From 3ecdd2c69c4864526c63b8e55df22ad1a86f3c72 Mon Sep 17 00:00:00 2001 From: Andrew Clayton Date: Fri, 18 Nov 2022 23:42:44 +0000 Subject: Isolation: Rename NXT_HAVE_CLONE -> NXT_HAVE_LINUX_NS. Due to the need to replace our use of clone/__NR_clone on Linux with fork(2)/unshare(2) for enabling Linux namespaces(7) to keep the pthreads(7) API working. Let's rename NXT_HAVE_CLONE to NXT_HAVE_LINUX_NS, i.e name it after the feature, not how it's implemented, then in future if we change how we do namespaces again we don't have to rename this. Reviewed-by: Alejandro Colomar Signed-off-by: Andrew Clayton --- auto/isolation | 14 +++++++------- auto/sources | 2 +- src/nxt_clone.c | 2 +- src/nxt_credential.c | 6 +++--- src/nxt_isolation.c | 8 ++++---- src/nxt_main_process.c | 2 +- src/nxt_process.c | 10 +++++----- src/nxt_process.h | 6 +++--- 8 files changed, 25 insertions(+), 25 deletions(-) diff --git a/auto/isolation b/auto/isolation index b706c94d..27f44624 100644 --- a/auto/isolation +++ b/auto/isolation @@ -4,7 +4,7 @@ # Linux clone syscall. NXT_ISOLATION=NO -NXT_HAVE_CLONE=NO +NXT_HAVE_LINUX_NS=NO NXT_HAVE_CLONE_NEWUSER=NO NXT_HAVE_MOUNT=NO NXT_HAVE_UNMOUNT=NO @@ -12,21 +12,21 @@ NXT_HAVE_ROOTFS=NO nsflags="USER NS PID NET UTS CGROUP" -nxt_feature="clone(2)" -nxt_feature_name=NXT_HAVE_CLONE +nxt_feature="Linux unshare()" +nxt_feature_name=NXT_HAVE_LINUX_NS nxt_feature_run=no nxt_feature_incs= nxt_feature_libs= -nxt_feature_test="#include - #include +nxt_feature_test="#define _GNU_SOURCE + #include int main(void) { - return SYS_clone | SIGCHLD; + return unshare(0); }" . auto/feature if [ $nxt_found = yes ]; then - NXT_HAVE_CLONE=YES + NXT_HAVE_LINUX_NS=YES # Test all isolation flags for flag in $nsflags; do diff --git a/auto/sources b/auto/sources index 29f3c7b5..2ca78844 100644 --- a/auto/sources +++ b/auto/sources @@ -299,7 +299,7 @@ if [ "$NXT_HAVE_HPUX_SENDFILE" = "YES" \ fi -if [ "$NXT_HAVE_CLONE" = "YES" ]; then +if [ "$NXT_HAVE_LINUX_NS" = "YES" ]; then NXT_LIB_SRCS="$NXT_LIB_SRCS $NXT_LIB_CLONE_SRCS" fi diff --git a/src/nxt_clone.c b/src/nxt_clone.c index a9b39ac1..a98aac47 100644 --- a/src/nxt_clone.c +++ b/src/nxt_clone.c @@ -8,7 +8,7 @@ #include #include -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) pid_t nxt_clone(nxt_int_t flags) diff --git a/src/nxt_credential.c b/src/nxt_credential.c index 168db9cf..bda97024 100644 --- a/src/nxt_credential.c +++ b/src/nxt_credential.c @@ -286,7 +286,7 @@ nxt_credential_setuid(nxt_task_t *task, nxt_credential_t *uc) if (setuid(uc->uid) != 0) { -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) if (nxt_errno == EINVAL) { nxt_log(task, NXT_LOG_ERR, "The uid %d (user \"%s\") isn't " "valid in the application namespace.", uc->uid, uc->user); @@ -314,7 +314,7 @@ nxt_credential_setgids(nxt_task_t *task, nxt_credential_t *uc) if (setgid(uc->base_gid) != 0) { -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) if (nxt_errno == EINVAL) { nxt_log(task, NXT_LOG_ERR, "The gid %d isn't valid in the " "application namespace.", uc->base_gid); @@ -333,7 +333,7 @@ nxt_credential_setgids(nxt_task_t *task, nxt_credential_t *uc) if (nxt_slow_path(uc->ngroups > 0 && setgroups(uc->ngroups, uc->gids) != 0)) { -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) if (nxt_errno == EINVAL) { nxt_log(task, NXT_LOG_ERR, "The user \"%s\" (uid: %d) has " "supplementary group ids not valid in the application " diff --git a/src/nxt_isolation.c b/src/nxt_isolation.c index b6b13c59..e43cf1f7 100644 --- a/src/nxt_isolation.c +++ b/src/nxt_isolation.c @@ -21,7 +21,7 @@ static nxt_int_t nxt_isolation_set_cgroup(nxt_task_t *task, nxt_conf_value_t *isolation, nxt_process_t *process); #endif -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) static nxt_int_t nxt_isolation_set_namespaces(nxt_task_t *task, nxt_conf_value_t *isolation, nxt_process_t *process); static nxt_int_t nxt_isolation_clone_flags(nxt_task_t *task, @@ -169,7 +169,7 @@ nxt_isolation_set(nxt_task_t *task, nxt_conf_value_t *isolation, } #endif -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) if (nxt_slow_path(nxt_isolation_set_namespaces(task, isolation, process) != NXT_OK)) { @@ -247,7 +247,7 @@ nxt_isolation_set_cgroup(nxt_task_t *task, nxt_conf_value_t *isolation, #endif -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) static nxt_int_t nxt_isolation_set_namespaces(nxt_task_t *task, nxt_conf_value_t *isolation, @@ -409,7 +409,7 @@ nxt_isolation_vldt_creds(nxt_task_t *task, nxt_process_t *process) #endif -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) static nxt_int_t nxt_isolation_clone_flags(nxt_task_t *task, nxt_conf_value_t *namespaces, diff --git a/src/nxt_main_process.c b/src/nxt_main_process.c index de41e8d7..4c89121e 100644 --- a/src/nxt_main_process.c +++ b/src/nxt_main_process.c @@ -556,7 +556,7 @@ nxt_main_process_created_handler(nxt_task_t *task, nxt_port_recv_msg_t *msg) nxt_assert(process != NULL); nxt_assert(process->state == NXT_PROCESS_STATE_CREATING); -#if (NXT_HAVE_CLONE && NXT_HAVE_CLONE_NEWUSER) +#if (NXT_HAVE_LINUX_NS && NXT_HAVE_CLONE_NEWUSER) if (nxt_is_clone_flag_set(process->isolation.clone.flags, NEWUSER)) { if (nxt_slow_path(nxt_clone_credential_map(task, process->pid, process->user_cred, diff --git a/src/nxt_process.c b/src/nxt_process.c index d8836ad2..b40eb8cf 100644 --- a/src/nxt_process.c +++ b/src/nxt_process.c @@ -7,7 +7,7 @@ #include #include -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) #include #endif @@ -18,7 +18,7 @@ #endif -#if (NXT_HAVE_CLONE) && (NXT_HAVE_CLONE_NEWPID) +#if (NXT_HAVE_LINUX_NS) && (NXT_HAVE_CLONE_NEWPID) #define nxt_is_pid_isolated(process) \ nxt_is_clone_flag_set(process->isolation.clone.flags, NEWPID) #else @@ -318,7 +318,7 @@ nxt_process_create(nxt_task_t *task, nxt_process_t *process) nxt_pid_t pid; nxt_runtime_t *rt; -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) pid = nxt_clone(SIGCHLD | process->isolation.clone.flags); if (nxt_slow_path(pid < 0)) { nxt_alert(task, "clone() failed for %s %E", process->name, nxt_errno); @@ -355,7 +355,7 @@ nxt_process_create(nxt_task_t *task, nxt_process_t *process) /* Parent. */ -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) nxt_debug(task, "clone(%s): %PI", process->name, pid); #else nxt_debug(task, "fork(%s): %PI", process->name, pid); @@ -781,7 +781,7 @@ nxt_process_apply_creds(nxt_task_t *task, nxt_process_t *process) cap_setid = rt->capabilities.setid; -#if (NXT_HAVE_CLONE && NXT_HAVE_CLONE_NEWUSER) +#if (NXT_HAVE_LINUX_NS && NXT_HAVE_CLONE_NEWUSER) if (!cap_setid && nxt_is_clone_flag_set(process->isolation.clone.flags, NEWUSER)) { diff --git a/src/nxt_process.h b/src/nxt_process.h index 0db68d45..1dd51521 100644 --- a/src/nxt_process.h +++ b/src/nxt_process.h @@ -7,13 +7,13 @@ #ifndef _NXT_PROCESS_H_INCLUDED_ #define _NXT_PROCESS_H_INCLUDED_ -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) #include #include #endif -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) /* * Old glibc wrapper for getpid(2) returns a cached pid invalidated only by * fork(2) calls. As we use clone(2) for container, it returns the wrong pid. @@ -100,7 +100,7 @@ typedef struct { nxt_cgroup_t cgroup; #endif -#if (NXT_HAVE_CLONE) +#if (NXT_HAVE_LINUX_NS) nxt_clone_t clone; #endif -- cgit