mountinfo: linux: add a /proc/self/mountinfo fallback #135
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
This should fix the CI issues in opencontainers/runc#4109. Sorry for the noise 😅. |
samuelkarp
approved these changes
Nov 6, 2023
There was a problem hiding this comment.
LGTM
(because I didn't know offhand if os.IsNotExist would work with nil errs: https://go.dev/play/p/Hku5gFHXWtX)
In very specific cases (that we hit in runc), it is possible to be running in a child pid namespace (where the Go process's pid is 1) but still have a host /proc. While this is not a problem with /proc/thread-self (since the process *is* in the host pid namespace), the /proc/self/task/<tid> fallback doesn't work because gettid(2) returns the wrong thread-id for the host pid namespace. There isn't much we can do in this case other than use /proc/self, because the simple workarounds (grep NSpid /proc/self/task/*/status) aren't available in pre-3.17 kernels and any more complicated schemes (such as setting the signal mask to something unique and scanning for it) are unworkable for obvious reasons. Fixes: 12c61a3 ("mountinfo: linux: use /proc/thread-self/mountinfo") Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
cyphar
force-pushed
the
mountinfo-linux-proc-self-fallback
branch
from
f0e0b5e to
6c165c1
Compare
|
Yup, it seems this does fix the issue. Before: And now in the test PR (opencontainers/runc#4112), all the tests pass. It is unfortunate that in theory we could produce the wrong data in this one case, but it's only for ancient kernels and (in runc's case at least) we are never running with heterogeneous threads when we are pid1 inside the container. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In very specific cases (that we hit in runc), it is possible to be running in a child pid namespace (where the Go process's pid is 1) but still have a host /proc. While this is not a problem with /proc/thread-self (since the process is in the host pid namespace), the /proc/self/task/ fallback doesn't work because gettid(2) returns the wrong thread-id for the host pid namespace.
There isn't much we can do in this case other than use /proc/self, because the simple workarounds (grep NSpid /proc/self/task/*/status) aren't available in pre-3.17 kernels and any more complicated schemes (such as setting the signal mask to something unique and scanning for it) are unworkable for obvious reasons.
Fixes: 12c61a3 ("mountinfo: linux: use /proc/thread-self/mountinfo")
Signed-off-by: Aleksa Sarai cyphar@cyphar.com