containerd/pkg/oci/utils_unix.go

//go:build !windows

/*
   Copyright The containerd Authors.

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
*/

package oci

import (
	"errors"
	"fmt"
	"io/fs"
	"os"
	"path/filepath"
	"strings"
	"syscall"

	"github.com/moby/sys/userns"
	"github.com/opencontainers/runtime-spec/specs-go"
	"golang.org/x/sys/unix"
)

// ErrNotADevice denotes that a file is not a valid linux device.
// When checking this error, use errors.Is(err, oci.ErrNotADevice)
var ErrNotADevice = errors.New("not a device node")

// Testing dependencies
var (
	osReadDir              = os.ReadDir
	usernsRunningInUserNS  = userns.RunningInUserNS
	overrideDeviceFromPath func(path string) error
)

// HostDevices returns all devices that can be found under /dev directory.
func HostDevices() ([]specs.LinuxDevice, error) {
	return getDevices("/dev", "")
}

func getDevices(path, containerPath string) ([]specs.LinuxDevice, error) {
	stat, err := os.Stat(path)
	if err != nil {
		return nil, fmt.Errorf("error stating device path: %w", err)
	}

	if !stat.IsDir() {
		dev, err := DeviceFromPath(path)
		if err != nil {
			// wrap error with detailed path and container path when it is ErrNotADevice
			if errors.Is(err, ErrNotADevice) {
				return nil, fmt.Errorf("get device path: %q containerPath: %q error: %w", path, containerPath, err)
			}
			return nil, err
		}
		if containerPath != "" {
			dev.Path = containerPath
		}
		return []specs.LinuxDevice{*dev}, nil
	}

	files, err := osReadDir(path)
	if err != nil {
		return nil, err
	}
	var out []specs.LinuxDevice
	for _, f := range files {
		switch {
		case f.IsDir():
			switch f.Name() {
			// ".lxc" & ".lxd-mounts" added to address https://github.com/lxc/lxd/issues/2825
			// ".udev" added to address https://github.com/opencontainers/runc/issues/2093
			case "pts", "shm", "fd", "mqueue", ".lxc", ".lxd-mounts", ".udev":
				continue
			default:
				var cp string
				if containerPath != "" {
					cp = filepath.Join(containerPath, filepath.Base(f.Name()))
				}
				sub, err := getDevices(filepath.Join(path, f.Name()), cp)
				if err != nil {
					if errors.Is(err, os.ErrPermission) && usernsRunningInUserNS() {
						// ignore the "permission denied" error if running in userns.
						// This allows rootless containers to use devices that are
						// accessible, ignoring devices / subdirectories that are not.
						continue
					}
					return nil, err
				}

				out = append(out, sub...)
				continue
			}
		case f.Name() == "console":
			continue
		default:
			device, err := DeviceFromPath(filepath.Join(path, f.Name()))
			if err != nil {
				if errors.Is(err, ErrNotADevice) {
					continue
				}
				if os.IsNotExist(err) {
					continue
				}
				if errors.Is(err, os.ErrPermission) && usernsRunningInUserNS() {
					// ignore the "permission denied" error if running in userns.
					// This allows rootless containers to use devices that are
					// accessible, ignoring devices that are not.
					continue
				}
				return nil, err
			}
			if device.Type == fifoDevice {
				continue
			}
			if containerPath != "" {
				device.Path = filepath.Join(containerPath, filepath.Base(f.Name()))
			}
			out = append(out, *device)
		}
	}
	return out, nil
}

// TODO consider adding these consts to the OCI runtime-spec.
const (
	wildcardDevice = "a" //nolint:nolintlint,unused // currently unused, but should be included when upstreaming to OCI runtime-spec.
	blockDevice    = "b"
	charDevice     = "c" // or "u"
	fifoDevice     = "p"
)

