From dc6db3d565f4bf8b3bd5f11149be65d43750d0b0 Mon Sep 17 00:00:00 2001 From: Christian Goll Date: Tue, 6 Feb 2024 16:50:21 +0100 Subject: [PATCH] using the right overlay directory and remove it Signed-off-by: Christian Goll --- CHANGELOG.md | 1 + .../app/wwctl/container/exec/child/main.go | 10 ++++++-- .../app/wwctl/container/exec/child/root.go | 7 ++++-- internal/app/wwctl/container/exec/main.go | 24 +++++++------------ internal/app/wwctl/container/exec/root.go | 10 ++++---- 5 files changed, 27 insertions(+), 25 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b44547f2..4edb4d07 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -59,6 +59,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). - Fix the issue that warewulf.conf parse does not support CIDR format. #1130 - Reduce the number of times syncuser walks the container file system. #1209 - Create ssh key also when calling `wwctl configure --all` #1250 +- Remove the temporary overlay dir. #1180 ### Security diff --git a/internal/app/wwctl/container/exec/child/main.go b/internal/app/wwctl/container/exec/child/main.go index 57cf7192..bf409508 100644 --- a/internal/app/wwctl/container/exec/child/main.go +++ b/internal/app/wwctl/container/exec/child/main.go @@ -21,6 +21,8 @@ import ( "github.com/warewulf/warewulf/internal/pkg/wwlog" ) +const exitEval = `$(VALU="$?" ; if [ $VALU == 0 ]; then echo write; else echo discard; fi)` + func CobraRunE(cmd *cobra.Command, args []string) (err error) { if os.Getpid() != 1 { wwlog.Error("PID is not 1: %d", os.Getpid()) @@ -34,11 +36,13 @@ func CobraRunE(cmd *cobra.Command, args []string) (err error) { os.Exit(1) } conf := warewulfconf.Get() + if overlayDir == "" { + overlayDir = path.Join(conf.Paths.WWChrootdir, "overlays") + } mountPts := conf.MountsContainer mountPts = append(container.InitMountPnts(binds), mountPts...) // check for valid mount points lowerObjects := checkMountPoints(containerName, mountPts) - overlayDir := conf.Paths.WWChrootdir + "/overlays" // need to create a overlay, where the lower layer contains // the missing mount points wwlog.Verbose("for ephermal mount use tempdir %s", overlayDir) @@ -46,6 +50,7 @@ func CobraRunE(cmd *cobra.Command, args []string) (err error) { _ = os.MkdirAll(path.Join(overlayDir, "work"), os.ModePerm) _ = os.MkdirAll(path.Join(overlayDir, "lower"), os.ModePerm) _ = os.MkdirAll(path.Join(overlayDir, "nodeoverlay"), os.ModePerm) + // handle all lower object, have some extra logic if the object is a file for _, obj := range lowerObjects { newFile := "" if !strings.HasSuffix(obj, "/") { @@ -65,11 +70,12 @@ func CobraRunE(cmd *cobra.Command, args []string) (err error) { } } containerPath := container.RootFsDir(containerName) + // running in a private PID space, so also make / private, so that nothing gets out from here err = syscall.Mount("", "/", "", syscall.MS_PRIVATE|syscall.MS_REC, "") if err != nil { return errors.Wrap(err, "failed to mount") } - ps1Str := fmt.Sprintf("[%s] Warewulf> ", containerName) + ps1Str := fmt.Sprintf("[%s|%s] Warewulf> ", exitEval, containerName) if len(lowerObjects) != 0 && nodename == "" { options := fmt.Sprintf("lowerdir=%s,upperdir=%s,workdir=%s", path.Join(overlayDir, "lower"), containerPath, path.Join(overlayDir, "work")) diff --git a/internal/app/wwctl/container/exec/child/root.go b/internal/app/wwctl/container/exec/child/root.go index ad807a6f..ab72086d 100644 --- a/internal/app/wwctl/container/exec/child/root.go +++ b/internal/app/wwctl/container/exec/child/root.go @@ -13,13 +13,16 @@ var ( Args: cobra.MinimumNArgs(1), FParseErrWhitelist: cobra.FParseErrWhitelist{UnknownFlags: true}, } - binds []string - nodename string + binds []string + nodename string + overlayDir string ) func