Skip to content

Commit dd62d21

Browse files
bitokubitoku
committed
Refactor container mount setup functions and improve SELinux label handling
Signed-off-by: Ayato Tokubi <[email protected]>
1 parent 4e2f7db commit dd62d21

File tree

3 files changed

+41
-33
lines changed

3 files changed

+41
-33
lines changed

‎server/container_create.go‎

Lines changed: 37 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -677,7 +677,10 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr container.Conta
677677
}
678678
}()
679679

680-
mountLabel, processLabel, hostNet, maybeRelabel, skipRelabel := s.configureSELinuxLabels(ctr, sb, containerInfo, securityContext)
680+
mountLabel, processLabel, maybeRelabel, skipRelabel, err := s.configureSELinuxLabels(ctr, sb, containerInfo)
681+
if err != nil {
682+
return nil, err
683+
}
681684

682685
cgroup2RWAnnotation, _ := v2.GetAnnotationValue(sb.Annotations(), v2.Cgroup2MountHierarchyRW)
683686
cgroup2RW := node.CgroupIsV2() && cgroup2RWAnnotation == "true"
@@ -798,6 +801,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr container.Conta
798801
return nil, err
799802
}
800803

804+
hostNet := securityContext.GetNamespaceOptions().GetNetwork() == types.NamespaceMode_NODE
801805
addSysfsMounts(ctr, containerConfig, hostNet, sb, containerMappings)
802806

803807
containerImageConfig := containerInfo.Config
@@ -817,7 +821,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr container.Conta
817821

818822
addShmMount(ctr, sb)
819823

820-
if err := s.setupContainerMounts(ctr, sb, containerConfig, mountLabel, hostNet, specgen); err != nil {
824+
if err := s.setupBaseContainerMounts(ctr, sb, containerConfig, mountLabel, hostNet); err != nil {
821825
return nil, err
822826
}
823827

@@ -855,7 +859,7 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr container.Conta
855859
return nil, err
856860
}
857861

858-
processLabel, err = s.setupContainerMountsAndSystemd(ctr, sb, containerInfo, containerIDMappings, mountPoint, mountLabel, processLabel, ociMounts, volumeMounts, specgen)
862+
err = s.setupContainerMounts(ctr, sb, containerInfo, containerIDMappings, mountPoint, mountLabel, ociMounts, volumeMounts)
859863
if err != nil {
860864
return nil, err
861865
}
@@ -966,7 +970,9 @@ func (s *Server) createSandboxContainer(ctx context.Context, ctr container.Conta
966970
return ociContainer, nil
967971
}
968972

969-
func (s *Server) setupContainerMountsAndSystemd(ctr container.Container, sb *sandbox.Sandbox, containerInfo *storage.ContainerInfo, containerIDMappings *idtools.IDMappings, mountPoint, mountLabel, processLabel string, ociMounts, volumeMounts []rspec.Mount, specgen *generate.Generator) (string, error) {
973+
// setupContainerMounts configures the container's OCI, volume, and secret mounts. It handles
974+
// ID mappings for user namespaces and sets up FIPS mode if disabled via annotation.
975+
func (s *Server) setupContainerMounts(ctr container.Container, sb *sandbox.Sandbox, containerInfo *storage.ContainerInfo, containerIDMappings *idtools.IDMappings, mountPoint, mountLabel string, ociMounts, volumeMounts []rspec.Mount) error {
970976
rootUID, rootGID := 0, 0
971977

972978
if containerIDMappings != nil {
@@ -989,7 +995,7 @@ func (s *Server) setupContainerMountsAndSystemd(ctr container.Container, sb *san
989995
disableFIPSAnnotation, _ := v2.GetAnnotationValue(sb.Annotations(), v2.DisableFIPS)
990996
if ctr.DisableFips() && disableFIPSAnnotation == "true" {
991997
if err := disableFipsForContainer(ctr, containerInfo.RunDir); err != nil {
992-
return "", fmt.Errorf("failed to disable FIPS for container %s: %w", ctr.ID(), err)
998+
return fmt.Errorf("failed to disable FIPS for container %s: %w", ctr.ID(), err)
993999
}
9941000
}
9951001

