containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

networking: use --enable-sandbox if available 

if slirp4netns supports sandboxing, enable it.

It automatically creates a new mount namespace where slirp4netns will
run and have limited access to the host resources.

It needs slirp4netns 0.4.1.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano 2019-09-16 16:40:41 +02:00
parent a1970e1915
commit 7c3428de26
No known key found for this signature in database
GPG Key ID: E4730F97F60286ED
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libpod/networking_linux.go
View File

@ -127,13 +127,13 @@ type slirp4netnsCmd struct {
Args slirp4netnsCmdArg `json:"arguments"` Args slirp4netnsCmdArg `json:"arguments"`
} }
func checkSlirpFlags(path string) (bool, bool, error) { func checkSlirpFlags(path string) (bool, bool, bool, error) {
cmd := exec.Command(path, "--help") cmd := exec.Command(path, "--help")
out, err := cmd.CombinedOutput() out, err := cmd.CombinedOutput()
if err != nil { if err != nil {
return false, false, err return false, false, false, err
} }
return strings.Contains(string(out), "--disable-host-loopback"), strings.Contains(string(out), "--mtu"), nil return strings.Contains(string(out), "--disable-host-loopback"), strings.Contains(string(out), "--mtu"), strings.Contains(string(out), "--enable-sandbox"), nil
} }
// Configure the network namespace for a rootless container // Configure the network namespace for a rootless container
@ -166,7 +166,7 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) (err error) {
if havePortMapping { if havePortMapping {
cmdArgs = append(cmdArgs, "--api-socket", apiSocket, fmt.Sprintf("%d", ctr.state.PID)) cmdArgs = append(cmdArgs, "--api-socket", apiSocket, fmt.Sprintf("%d", ctr.state.PID))
} }
dhp, mtu, err := checkSlirpFlags(path) dhp, mtu, sandbox, err := checkSlirpFlags(path)
if err != nil { if err != nil {
return errors.Wrapf(err, "error checking slirp4netns binary %s", path) return errors.Wrapf(err, "error checking slirp4netns binary %s", path)
} }
@ -176,6 +176,9 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) (err error) {
if mtu { if mtu {
cmdArgs = append(cmdArgs, "--mtu", "65520") cmdArgs = append(cmdArgs, "--mtu", "65520")
} }
if sandbox {
cmdArgs = append(cmdArgs, "--enable-sandbox")
}
cmdArgs = append(cmdArgs, "-c", "-e", "3", "-r", "4", fmt.Sprintf("%d", ctr.state.PID), "tap0") cmdArgs = append(cmdArgs, "-c", "-e", "3", "-r", "4", fmt.Sprintf("%d", ctr.state.PID), "tap0")
cmd := exec.Command(path, cmdArgs...) cmd := exec.Command(path, cmdArgs...)