|
| 1 | +use crate::sandbox::oci; |
| 2 | +use libcontainer::workload::default::DefaultExecutor; |
| 3 | +use libcontainer::workload::{Executor, ExecutorError}; |
| 4 | +use nix::unistd::{dup, dup2}; |
| 5 | + |
| 6 | +use libc::{STDERR_FILENO, STDIN_FILENO, STDOUT_FILENO}; |
| 7 | +use oci_spec::runtime::Spec; |
| 8 | +use std::io::Read; |
| 9 | +use std::{fs::OpenOptions, os::fd::RawFd, path::PathBuf}; |
| 10 | + |
| 11 | +#[derive(Default)] |
| 12 | +pub struct LinuxContainerExecutor { |
| 13 | + stdin: Option<RawFd>, |
| 14 | + stdout: Option<RawFd>, |
| 15 | + stderr: Option<RawFd>, |
| 16 | + default_executor: DefaultExecutor, |
| 17 | +} |
| 18 | + |
| 19 | +impl LinuxContainerExecutor { |
| 20 | + pub fn new(stdin: Option<RawFd>, stdout: Option<RawFd>, stderr: Option<RawFd>) -> Self { |
| 21 | + Self { |
| 22 | + stdin, |
| 23 | + stdout, |
| 24 | + stderr, |
| 25 | + ..Default::default() |
| 26 | + } |
| 27 | + } |
| 28 | +} |
| 29 | + |
| 30 | +impl Executor for LinuxContainerExecutor { |
| 31 | + fn exec(&self, spec: &Spec) -> Result<(), ExecutorError> { |
| 32 | + redirect_io(self.stdin, self.stdout, self.stderr).map_err(|err| { |
| 33 | + log::error!("failed to redirect io: {}", err); |
| 34 | + ExecutorError::Other(format!("failed to redirect io: {}", err)) |
| 35 | + })?; |
| 36 | + self.default_executor.exec(spec) |
| 37 | + } |
| 38 | + |
| 39 | + fn can_handle(&self, spec: &Spec) -> bool { |
| 40 | + let args = oci::get_args(spec); |
| 41 | + |
| 42 | + if args.is_empty() { |
| 43 | + return false; |
| 44 | + } |
| 45 | + |
| 46 | + let executable = args[0].as_str(); |
| 47 | + |
| 48 | + // mostly follows youki's verify_binary implementation |
| 49 | + // https://github.com/containers/youki/blob/2d6fd7650bb0f22a78fb5fa982b5628f61fe25af/crates/libcontainer/src/process/container_init_process.rs#L106 |
| 50 | + let path = if executable.contains('/') { |
| 51 | + PathBuf::from(executable) |
| 52 | + } else { |
| 53 | + let path = std::env::var("PATH").unwrap_or_default(); |
| 54 | + // check each path in $PATH |
| 55 | + let mut found = false; |
| 56 | + let mut found_path = PathBuf::default(); |
| 57 | + for p in path.split(':') { |
| 58 | + let path = PathBuf::from(p).join(executable); |
| 59 | + if path.exists() { |
| 60 | + found = true; |
| 61 | + found_path = path; |
| 62 | + break; |
| 63 | + } |
| 64 | + } |
| 65 | + if !found { |
| 66 | + return false; |
| 67 | + } |
| 68 | + found_path |
| 69 | + }; |
| 70 | + |
| 71 | + // check execute permission |
| 72 | + use std::os::unix::fs::PermissionsExt; |
| 73 | + let metadata = path.metadata(); |
| 74 | + if metadata.is_err() { |
| 75 | + log::info!("failed to get metadata of {:?}", path); |
| 76 | + return false; |
| 77 | + } |
| 78 | + let metadata = metadata.unwrap(); |
| 79 | + let permissions = metadata.permissions(); |
| 80 | + if !metadata.is_file() || permissions.mode() & 0o001 == 0 { |
| 81 | + log::info!("{} is not a file or has no execute permission", executable); |
| 82 | + return false; |
| 83 | + } |
| 84 | + |
| 85 | + // check the shebang and ELF magic number |
| 86 | + // https://en.wikipedia.org/wiki/Executable_and_Linkable_Format#File_header |
| 87 | + let mut buffer = [0; 4]; |
| 88 | + |
| 89 | + let file = OpenOptions::new().read(true).open(path); |
| 90 | + if file.is_err() { |
| 91 | + log::info!("failed to open {}", executable); |
| 92 | + return false; |
| 93 | + } |
| 94 | + let mut file = file.unwrap(); |
| 95 | + match file.read_exact(&mut buffer) { |
| 96 | + Ok(_) => {} |
| 97 | + Err(err) => { |
| 98 | + log::info!("failed to read shebang of {}: {}", executable, err); |
| 99 | + return false; |
| 100 | + } |
| 101 | + } |
| 102 | + match buffer { |
| 103 | + // ELF magic number |
| 104 | + [0x7f, 0x45, 0x4c, 0x46] => true, |
| 105 | + // shebang |
| 106 | + [0x23, 0x21, ..] => true, |
| 107 | + _ => { |
| 108 | + log::info!("{} is not a valid script or elf file", executable); |
| 109 | + false |
| 110 | + } |
| 111 | + } |
| 112 | + } |
| 113 | + |
| 114 | + fn name(&self) -> &'static str { |
| 115 | + self.default_executor.name() |
| 116 | + } |
| 117 | +} |
| 118 | + |
| 119 | +fn redirect_io(stdin: Option<i32>, stdout: Option<i32>, stderr: Option<i32>) -> anyhow::Result<()> { |
| 120 | + if let Some(stdin) = stdin { |
| 121 | + dup(STDIN_FILENO)?; |
| 122 | + dup2(stdin, STDIN_FILENO)?; |
| 123 | + } |
| 124 | + if let Some(stdout) = stdout { |
| 125 | + dup(STDOUT_FILENO)?; |
| 126 | + dup2(stdout, STDOUT_FILENO)?; |
| 127 | + } |
| 128 | + if let Some(stderr) = stderr { |
| 129 | + dup(STDERR_FILENO)?; |
| 130 | + dup2(stderr, STDERR_FILENO)?; |
| 131 | + } |
| 132 | + Ok(()) |
| 133 | +} |
0 commit comments