + # build up optional flags + local options=( + $(usev apparmor) + $(usev seccomp) + $(usev selinux) + ) + + emake BUILDTAGS="${options[*]}" COMMIT="${COMMIT_ID}" +} + +src_install() { + dobin runc +}