@@ -1012,23 +1018,7 @@ func (s *Server) setupContainerMountsAndSystemd(ctr container.Container, sb *san
10121018
ctr.SpecAddMount(rspecMount)
10131019
}
10141020

1015-
if ctr.WillRunSystemd() {
1016-
var err error
1017-
1018-
// Don't override the process label if it was already set.
1019-
// Otherwise, it should be set container_init_t to run the init process
1020-
// in a container.
1021-
if processLabel == "" {
1022-
processLabel, err = InitLabel(processLabel)
1023-
if err != nil {
1024-
return "", err
1025-
}
1026-
}
1027-
1028-
setupSystemd(specgen.Mounts(), *specgen)
1029-
}
1030-
1031-
return processLabel, nil
1021+
return nil
10321022
}
10331023

10341024
func (s *Server) setupContainerEnvironmentAndWorkdir(ctx context.Context, specgen *generate.Generator, containerConfig *types.ContainerConfig, containerImageConfig *v1.Image, containerInfo *storage.ContainerInfo, mountPoint, mountLabel string, linux *types.LinuxContainerConfig, securityContext *types.LinuxContainerSecurityContext) ([]rspec.Mount, error) {
@@ -1130,7 +1120,10 @@ func (s *Server) setupSeccomp(ctx context.Context, ctr container.Container, sb *
11301120
return seccompRef, nil
11311121
}
11321122

1133-
func (s *Server) setupContainerMounts(ctr container.Container, sb *sandbox.Sandbox, containerConfig *types.ContainerConfig, mountLabel string, hostNet bool, specgen *generate.Generator) error {
1123+
// setupBaseContainerMounts configures the base mounts for a container including resolv.conf,
1124+
// hostname, containerenv, and /etc/hosts. It also sets up privileged bind mount options and
1125+
// systemd-specific mounts when applicable.
1126+
func (s *Server) setupBaseContainerMounts(ctr container.Container, sb *sandbox.Sandbox, containerConfig *types.ContainerConfig, mountLabel string, hostNet bool) error {
11341127
options := []string{"rw"}
11351128
if ctr.ReadOnly(s.config.ReadOnly) {
11361129
options = []string{"ro"}
@@ -1186,7 +1179,11 @@ func (s *Server) setupContainerMounts(ctr container.Container, sb *sandbox.Sandb
11861179
}
11871180

11881181
if ctr.Privileged() {
1189-
setOCIBindMountsPrivileged(specgen)
1182+
setOCIBindMountsPrivileged(ctr.Spec())
1183+
}
1184+
1185+
if ctr.WillRunSystemd() {
1186+
setupSystemdMounts(ctr.Spec())
11901187
}
11911188

11921189
return nil
@@ -1195,16 +1192,17 @@ func (s *Server) setupContainerMounts(ctr container.Container, sb *sandbox.Sandb
11951192
// configureSELinuxLabels determines the appropriate SELinux labels for a container based on its
11961193
// security context and namespace configuration. It returns the mount and process labels, along with
11971194
// flags indicating network mode and whether volume relabeling should be skipped or made optional.
1198-
func (s *Server) configureSELinuxLabels(ctr container.Container, sb *sandbox.Sandbox, containerInfo *storage.ContainerInfo, securityContext *types.LinuxContainerSecurityContext) (mountLabel, processLabel string, hostNet, maybeRelabel, skipRelabel bool) {
1195+
func (s *Server) configureSELinuxLabels(ctr container.Container, sb *sandbox.Sandbox, containerInfo *storage.ContainerInfo) (mountLabel, processLabel string, maybeRelabel, skipRelabel bool, err error) {
11991196
mountLabel = containerInfo.MountLabel
12001197

12011198
if !ctr.Privileged() {
12021199
processLabel = containerInfo.ProcessLabel
12031200
}
12041201

