dilim/moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2026-08-04 15:11:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #48774 from thaJeztah/safepath_nits

Browse Source 
internal/safepath: log some unhandled errors, and remove workaround for ECI / Sysbox
This commit is contained in:
Sebastiaan van Stijn
2024-10-28 10:39:38 +01:00
committed by GitHub
parent 89c0170aee 75e8f57579
commit 61433c2a6e
2 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
internal/safepath/join_linux.go
View File

@@ -20,7 +20,7 @@ import (
// After use, it is the caller's responsibility to call Close on the returned
// SafePath object, which will unmount the temporary file/directory
// and remove it.
func Join(_ context.Context, path, subpath string) (*SafePath, error) {
func Join(ctx context.Context, path, subpath string) (*SafePath, error) {
base, subpart, err := evaluatePath(path, subpath)
if err != nil {
return nil, err
@@ -33,22 +33,21 @@ func Join(_ context.Context, path, subpath string) (*SafePath, error) {
return nil, err
}
defer unix_noeintr.Close(fd)
defer func() {
if err := unix_noeintr.Close(fd); err != nil {
log.G(ctx).WithError(err).Errorf("Closing FD %d failed for safeOpenFd(%s, %s)", fd, base, subpart)
}
}()
tmpMount, err := tempMountPoint(fd)
if err != nil {
return nil, errors.Wrap(err, "failed to create temporary file for safe mount")
}
pid := strconv.Itoa(unix.Gettid())
// Using explicit pid path, because /proc/self/fd/<fd> fails with EACCES
// when running under "Enhanced Container Isolation" in Docker Desktop
// which uses sysbox runtime under the hood.
// TODO(vvoland): Investigate.
mountSource := "/proc/" + pid + "/fd/" + strconv.Itoa(fd)
if err := unix_noeintr.Mount(mountSource, tmpMount, "none", unix.MS_BIND, ""); err != nil {
os.Remove(tmpMount)
if err := unix_noeintr.Mount("/proc/self/fd/"+strconv.Itoa(fd), tmpMount, "none", unix.MS_BIND, ""); err != nil {
if err := os.Remove(tmpMount); err != nil {
log.G(ctx).WithError(err).Warn("failed to remove tmpMount after failed mount")
}
return nil, errors.Wrap(err, "failed to mount resolved path")
}

2
internal/safepath/k8s_safeopen_linux.go
View File

@@ -78,7 +78,7 @@ func kubernetesSafeOpen(base, subpath string) (int, error) {
// Trigger auto mount if it's an auto-mounted directory, ignore error if not a directory.
// Notice the trailing slash is mandatory, see "automount" in openat(2) and open_by_handle_at(2).
unix_noeintr.Fstatat(parentFD, seg+"/", &deviceStat, unix.AT_SYMLINK_NOFOLLOW)
_ = unix_noeintr.Fstatat(parentFD, seg+"/", &deviceStat, unix.AT_SYMLINK_NOFOLLOW)
log.G(context.TODO()).Debugf("Opening path %s", currentPath)
childFD, err = unix_noeintr.Openat(parentFD, seg, openFDFlags|unix.O_CLOEXEC, 0)