mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Ayush RanjanandgVisor bot
c632f85036
Directfs accesses host filesystem directly, without going through the gofer server. This change basically adds runsc fsgofer functionality into the gofer client. We use the gofer dentry impl abstraction to make direct host syscalls instead of making LISAFS RPCs. It works on a donated FD to the root of the mount. All other relevant mount options supported in gofer client are also supported here. Directfs is also a lisafs user. Directfs client makes a Mount RPC. The server is expected to donate a host FD to the mount point that the client can use to perform all necessary filesystem operations. Directfs client does not set up any flipcall channels, because it (mostly) doesn't make any RPCs. Note however that we can not avoid LISAFS RPCs in certain cases. Certain operations like bind(2) and connect(2) require host paths. But the container filesystem is not mounted inside the sandbox's mount namespace. The sandbox just has an FD to the filesystem root. Furthermore, procfs is also not mounted in the sandbox process for security reasons. Otherwise we could have used host paths like `/proc/self/fd/<sockFD>`. The only viable option is to use fchdir(2) to change working directory to the socket's parent directory and use a relative host path from there. But in certain situations, we don't even have access to a socket's parent directory (in case of a socket mount point). The parent lives in a different gofer mount in the sentry. There is no clean way of fetching that. In these extreme corner cases, directfs falls back to using LISAFS RPCs. These corner cases are: - chmod(2) on mount point socket. - utimensat(2) on mount point symlink. - connect(2) on mount point socket. PiperOrigin-RevId: 510465837
131 lines
3.5 KiB
Go
131 lines
3.5 KiB
Go
// Copyright 2020 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package gofer
|
|
|
|
import (
|
|
"golang.org/x/sys/unix"
|
|
"gvisor.dev/gvisor/pkg/abi/linux"
|
|
"gvisor.dev/gvisor/pkg/context"
|
|
"gvisor.dev/gvisor/pkg/log"
|
|
"gvisor.dev/gvisor/pkg/sentry/socket/unix/transport"
|
|
"gvisor.dev/gvisor/pkg/syserr"
|
|
"gvisor.dev/gvisor/pkg/waiter"
|
|
)
|
|
|
|
func (d *dentry) isSocket() bool {
|
|
return d.fileType() == linux.S_IFSOCK
|
|
}
|
|
|
|
func isSocketTypeSupported(sockType linux.SockType) bool {
|
|
switch sockType {
|
|
case unix.SOCK_STREAM, unix.SOCK_DGRAM, unix.SOCK_SEQPACKET:
|
|
return true
|
|
default:
|
|
return false
|
|
}
|
|
}
|
|
|
|
// endpoint is a Gofer-backed transport.BoundEndpoint.
|
|
//
|
|
// An endpoint's lifetime is the time between when filesystem.BoundEndpointAt()
|
|
// is called and either BoundEndpoint.BidirectionalConnect or
|
|
// BoundEndpoint.UnidirectionalConnect is called.
|
|
//
|
|
// +stateify savable
|
|
type endpoint struct {
|
|
// dentry is the filesystem dentry which produced this endpoint. dentry is
|
|
// not synthetic.
|
|
dentry *dentry
|
|
|
|
// path is the sentry path where this endpoint is bound.
|
|
path string
|
|
}
|
|
|
|
// BidirectionalConnect implements BoundEndpoint.BidirectionalConnect.
|
|
func (e *endpoint) BidirectionalConnect(ctx context.Context, ce transport.ConnectingEndpoint, returnConnect func(transport.Receiver, transport.ConnectedEndpoint)) *syserr.Error {
|
|
// No lock ordering required as only the ConnectingEndpoint has a mutex.
|
|
ce.Lock()
|
|
|
|
// Check connecting state.
|
|
if ce.Connected() {
|
|
ce.Unlock()
|
|
return syserr.ErrAlreadyConnected
|
|
}
|
|
if ce.ListeningLocked() {
|
|
ce.Unlock()
|
|
return syserr.ErrInvalidEndpointState
|
|
}
|
|
|
|
c, err := e.newConnectedEndpoint(ctx, ce.Type(), ce.WaiterQueue())
|
|
if err != nil {
|
|
ce.Unlock()
|
|
return err
|
|
}
|
|
|
|
returnConnect(c, c)
|
|
ce.Unlock()
|
|
if err := c.Init(); err != nil {
|
|
return syserr.FromError(err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// UnidirectionalConnect implements
|
|
// transport.BoundEndpoint.UnidirectionalConnect.
|
|
func (e *endpoint) UnidirectionalConnect(ctx context.Context) (transport.ConnectedEndpoint, *syserr.Error) {
|
|
c, err := e.newConnectedEndpoint(ctx, linux.SOCK_DGRAM, &waiter.Queue{})
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if err := c.Init(); err != nil {
|
|
return nil, syserr.FromError(err)
|
|
}
|
|
|
|
// We don't need the receiver.
|
|
c.CloseRecv()
|
|
c.Release(ctx)
|
|
|
|
return c, nil
|
|
}
|
|
|
|
func (e *endpoint) newConnectedEndpoint(ctx context.Context, sockType linux.SockType, queue *waiter.Queue) (*transport.SCMConnectedEndpoint, *syserr.Error) {
|
|
e.dentry.fs.renameMu.RLock()
|
|
hostSockFD, err := e.dentry.connect(ctx, sockType)
|
|
e.dentry.fs.renameMu.RUnlock()
|
|
if err != nil {
|
|
return nil, syserr.ErrConnectionRefused
|
|
}
|
|
|
|
c, serr := transport.NewSCMEndpoint(hostSockFD, queue, e.path)
|
|
if serr != nil {
|
|
unix.Close(hostSockFD)
|
|
log.Warningf("NewSCMEndpoint failed: path=%q, err=%v", e.path, serr)
|
|
return nil, serr
|
|
}
|
|
return c, nil
|
|
}
|
|
|
|
// Release implements transport.BoundEndpoint.Release.
|
|
func (e *endpoint) Release(ctx context.Context) {
|
|
e.dentry.DecRef(ctx)
|
|
}
|
|
|
|
// Passcred implements transport.BoundEndpoint.Passcred.
|
|
func (e *endpoint) Passcred() bool {
|
|
return false
|
|
}
|