github.com/anth0d/nomad@v0.0.0-20221214183521-ae3a0a2cad06/client/allocrunner/taskrunner/getter/util_linux.go (about)

     1  //go:build linux
     2  
     3  package getter
     4  
     5  import (
     6  	"path/filepath"
     7  	"syscall"
     8  
     9  	"github.com/hashicorp/nomad/helper/users"
    10  	"github.com/shoenig/go-landlock"
    11  )
    12  
    13  var (
    14  	// userUID is the current user's uid
    15  	userUID uint32
    16  
    17  	// userGID is the current user's gid
    18  	userGID uint32
    19  )
    20  
    21  func init() {
    22  	userUID = uint32(syscall.Getuid())
    23  	userGID = uint32(syscall.Getgid())
    24  }
    25  
    26  // attributes returns the system process attributes to run
    27  // the sandbox process with
    28  func attributes() *syscall.SysProcAttr {
    29  	uid, gid := credentials()
    30  	return &syscall.SysProcAttr{
    31  		Credential: &syscall.Credential{
    32  			Uid: uid,
    33  			Gid: gid,
    34  		},
    35  	}
    36  }
    37  
    38  // credentials returns the UID and GID of the user the child process
    39  // will run as. On Linux systems this will be the nobody user if Nomad
    40  // is being run as the root user, or the user Nomad is being run as
    41  // otherwise.
    42  func credentials() (uint32, uint32) {
    43  	switch userUID {
    44  	case 0:
    45  		return users.NobodyIDs()
    46  	default:
    47  		return userUID, userGID
    48  	}
    49  }
    50  
    51  // defaultEnvironment is the default minimal environment variables for Linux.
    52  func defaultEnvironment(taskDir string) map[string]string {
    53  	tmpDir := filepath.Join(taskDir, "tmp")
    54  	return map[string]string{
    55  		"PATH":   "/usr/local/bin:/usr/bin:/bin",
    56  		"TMPDIR": tmpDir,
    57  	}
    58  }
    59  
    60  // lockdown isolates this process to only be able to write and
    61  // create files in the task's task directory.
    62  // dir - the task directory
    63  //
    64  // Only applies to Linux, when available.
    65  func lockdown(dir string) error {
    66  	// landlock not present in the kernel, do not sandbox
    67  	if !landlock.Available() {
    68  		return nil
    69  	}
    70  	paths := []*landlock.Path{
    71  		landlock.DNS(),
    72  		landlock.Certs(),
    73  		landlock.Shared(),
    74  		landlock.Dir("/bin", "rx"),
    75  		landlock.Dir("/usr/bin", "rx"),
    76  		landlock.Dir("/usr/local/bin", "rx"),
    77  		landlock.Dir(dir, "rwc"),
    78  	}
    79  	locker := landlock.New(paths...)
    80  	return locker.Lock(landlock.Mandatory)
    81  }