Attachment 606705 Details for Bug 851340 – Use newer clone flags

[patch] Use newer clone flags

0001-Use-CLONE_NEWPID-CLONE_NEWIPC-and-CLONE_NEWNET-if-av.patch (text/plain), 2.23 KB, created by Colin Walters on 2012-08-23 21:05:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Colin Walters

Created: 2012-08-23 21:05:47 UTC

Size: 2.23 KB

patch

obsolete

>From ec030315019ef0751ac2772696b6f2ebc26a4d71 Mon Sep 17 00:00:00 2001
>From: Colin Walters <walters@verbum.org>
>Date: Thu, 23 Aug 2012 16:52:05 -0400
>Subject: [PATCH] Use CLONE_NEWPID, CLONE_NEWIPC, and CLONE_NEWNET if
> available
>
>CLONE_NEWPID ensures that we don't get processes leaking out of the
>build container.  The other two ensure more isolation.
>
>For more about this, see http://git.gnome.org/browse/linux-user-chroot/tree/README
>---
> py/mock.py           | 14 +++++++++-----
> py/mockbuild/util.py |  4 ++++
> 2 files changed, 13 insertions(+), 5 deletions(-)
>
>diff --git a/py/mock.py b/py/mock.py
>index 9f313e8..dab9b33 100755
>--- a/py/mock.py
>+++ b/py/mock.py
>@@ -768,13 +768,17 @@ def main(ret):
>     os.environ["HOME"] = chroot.homedir
> 
>     # New namespace starting from here
>+    base_unshare_flags = mockbuild.util.CLONE_NEWNS|mockbuild.util.CLONE_NEWUTS
>+    extended_unshare_flags = base_unshare_flags|mockbuild.util.CLONE_NEWNET|mockbuild.util.CLONE_NEWPID|mockbuild.util.CLONE_NEWIPC
>     try:
>-        mockbuild.util.unshare(mockbuild.util.CLONE_NEWNS|mockbuild.util.CLONE_NEWUTS)
>+        mockbuild.util.unshare(extended_unshare_flags)
>     except mockbuild.exception.UnshareFailed, e:
>-        log.error("Namespace unshare failed.")
>-        sys.exit(e.resultcode)
>-    except:
>-        raise
>+        log.debug("unshare(%d) failed, falling back to unshare(%d)" % (extended_unshare_flags, base_unshare_flags))
>+        try:
>+            mockbuild.util.unshare(base_unshare_flags)
>+        except mockbuild.exception.UnshareFailed, e:
>+            log.error("Namespace unshare failed.")
>+            sys.exit(e.resultcode)
> 
>     # set personality (ie. setarch)
>     if config_opts['internal_setarch']:
>diff --git a/py/mockbuild/util.py b/py/mockbuild/util.py
>index 95d69c1..9852a92 100644
>--- a/py/mockbuild/util.py
>+++ b/py/mockbuild/util.py
>@@ -30,8 +30,12 @@ _libc.personality.argtypes = [ctypes.c_ulong]
> _libc.personality.restype = ctypes.c_int
> _libc.unshare.argtypes = [ctypes.c_int,]
> _libc.unshare.restype = ctypes.c_int
>+# See linux/include/sched.h
> CLONE_NEWNS = 0x00020000
> CLONE_NEWUTS = 0x04000000
>+CLONE_NEWPID = 0x20000000
>+CLONE_NEWNET = 0x40000000
>+CLONE_NEWIPC = 0x08000000
> 
> # taken from sys/personality.h
> PER_LINUX32=0x0008
>-- 
>1.7.11.4
>

Actions: View | Diff

Attachments on bug 851340: 606705 | 606707