From 8497d1274b046804999699ccb66b11a3249906a1 Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Wed, 4 Jun 2014 17:54:00 -0700 Subject: [PATCH 1/2] Move env load to nsenter Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- pkg/libcontainer/namespaces/execin.go | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/pkg/libcontainer/namespaces/execin.go b/pkg/libcontainer/namespaces/execin.go index 699c67dbc7..4d5671e778 100644 --- a/pkg/libcontainer/namespaces/execin.go +++ b/pkg/libcontainer/namespaces/execin.go @@ -14,12 +14,6 @@ import ( // ExecIn uses an existing pid and joins the pid's namespaces with the new command. func ExecIn(container *libcontainer.Container, nspid int, args []string) error { - // clear the current processes env and replace it with the environment - // defined on the container - if err := LoadContainerEnvironment(container); err != nil { - return err - } - // TODO(vmarmol): If this gets too long, send it over a pipe to the child. // Marshall the container into JSON since it won't be available in the namespace. containerJson, err := json.Marshal(container) @@ -36,7 +30,7 @@ func ExecIn(container *libcontainer.Container, nspid int, args []string) error { // Enter the namespace and then finish setup finalArgs := []string{os.Args[0], "nsenter", strconv.Itoa(nspid), processLabel, string(containerJson)} finalArgs = append(finalArgs, args...) - if err := system.Execv(finalArgs[0], finalArgs[0:], container.Env); err != nil { + if err := system.Execv(finalArgs[0], finalArgs[0:], os.Environ()); err != nil { return err } panic("unreachable") @@ -44,13 +38,18 @@ func ExecIn(container *libcontainer.Container, nspid int, args []string) error { // NsEnter is run after entering the namespace. func NsEnter(container *libcontainer.Container, processLabel string, nspid int, args []string) error { + // clear the current processes env and replace it with the environment + // defined on the container + if err := LoadContainerEnvironment(container); err != nil { + return err + } if err := FinalizeNamespace(container); err != nil { return err } if err := label.SetProcessLabel(processLabel); err != nil { return err } - if err := system.Execv(args[0], args[0:], os.Environ()); err != nil { + if err := system.Execv(args[0], args[0:], container.Env); err != nil { return err } panic("unreachable") From 7eb508633db93213404292bd4fd21b6855f45bea Mon Sep 17 00:00:00 2001 From: Michael Crosby Date: Wed, 4 Jun 2014 18:03:17 -0700 Subject: [PATCH 2/2] Exclude the user namespace for setns Docker-DCO-1.1-Signed-off-by: Michael Crosby (github: crosbymichael) --- pkg/libcontainer/namespaces/nsenter.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg/libcontainer/namespaces/nsenter.go b/pkg/libcontainer/namespaces/nsenter.go index c5dd2e7953..d5c2e761b7 100644 --- a/pkg/libcontainer/namespaces/nsenter.go +++ b/pkg/libcontainer/namespaces/nsenter.go @@ -85,8 +85,9 @@ void nsenter() { fprintf(stderr, "nsenter: Failed to open directory \"%s\" with error: \"%s\"\n", ns_dir, strerror(errno)); exit(1); } + while((dent = readdir(dir)) != NULL) { - if(strcmp(dent->d_name, ".") == 0 || strcmp(dent->d_name, "..") == 0) { + if(strcmp(dent->d_name, ".") == 0 || strcmp(dent->d_name, "..") == 0 || strcmp(dent->d_name, "user") == 0) { continue; }