init() { baseCmd.Flags().StringVarP(&nodename, "node", "n", "", "create ro overlay for given node") baseCmd.Flags().StringArrayVarP(&binds, "bind", "b", []string{}, "bind points") + baseCmd.Flags().StringVar(&overlayDir, "overlaydir", "", "overlayDir") + } // GetRootCommand returns the root cobra.Command for the application. diff --git a/internal/app/wwctl/container/exec/main.go b/internal/app/wwctl/container/exec/main.go index 44e11e9f..80140a67 100644 --- a/internal/app/wwctl/container/exec/main.go +++ b/internal/app/wwctl/container/exec/main.go @@ -12,6 +12,7 @@ import ( "time" "github.com/spf13/cobra" + warewulfconf "github.com/warewulf/warewulf/internal/pkg/config" "github.com/warewulf/warewulf/internal/pkg/container" "github.com/warewulf/warewulf/internal/pkg/util" "github.com/warewulf/warewulf/internal/pkg/wwlog" @@ -20,15 +21,15 @@ import ( /* fork off a process with a new PID space */ -func runContainedCmd(args []string) error { - var err error - if tempDir == "" { - tempDir, err = os.MkdirTemp(os.TempDir(), "overlay") +func runContainedCmd(args []string) (err error) { + if overlayDir == "" { + conf := warewulfconf.Get() + overlayDir, err = os.MkdirTemp(conf.Paths.WWChrootdir, "overlays-") if err != nil { wwlog.Warn("couldn't create temp dir for overlay", err) } defer func() { - err = os.RemoveAll(tempDir) + err = os.RemoveAll(overlayDir) if err != nil { wwlog.Warn("Couldn't remove temp dir for ephermal mounts:", err) } @@ -36,7 +37,7 @@ func runContainedCmd(args []string) error { } logStr := fmt.Sprint(wwlog.GetLogLevel()) wwlog.Verbose("Running contained command: %s", args[1:]) - c := exec.Command("/proc/self/exe", append([]string{"--loglevel", logStr, "--tempdir", tempDir, "container", "exec", "__child"}, args...)...) + c := exec.Command("/proc/self/exe", append([]string{"--loglevel", logStr, "--overlaydir", overlayDir, "container", "exec", "__child"}, args...)...) c.SysProcAttr = &syscall.SysProcAttr{ Cloneflags: syscall.CLONE_NEWUTS | syscall.CLONE_NEWPID | syscall.CLONE_NEWNS, @@ -45,16 +46,7 @@ func runContainedCmd(args []string) error { c.Stdout = os.Stdout c.Stderr = os.Stderr - if err := c.Run(); err != nil { - fmt.Printf("Command exited non-zero, not rebuilding/updating VNFS image\n") - // defer is not called before os.Exit(0) - err = os.RemoveAll(tempDir) - if err != nil { - wwlog.Warn("Couldn't remove temp dir for ephermal mounts:", err) - } - os.Exit(0) - } - return nil + return c.Run() } func CobraRunE(cmd *cobra.Command, args []string) error { diff --git a/internal/app/wwctl/container/exec/root.go b/internal/app/wwctl/container/exec/root.go index a59b42c1..f68fa620 100644 --- a/internal/app/wwctl/container/exec/root.go +++ b/internal/app/wwctl/container/exec/root.go @@ -25,17 +25,17 @@ var ( }, FParseErrWhitelist: cobra.FParseErrWhitelist{UnknownFlags: true}, } - SyncUser bool - binds []string - tempDir string - nodeName string + SyncUser bool + binds []string + overlayDir string + nodeName string ) func init() { baseCmd.AddCommand(child.GetCommand()) baseCmd.PersistentFlags().StringArrayVarP(&binds, "bind", "b", []string{}, "Bind a local path into the container (must exist)") baseCmd.PersistentFlags().BoolVar(&SyncUser, "syncuser", false, "Synchronize UIDs/GIDs from host to container") - baseCmd.PersistentFlags().StringVar(&tempDir, "tempdir", "", "Use tempdir for constructing the overlay fs (only used if mount points don't exist in container)") + baseCmd.PersistentFlags().StringVar(&overlayDir, "overlaydir", "", "Use tempdir for constructing the overlay fs (only used if mount points don't exist in container)") baseCmd.PersistentFlags().StringVarP(&nodeName, "node", "n", "", "Create a read only view of the container for the given node") }