// DeviceFromPath takes the path to a device to look up the information about a
// linux device and returns that information as a LinuxDevice struct.
func DeviceFromPath(path string) (*specs.LinuxDevice, error) {
	if overrideDeviceFromPath != nil {
		if err := overrideDeviceFromPath(path); err != nil {
			return nil, err
		}
	}

	var stat unix.Stat_t
	if err := unix.Lstat(path, &stat); err != nil {
		return nil, err
	}

	var (
		devNumber = uint64(stat.Rdev) //nolint:nolintlint,unconvert // the type is 32bit on mips.
		major     = unix.Major(devNumber)
		minor     = unix.Minor(devNumber)
	)

	var (
		devType string
		mode    = stat.Mode
	)

	switch mode & unix.S_IFMT {
	case unix.S_IFBLK:
		devType = blockDevice
	case unix.S_IFCHR:
		devType = charDevice
	case unix.S_IFIFO:
		devType = fifoDevice
	default:
		return nil, ErrNotADevice
	}
	fm := os.FileMode(mode &^ unix.S_IFMT)
	return &specs.LinuxDevice{
		Type:     devType,
		Path:     path,
		Major:    int64(major),
		Minor:    int64(minor),
		FileMode: &fm,
		UID:      &stat.Uid,
		GID:      &stat.Gid,
	}, nil
}

// resolveInRootFS resolves name within rootFS, following symbolic links while
// treating rootFS as the filesystem root. It returns the canonical path
// relative to rootFS.
//
// ReadLink is expected to return a bounded target. Linux rejects symlink
// targets of PATH_MAX (4096) bytes or more when creating them. Together with
// the 40-link limit, this bounds the work during resolution. However, a
// synthetic fs.ReadLinkFS can return an arbitrarily large target and make the
// resolution expensive. See the "Length limit" section of path_resolution(7).
func resolveInRootFS(rootFs fs.ReadLinkFS, name string) (string, error) {
	if len(name) == 0 {
		return "", &fs.PathError{
			Op:   "resolve",
			Path: name,
			Err:  syscall.ENOENT,
		}
	}

	// In Linux 4.2, the kernel's pathname-resolution code was reworked to
	// eliminate the use of recursion, so that the only limit that remains
	// is the maximum of 40 resolutions for the entire pathname.
	//
	// https://man7.org/linux/man-pages/man7/path_resolution.7.html
	const symloopMax = 40
	followed := 0

	seq := "/"

	pendings := splitPathComponents(name)
	candidates := make([]string, 0, len(pendings))
	for len(pendings) > 0 {
		part := pendings[0]
		pendings = pendings[1:]

		if part == "." {
			continue
		}

		if part == ".." {
			if len(candidates) > 0 {
				candidates = candidates[:len(candidates)-1]
			}
			continue
		}

		candidates = append(candidates, part)

		resolved := strings.Join(candidates, seq)

		info, err := rootFs.Lstat(resolved)
		if err != nil {
			return "", err
		}

		if info.Mode()&os.ModeSymlink != 0 {
			followed++

			if followed > symloopMax {
				return "", &fs.PathError{
					Op:   "resolve",
					Path: resolved,
					Err:  syscall.ELOOP,
				}
			}

			// target can't be empty in real filesystem because
			// linux kernel doesn't allow to create empty symbolic
			// link. However, synthetic fs.FS can do that.
			target, err := rootFs.ReadLink(resolved)
			if err != nil {
				return "", err
			}

			if filepath.IsAbs(target) {
				candidates = candidates[:0]
			} else {
				candidates = candidates[:len(candidates)-1]
			}

			pendings = append(splitPathComponents(target), pendings...)
			continue
		}

		if !info.IsDir() && len(pendings) > 0 {
			return "", &fs.PathError{
				Op:   "resolve",
				Path: resolved,
				Err:  syscall.ENOTDIR,
			}
		}
	}

	resolvedName := strings.Join(candidates, seq)
	if resolvedName == "" {
		resolvedName = "."
	}
	return resolvedName, nil
}

// splitPathComponents returns path components in string slice format and appends
// "." as last one if origin name contains trailing slash. With trailing dot
// component, the path resolution can verify if name is directory or not.
func splitPathComponents(name string) []string {
	res := make([]string, 0, 8)
	for part := range strings.SplitSeq(name, "/") {
		if part == "" {
			continue
		}
		res = append(res, part)
	}

	if len(name) > 0 && name[len(name)-1] == '/' {
		res = append(res, ".")
	}
	return res
}