Documentation
¶
Index ¶
- Constants
- Variables
- func Annotations(labels []string) (bundle string, userAnnotations map[string]string)
- func CleanPath(path string) string
- func CloseExecFrom(minFd int) error
- func EnsureProcHandle(fh *os.File) error
- func ExitStatus(status unix.WaitStatus) int
- func GetIntSize() int
- func NewSockPair(name string) (parent, child *os.File, err error)
- func RecvFd(socket *os.File) (*os.File, error)
- func ResolveRootfs(uncleanRootfs string) (string, error)
- func SearchLabels(labels []string, query string) string
- func SendFd(socket *os.File, name string, fd uintptr) error
- func StringSliceContains(s []string, val string) bool
- func StripRoot(root, path string) string
- func UnsafeCloseFrom(minFd int) error
- func WithProcfd(root, unsafePath string, fn func(procfd string) error) error
- func WriteJSON(w io.Writer, v interface{}) error
- type ProcThreadSelfCloser
Constants ¶
const MaxNameLen = 4096
MaxSendfdLen is the maximum length of the name of a file descriptor being sent using SendFd. The name of the file handle returned by RecvFd will never be larger than this value.
Variables ¶
var NativeEndian binary.ByteOrder
NativeEndian is the native byte order of the host system.
Functions ¶
func Annotations ¶
Annotations returns the bundle path and user defined annotations from the libcontainer state. We need to remove the bundle because that is a label added by libcontainer.
func CleanPath ¶
CleanPath makes a path safe for use with filepath.Join. This is done by not only cleaning the path, but also (if the path is relative) adding a leading '/' and cleaning it (then removing the leading '/'). This ensures that a path resulting from prepending another path will always resolve to lexically be a subdirectory of the prefixed path. This is all done lexically, so paths that include symlinks won't be safe as a result of using CleanPath.
func CloseExecFrom ¶
CloseExecFrom sets the O_CLOEXEC flag on all file descriptors greater or equal to minFd in the current process.
func EnsureProcHandle ¶
EnsureProcHandle returns whether or not the given file handle is on procfs.
func ExitStatus ¶
func ExitStatus(status unix.WaitStatus) int
ExitStatus returns the correct exit status for a process based on if it was signaled or exited cleanly
func GetIntSize ¶
func GetIntSize() int
func NewSockPair ¶
NewSockPair returns a new SOCK_STREAM unix socket pair.
func RecvFd ¶
RecvFd waits for a file descriptor to be sent over the given AF_UNIX socket. The file name of the remote file descriptor will be recreated locally (it is sent as non-auxiliary data in the same payload).
func ResolveRootfs ¶
ResolveRootfs ensures that the current working directory is not a symlink and returns the absolute path to the rootfs
func SearchLabels ¶
SearchLabels searches a list of key-value pairs for the provided key and returns the corresponding value. The pairs must be separated with '='.
func SendFd ¶
SendFd sends a file descriptor over the given AF_UNIX socket. In addition, the file.Name() of the given file will also be sent as non-auxiliary data in the same payload (allowing to send contextual information for a file descriptor).
func StringSliceContains ¶
func StripRoot ¶
StripRoot returns the passed path, stripping the root path if it was (lexicially) inside it. Note that both passed paths will always be treated as absolute, and the returned path will also always be absolute. In addition, the paths are cleaned before stripping the root.
func UnsafeCloseFrom ¶
UnsafeCloseFrom closes all file descriptors greater or equal to minFd in the current process, except for those critical to Go's runtime (such as the netpoll management descriptors).
NOTE: That this function is incredibly dangerous to use in most Go code, as closing file descriptors from underneath *os.File handles can lead to very bad behaviour (the closed file descriptor can be re-used and then any *os.File operations would apply to the wrong file). This function is only intended to be called from the last stage of runc init.
func WithProcfd ¶
WithProcfd runs the passed closure with a procfd path (/proc/self/fd/...) corresponding to the unsafePath resolved within the root. Before passing the fd, this path is verified to have been inside the root -- so operating on it through the passed fdpath should be safe. Do not access this path through the original path strings, and do not attempt to use the pathname outside of the passed closure (the file handle will be freed once the closure returns).
Types ¶
type ProcThreadSelfCloser ¶
type ProcThreadSelfCloser func()
func ProcThreadSelf ¶
func ProcThreadSelf(subpath string) (string, ProcThreadSelfCloser)
ProcThreadSelf returns a string that is equivalent to /proc/thread-self/<subpath>, with a graceful fallback on older kernels where /proc/thread-self doesn't exist. This method DOES NOT use SecureJoin, meaning that the passed string needs to be trusted. The caller _must_ call the returned procThreadSelfCloser function (which is runtime.UnlockOSThread) *only once* after it has finished using the returned path string.
func ProcThreadSelfFd ¶
func ProcThreadSelfFd(fd uintptr) (string, ProcThreadSelfCloser)
ProcThreadSelfFd is small wrapper around ProcThreadSelf to make it easier to create a /proc/thread-self handle for given file descriptor.
It is basically equivalent to ProcThreadSelf(fmt.Sprintf("fd/%d", fd)), but without using fmt.Sprintf to avoid unneeded overhead.
Source Files