#
2322:8fd12ec7a8ef |
| 30-Nov-2022 |
Andrew Clayton |
Enable the PR_SET_CHILD_SUBREAPER prctl(2) option on Linux.
This prctl(2) option can be used to set the "child subreaper" attribute of the calling process. This allows a process to take on the role
Enable the PR_SET_CHILD_SUBREAPER prctl(2) option on Linux.
This prctl(2) option can be used to set the "child subreaper" attribute of the calling process. This allows a process to take on the role of 'init', which means the process will inherit descendant processes when their immediate parent terminates.
This will be used in an upcoming commit that uses a double fork(2) + unshare(2) to create a new PID namespace. The parent from the second fork will terminate leaving the child process to be inherited by 'init'. Aside from it being better to maintain the parent/child relationships between the various unit processes, without setting this you need to ^C twice to fully quit unit when running in the foreground after the double fork.
Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
#
2321:b8d29a14676d |
| 18-Nov-2022 |
Andrew Clayton |
Isolation: Rename NXT_HAVE_CLONE -> NXT_HAVE_LINUX_NS.
Due to the need to replace our use of clone/__NR_clone on Linux with fork(2)/unshare(2) for enabling Linux namespaces(7) to keep the pthreads(7
Isolation: Rename NXT_HAVE_CLONE -> NXT_HAVE_LINUX_NS.
Due to the need to replace our use of clone/__NR_clone on Linux with fork(2)/unshare(2) for enabling Linux namespaces(7) to keep the pthreads(7) API working. Let's rename NXT_HAVE_CLONE to NXT_HAVE_LINUX_NS, i.e name it after the feature, not how it's implemented, then in future if we change how we do namespaces again we don't have to rename this.
Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
#
2320:8b988d80e3c6 |
| 25-Nov-2022 |
Andrew Clayton |
Isolation: Fix the enablement of PR_SET_NO_NEW_PRIVS.
This prctl(2) option is checked for in auto/isolation, unfortunately due to a typo this feature has never been enabled.
In the auto/isolation s
Isolation: Fix the enablement of PR_SET_NO_NEW_PRIVS.
This prctl(2) option is checked for in auto/isolation, unfortunately due to a typo this feature has never been enabled.
In the auto/isolation script the feature name was down as NXT_HAVE_PR_SET_NO_NEW_PRIVS0, which means we end up with the following in build/nxt_auto_config.h
#ifndef NXT_HAVE_PR_SET_NO_NEW_PRIVS0 #define NXT_HAVE_PR_SET_NO_NEW_PRIVS0 1 #endif
Whereas everywhere else is checking for NXT_HAVE_PR_SET_NO_NEW_PRIVS.
This also guards the inclusion of sys/prctl.h in src/nxt_process.c which is required by a subsequent commit.
Fixes: e2b53e1 ("Added "rootfs" feature.") Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
Revision tags: 1.29.0-1, 1.29.0 |
|
#
2228:f403dc1e3ec1 |
| 27-Oct-2022 |
Andrew Clayton |
Fixed main() prototypes in auto tests.
Future releases of GCC are planning to remove[0] default support for some old features that were removed from C99 but GCC still accepts.
We can test for these
Fixed main() prototypes in auto tests.
Future releases of GCC are planning to remove[0] default support for some old features that were removed from C99 but GCC still accepts.
We can test for these changes by using the following -Werror= directives
-Werror=implicit-int -Werror=implicit-function-declaration -Werror=int-conversion -Werror=strict-prototypes -Werror=old-style-definition
Doing so revealed an issue with the auto/ tests in that the test programs always define main as
int main()
rather than
int main(void)
which results in a bunch of errors like
build/autotest.c:3:23: error: function declaration isn't a prototype [-Werror=strict-prototypes] 3 | int main() { | ^~~~ build/autotest.c: In function 'main': build/autotest.c:3:23: error: old-style function definition [-Werror=old-style-definition]
The fix was easy, it only required fixing the main prototype with
find -type f -exec sed -i 's/int main() {/int main(void) {/g' {} \;
Regardless of these upcoming GCC changes, this is probably a good thing to do anyway for correctness.
