nsenter

README

nsenter

Credits

This package was taken from runc and adapted for the needs of the seccomp agent.

Source: https://github.com/opencontainers/runc/blob/master/libcontainer/nsenter/README.md

How does it work?

The nsenter package registers a special init constructor that is called before the Go runtime has a chance to boot. This provides us the ability to setns on existing namespaces and avoid the issues that the Go runtime has with multiple threads. This constructor will be called if this package is registered, imported, in your go application.

The nsenter package will import "C" and it uses cgo package. In cgo, if the import of "C" is immediately preceded by a comment, that comment, called the preamble, is used as a header when compiling the C parts of the package. So every time we import package nsenter, the C code function nsexec() would be called.

Because nsexec() must be run before the Go runtime in order to use the Linux kernel namespace, you must import this library into a package if you plan to use libcontainer directly. Otherwise Go will not execute the nsexec() constructor, which means that the re-exec will not cause the namespaces to be joined.

Documentation

Index

• func Init()
• func OpenCwd(pid uint32) (*os.File, error)
• func OpenNamespace(pid uint32, nstype string) (*os.File, error)
• func OpenRoot(pid uint32) (*os.File, error)
• func RegisterModule(name string, f RunFunc) bool
• func Run(root, cwd, mntns, netns, pidns *os.File, i interface{}) ([]byte, error)
• type ModuleXXX
• type RunFunc

Functions

func Init

func Init()

Init checks if the process has re-executed itself and must run a registered module. Init() needs to be called explicitely from main() to ensure it is called after all other init() functions.

func OpenCwd

func OpenCwd(pid uint32) (*os.File, error)

OpenCwd opens a /proc/pid/cwd file. It is done separately to Run() so that the caller can call libseccomp.NotifIDValid() in between.

func OpenNamespace

func OpenNamespace(pid uint32, nstype string) (*os.File, error)

OpenNamespaces opens a namespace file. It is done separately to Run() so that the caller can call libseccomp.NotifIDValid() in between.

func OpenRoot

func OpenRoot(pid uint32) (*os.File, error)

OpenRoot opens a /proc/pid/root file. It is done separately to Run() so that the caller can call libseccomp.NotifIDValid() in between.

func RegisterModule

func RegisterModule(name string, f RunFunc) bool

func Run

func Run(root, cwd, mntns, netns, pidns *os.File, i interface{}) ([]byte, error)

Run executes a module in other namespaces

Types

type ModuleXXX

type ModuleXXX interface {
	Run([]byte)
}

type RunFunc

type RunFunc func([]byte) string