summaryrefslogtreecommitdiffhomepage
diff options
context:
space:
mode:
Diffstat (limited to '')
-rw-r--r--auto/isolation14
-rw-r--r--auto/sources2
-rw-r--r--src/nxt_clone.c2
-rw-r--r--src/nxt_credential.c6
-rw-r--r--src/nxt_isolation.c8
-rw-r--r--src/nxt_main_process.c2
-rw-r--r--src/nxt_process.c10
-rw-r--r--src/nxt_process.h6
8 files changed, 25 insertions, 25 deletions
diff --git a/auto/isolation b/auto/isolation
index b706c94d..27f44624 100644
--- a/auto/isolation
+++ b/auto/isolation
@@ -4,7 +4,7 @@
# Linux clone syscall.
NXT_ISOLATION=NO
-NXT_HAVE_CLONE=NO
+NXT_HAVE_LINUX_NS=NO
NXT_HAVE_CLONE_NEWUSER=NO
NXT_HAVE_MOUNT=NO
NXT_HAVE_UNMOUNT=NO
@@ -12,21 +12,21 @@ NXT_HAVE_ROOTFS=NO
nsflags="USER NS PID NET UTS CGROUP"
-nxt_feature="clone(2)"
-nxt_feature_name=NXT_HAVE_CLONE
+nxt_feature="Linux unshare()"
+nxt_feature_name=NXT_HAVE_LINUX_NS
nxt_feature_run=no
nxt_feature_incs=
nxt_feature_libs=
-nxt_feature_test="#include <sys/wait.h>
- #include <sys/syscall.h>
+nxt_feature_test="#define _GNU_SOURCE
+ #include <sched.h>
int main(void) {
- return SYS_clone | SIGCHLD;
+ return unshare(0);
}"
. auto/feature
if [ $nxt_found = yes ]; then
- NXT_HAVE_CLONE=YES
+ NXT_HAVE_LINUX_NS=YES
# Test all isolation flags
for flag in $nsflags; do
diff --git a/auto/sources b/auto/sources
index 29f3c7b5..2ca78844 100644
--- a/auto/sources
+++ b/auto/sources
@@ -299,7 +299,7 @@ if [ "$NXT_HAVE_HPUX_SENDFILE" = "YES" \
fi
-if [ "$NXT_HAVE_CLONE" = "YES" ]; then
+if [ "$NXT_HAVE_LINUX_NS" = "YES" ]; then
NXT_LIB_SRCS="$NXT_LIB_SRCS $NXT_LIB_CLONE_SRCS"
fi
diff --git a/src/nxt_clone.c b/src/nxt_clone.c
index a9b39ac1..a98aac47 100644
--- a/src/nxt_clone.c
+++ b/src/nxt_clone.c
@@ -8,7 +8,7 @@
#include <nxt_conf.h>
#include <nxt_clone.h>
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
pid_t
nxt_clone(nxt_int_t flags)
diff --git a/src/nxt_credential.c b/src/nxt_credential.c
index 168db9cf..bda97024 100644
--- a/src/nxt_credential.c
+++ b/src/nxt_credential.c
@@ -286,7 +286,7 @@ nxt_credential_setuid(nxt_task_t *task, nxt_credential_t *uc)
if (setuid(uc->uid) != 0) {
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
if (nxt_errno == EINVAL) {
nxt_log(task, NXT_LOG_ERR, "The uid %d (user \"%s\") isn't "
"valid in the application namespace.", uc->uid, uc->user);
@@ -314,7 +314,7 @@ nxt_credential_setgids(nxt_task_t *task, nxt_credential_t *uc)
if (setgid(uc->base_gid) != 0) {
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
if (nxt_errno == EINVAL) {
nxt_log(task, NXT_LOG_ERR, "The gid %d isn't valid in the "
"application namespace.", uc->base_gid);
@@ -333,7 +333,7 @@ nxt_credential_setgids(nxt_task_t *task, nxt_credential_t *uc)
if (nxt_slow_path(uc->ngroups > 0
&& setgroups(uc->ngroups, uc->gids) != 0)) {
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
if (nxt_errno == EINVAL) {
nxt_log(task, NXT_LOG_ERR, "The user \"%s\" (uid: %d) has "
"supplementary group ids not valid in the application "
diff --git a/src/nxt_isolation.c b/src/nxt_isolation.c
index b6b13c59..e43cf1f7 100644
--- a/src/nxt_isolation.c
+++ b/src/nxt_isolation.c
@@ -21,7 +21,7 @@ static nxt_int_t nxt_isolation_set_cgroup(nxt_task_t *task,
nxt_conf_value_t *isolation, nxt_process_t *process);
#endif
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
static nxt_int_t nxt_isolation_set_namespaces(nxt_task_t *task,
nxt_conf_value_t *isolation, nxt_process_t *process);
static nxt_int_t nxt_isolation_clone_flags(nxt_task_t *task,
