1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
|
use std::{
ffi::CString,
fs::{DirBuilder, File},
io,
os::unix::ffi::OsStrExt,
path::Path,
};
use nix::{
mount::{self, MsFlags},
sched::{self, CloneFlags},
};
use serde::{Deserialize, Serialize};
use crate::util::ToIOResult;
fn prepare_buildtmp() -> io::Result<()> {
mount::mount::<_, _, _, str>(
Some("buildtmp"),
"build/tmp",
Some("tmpfs"),
MsFlags::empty(),
None,
)
.to_io_result()?;
DirBuilder::new().create("build/tmp/rootfs")?;
{
let file = File::open("build/rootfs.tar")?;
let mut archive = tar::Archive::new(file);
archive.set_preserve_permissions(true);
archive.set_preserve_mtime(true);
archive.set_unpack_xattrs(true);
let dst = Path::new("build/tmp/rootfs");
for entry_r in archive.entries()? {
let mut entry = entry_r?;
if entry.unpack_in(dst)? {
let header = entry.header();
let uid = header.uid()? as libc::uid_t;
let gid = header.gid()? as libc::gid_t;
let path = CString::new(dst.join(entry.path()?).as_os_str().as_bytes())
.map_err(|e| io::Error::new(io::ErrorKind::Other, e))?;
if unsafe { libc::lchown(path.as_ptr(), uid, gid) } < 0 {
return Err(io::Error::last_os_error());
}
}
}
}
DirBuilder::new().create("build/tmp/runc")?;
DirBuilder::new().create("build/tmp/runc/rootfs")?;
mount::mount::<_, _, str, str>(
Some("build/tmp/rootfs"),
"build/tmp/runc/rootfs",
None,
MsFlags::MS_BIND,
None,
)
.to_io_result()?;
mount::mount::<str, _, str, str>(
None,
"build/tmp/runc/rootfs",
None,
MsFlags::MS_BIND | MsFlags::MS_REMOUNT | MsFlags::MS_RDONLY,
None,
)
.to_io_result()?;
Ok(())
}
#[derive(Debug, Deserialize, Serialize)]
pub enum Error {
Code(i32),
String(String),
}
impl From<io::Error> for Error {
fn from(error: io::Error) -> Self {
match error.raw_os_error() {
Some(code) => Error::Code(code),
None => Error::String(error.to_string()),
}
}
}
impl From<Error> for io::Error {
fn from(error: Error) -> Self {
match error {
Error::Code(code) => io::Error::from_raw_os_error(code),
Error::String(string) => io::Error::new(io::ErrorKind::Other, string),
}
}
}
pub fn runc_unshare() -> Result<(), Error> {
sched::unshare(CloneFlags::CLONE_NEWUSER | CloneFlags::CLONE_NEWNS).to_io_result()?;
Ok(())
}
pub fn runc_initialize() -> Result<(), Error> {
prepare_buildtmp()?;
Ok(())
}
|