[0]: https://fedoraproject.org/wiki/Changes/PortingToModernC
Link: <https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/CJXKTLXJUPZ4F2C2VQOTNMEA5JAUPMBD/> Link: <https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/6SGHPHPAXKCVJ6PUZ57WVDQ5TDBVIRMF/> Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
Revision tags: 1.28.0-1, 1.28.0 |
|
#
2170:8eee6cdafb58 |
| 02-Aug-2022 |
Alejandro Colomar |
Rejecting non-Linux pivot_root(2).
Some non-Linux systems implement pivot_root(2), even if they don't document that. An example is MacOS:
$ grepc pivot_root / 2>/dev/null .../sys/sysproto.h:3012:
Rejecting non-Linux pivot_root(2).
Some non-Linux systems implement pivot_root(2), even if they don't document that. An example is MacOS:
$ grepc pivot_root / 2>/dev/null .../sys/sysproto.h:3012: int pivot_root(struct proc *, struct pivot_root_args *, int *);
Since the prototype of the syscall differs from that of Linux, we can't use that syscall. Let's make sure the test only detects pivot_root(2) under Linux. Also, rename the feature macro to make clear that it's only about Linux's pivot_root(2).
This closes #737 issue on GitHub.
show more ...
|
#
2169:b8afbff114fc |
| 18-Jun-2022 |
Alejandro Colomar |
Including <mntent.h> iff it exists.
With NXT_HAVE_PIVOT_ROOT, we had issues in MacOS. Headers should normally be included unconditionally, except of course if they don't exist.
This fixes part of
Including <mntent.h> iff it exists.
With NXT_HAVE_PIVOT_ROOT, we had issues in MacOS. Headers should normally be included unconditionally, except of course if they don't exist.
This fixes part of the #737 issue on GitHub.
show more ...
|
#
2153:37bccff06c9f |
| 18-Jun-2022 |
Alejandro Colomar |
Replaced Linux syscall macros by libc macros.
User-space programs should use the SYS_*form, as documented in syscall(2). That also adds compatibility to non-Linux systems.
|
Revision tags: 1.27.0-1, 1.27.0, 1.26.1-1, 1.26.1, 1.26.0-1, 1.26.0, 1.25.0-1, 1.25.0, 1.24.0-1, 1.24.0, 1.23.0-1, 1.23.0, 1.22.0-1, 1.22.0, 1.21.0-1, 1.21.0, 1.20.0-1, 1.20.0, 1.19.0-1, 1.19.0 |
|
#
1503:c21230ef5a0e |
| 22-Jun-2020 |
Tiago Natel de Moura |
Isolation: fixed build when features aren't detected.
|
Revision tags: 1.18.0-1, 1.18.0 |
|
#
1489:4a3ec07f4b19 |
| 28-May-2020 |
Tiago Natel de Moura |
Added "rootfs" feature.
|
Revision tags: 1.17.0-1, 1.17.0, 1.16.0-1, 1.16.0, 1.15.0-1, 1.15.0, 1.14.0-1, 1.14.0 |
|
#
1306:3604d05e48be |
| 06-Dec-2019 |
Tiago Natel |
Isolation: allowed the use of credentials with unpriv userns.
The setuid/setgid syscalls requires root capabilities but if the kernel supports unprivileged user namespace then the child process has
Isolation: allowed the use of credentials with unpriv userns.
The setuid/setgid syscalls requires root capabilities but if the kernel supports unprivileged user namespace then the child process has the full set of capabilities in the new namespace, then we can allow setting "user" and "group" in such cases (this is a common security use case).
Tests were added to ensure user gets meaningful error messages for uid/gid mapping misconfigurations.
show more ...
|
Revision tags: 1.13.0-1, 1.13.0, 1.12.0-1, 1.12.0, 1.11.0-2, 1.11.0-1, 1.11.0 |
|
#
1182:325b315e48c4 |
| 19-Sep-2019 |
Tiago de Bem Natel de Moura |
Initial applications isolation support using Linux namespaces.
|