@@ -169,7 +169,7 @@ nxt_isolation_set(nxt_task_t *task, nxt_conf_value_t *isolation,
}
#endif
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
if (nxt_slow_path(nxt_isolation_set_namespaces(task, isolation, process)
!= NXT_OK))
{
@@ -247,7 +247,7 @@ nxt_isolation_set_cgroup(nxt_task_t *task, nxt_conf_value_t *isolation,
#endif
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
static nxt_int_t
nxt_isolation_set_namespaces(nxt_task_t *task, nxt_conf_value_t *isolation,
@@ -409,7 +409,7 @@ nxt_isolation_vldt_creds(nxt_task_t *task, nxt_process_t *process)
#endif
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
static nxt_int_t
nxt_isolation_clone_flags(nxt_task_t *task, nxt_conf_value_t *namespaces,
diff --git a/src/nxt_main_process.c b/src/nxt_main_process.c
index de41e8d7..4c89121e 100644
--- a/src/nxt_main_process.c
+++ b/src/nxt_main_process.c
@@ -556,7 +556,7 @@ nxt_main_process_created_handler(nxt_task_t *task, nxt_port_recv_msg_t *msg)
nxt_assert(process != NULL);
nxt_assert(process->state == NXT_PROCESS_STATE_CREATING);
-#if (NXT_HAVE_CLONE && NXT_HAVE_CLONE_NEWUSER)
+#if (NXT_HAVE_LINUX_NS && NXT_HAVE_CLONE_NEWUSER)
if (nxt_is_clone_flag_set(process->isolation.clone.flags, NEWUSER)) {
if (nxt_slow_path(nxt_clone_credential_map(task, process->pid,
process->user_cred,
diff --git a/src/nxt_process.c b/src/nxt_process.c
index d8836ad2..b40eb8cf 100644
--- a/src/nxt_process.c
+++ b/src/nxt_process.c
@@ -7,7 +7,7 @@
#include <nxt_main.h>
#include <nxt_cgroup.h>
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
#include <nxt_clone.h>
#endif
@@ -18,7 +18,7 @@
#endif
-#if (NXT_HAVE_CLONE) && (NXT_HAVE_CLONE_NEWPID)
+#if (NXT_HAVE_LINUX_NS) && (NXT_HAVE_CLONE_NEWPID)
#define nxt_is_pid_isolated(process) \
nxt_is_clone_flag_set(process->isolation.clone.flags, NEWPID)
#else
@@ -318,7 +318,7 @@ nxt_process_create(nxt_task_t *task, nxt_process_t *process)
nxt_pid_t pid;
nxt_runtime_t *rt;
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
pid = nxt_clone(SIGCHLD | process->isolation.clone.flags);
if (nxt_slow_path(pid < 0)) {
nxt_alert(task, "clone() failed for %s %E", process->name, nxt_errno);
@@ -355,7 +355,7 @@ nxt_process_create(nxt_task_t *task, nxt_process_t *process)
/* Parent. */
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
nxt_debug(task, "clone(%s): %PI", process->name, pid);
#else
nxt_debug(task, "fork(%s): %PI", process->name, pid);
@@ -781,7 +781,7 @@ nxt_process_apply_creds(nxt_task_t *task, nxt_process_t *process)
cap_setid = rt->capabilities.setid;
-#if (NXT_HAVE_CLONE && NXT_HAVE_CLONE_NEWUSER)
+#if (NXT_HAVE_LINUX_NS && NXT_HAVE_CLONE_NEWUSER)
if (!cap_setid
&& nxt_is_clone_flag_set(process->isolation.clone.flags, NEWUSER))
{
diff --git a/src/nxt_process.h b/src/nxt_process.h
index 0db68d45..1dd51521 100644
--- a/src/nxt_process.h
+++ b/src/nxt_process.h
@@ -7,13 +7,13 @@
#ifndef _NXT_PROCESS_H_INCLUDED_
#define _NXT_PROCESS_H_INCLUDED_
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
#include <unistd.h>
#include <nxt_clone.h>
#endif
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
/*
* Old glibc wrapper for getpid(2) returns a cached pid invalidated only by
* fork(2) calls. As we use clone(2) for container, it returns the wrong pid.
@@ -100,7 +100,7 @@ typedef struct {
nxt_cgroup_t cgroup;
#endif
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
nxt_clone_t clone;
#endif
generated by cgit (git 2.34.1) at 2024-11-20 09:29:02 +0000