1202+
securityContext := ctr.Config().GetLinux().GetSecurityContext()
12051203
hostIPC := securityContext.GetNamespaceOptions().GetIpc() == types.NamespaceMode_NODE
12061204
hostPID := securityContext.GetNamespaceOptions().GetPid() == types.NamespaceMode_NODE
1207-
hostNet = securityContext.GetNamespaceOptions().GetNetwork() == types.NamespaceMode_NODE
1205+
hostNet := securityContext.GetNamespaceOptions().GetNetwork() == types.NamespaceMode_NODE
12081206

12091207
// Don't use SELinux separation with Host Pid or IPC Namespace or privileged.
12101208
if hostPID || hostIPC {
@@ -1215,22 +1213,30 @@ func (s *Server) configureSELinuxLabels(ctr container.Container, sb *sandbox.San
12151213
processLabel = ""
12161214
}
12171215

1216+
// Newer versions of container-selinux, container-selinux-2.132.0 or newer,
1217+
// supply a container_init_t label. If CRI-O is running systemd or init inside
1218+
// the container and the process label is unset, the init selinux label is required
1219+
// to run the container.
1220+
if ctr.WillRunSystemd() && processLabel == "" {
1221+
processLabel, err = InitLabel(processLabel)
1222+
if err != nil {
1223+
return "", "", false, false, fmt.Errorf("failed to get init label: %w", err)
1224+
}
1225+
}
1226+
12181227
if val, present := v2.GetAnnotationValue(sb.Annotations(), v2.TrySkipVolumeSELinuxLabel); present && val == "true" {
12191228
maybeRelabel = true
12201229
}
12211230

12221231
const superPrivilegedType = "spc_t"
12231232

12241233
if securityContext.GetSelinuxOptions().GetType() == superPrivilegedType || // super privileged container
1225-
(ctr.SandboxConfig().GetLinux() != nil &&
1226-
ctr.SandboxConfig().GetLinux().GetSecurityContext() != nil &&
1227-
ctr.SandboxConfig().GetLinux().GetSecurityContext().GetSelinuxOptions() != nil &&
1228-
ctr.SandboxConfig().GetLinux().GetSecurityContext().GetSelinuxOptions().GetType() == superPrivilegedType && // super privileged pod
1234+
(ctr.SandboxConfig().GetLinux().GetSecurityContext().GetSelinuxOptions().GetType() == superPrivilegedType && // super privileged pod
12291235
securityContext.GetSelinuxOptions().GetType() == "") {
12301236
skipRelabel = true
12311237
}
12321238

1233-
return mountLabel, processLabel, hostNet, maybeRelabel, skipRelabel
1239+
return mountLabel, processLabel, maybeRelabel, skipRelabel, nil
12341240
}
12351241

12361242
// createStorageContainer creates the storage layer container with the specified image and ID mappings.

‎server/container_create_freebsd.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,8 @@ func (s *Server) addOCIBindMounts(ctx context.Context, ctr ctrfactory.Container,
153153
func addShmMount(ctr ctrfactory.Container, sb *sandbox.Sandbox) {
154154
}
155155

156-
func setupSystemd(mounts []rspec.Mount, g generate.Generator) {
156+
// setupSystemdMounts is a no-op on FreeBSD as systemd is not supported.
157+
func setupSystemdMounts(g *generate.Generator) {
157158
}
158159

159160
// Returns the spec Generator for the container, with some values set.

‎server/container_create_linux.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -655,8 +655,9 @@ func mountExists(specMounts []rspec.Mount, dest string) bool {
655655

656656
// systemd expects to have /run, /run/lock and /tmp on tmpfs
657657
// It also expects to be able to write to /sys/fs/cgroup/systemd and /var/log/journal.
658-
func setupSystemd(mounts []rspec.Mount, g generate.Generator) {
658+
func setupSystemdMounts(g *generate.Generator) {
659659
options := []string{"rw", "rprivate", "noexec", "nosuid", "nodev"}
660+
mounts := g.Mounts()
660661

661662
for _, dest := range []string{"/run", "/run/lock"} {
662663
if mountExists(mounts, dest) {

0 commit comments

Comments
 (0)