github.com/rigado/snapd@v2.42.5-go-mod+incompatible/cmd/snap-confine/ns-support.h (about) 1 /* 2 * Copyright (C) 2016 Canonical Ltd 3 * 4 * This program is free software: you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License version 3 as 6 * published by the Free Software Foundation. 7 * 8 * This program is distributed in the hope that it will be useful, 9 * but WITHOUT ANY WARRANTY; without even the implied warranty of 10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 11 * GNU General Public License for more details. 12 * 13 * You should have received a copy of the GNU General Public License 14 * along with this program. If not, see <http://www.gnu.org/licenses/>. 15 * 16 */ 17 18 #ifndef SNAP_NAMESPACE_SUPPORT 19 #define SNAP_NAMESPACE_SUPPORT 20 21 #include <stdbool.h> 22 23 #include "../libsnap-confine-private/apparmor-support.h" 24 #include "snap-confine-invocation.h" 25 26 /** 27 * Re-associate the current process with the mount namespace of pid 1. 28 * 29 * This function inspects the mount namespace of the current process and that 30 * of pid 1. In case they differ the current process is re-associated with the 31 * mount namespace of pid 1. 32 * 33 * This function should be called before sc_initialize_mount_ns(). 34 **/ 35 void sc_reassociate_with_pid1_mount_ns(void); 36 37 /** 38 * Initialize namespace sharing. 39 * 40 * This function must be called once in each process that wishes to create or 41 * join a namespace group. 42 * 43 * It is responsible for bind mounting the control directory over itself and 44 * making it private (unsharing it with all the other peers) so that it can be 45 * used for storing preserved namespaces as bind-mounted files from the nsfs 46 * filesystem (namespace filesystem). 47 * 48 * This function should be called with a global lock (see sc_lock_global) held 49 * to ensure that no other instance of snap-confine attempts to do this 50 * concurrently. 51 * 52 * This function inspects /proc/self/mountinfo to determine if the directory 53 * where namespaces are kept (/run/snapd/ns) is correctly prepared as described 54 * above. 55 * 56 * For more details see namespaces(7). 57 **/ 58 void sc_initialize_mount_ns(void); 59 60 /** 61 * Data required to manage namespaces amongst a group of processes. 62 */ 63 struct sc_mount_ns; 64 65 /** 66 * Open a namespace group. 67 * 68 * This will open and keep file descriptors for /run/snapd/ns/. 69 * 70 * The following methods should be called only while holding a lock protecting 71 * that specific snap namespace: 72 * - sc_create_or_join_mount_ns() 73 * - sc_preserve_populated_mount_ns() 74 */ 75 struct sc_mount_ns *sc_open_mount_ns(const char *group_name); 76 77 /** 78 * Close namespace group. 79 * 80 * This will close all of the open file descriptors and release allocated memory. 81 */ 82 void sc_close_mount_ns(struct sc_mount_ns *group); 83 84 /** 85 * Join a preserved mount namespace if one exists. 86 * 87 * Technically the function opens /run/snapd/ns/${group_name}.mnt and tries to 88 * use setns() with the obtained file descriptor. 89 * 90 * If the preserved mount namespace does not exist or exists but is stale and 91 * was discarded and returns ESRCH. If the mount namespace was joined the 92 * function returns zero. 93 **/ 94 int sc_join_preserved_ns(struct sc_mount_ns *group, struct sc_apparmor 95 *apparmor, const sc_invocation * inv, 96 int snap_discard_ns_fd); 97 98 /** 99 * Join a preserved, per-user, mount namespace if one exists. 100 * 101 * Technically the function opens /run/snapd/ns/snap.$SNAP_NAME.$UID.mnt and 102 * tries to use setns() with the obtained file descriptor. 103 * 104 * The return is ESRCH if a preserved per-user mount namespace does not exist 105 * and cannot be joined or zero otherwise. 106 **/ 107 int sc_join_preserved_per_user_ns(struct sc_mount_ns *group, 108 const char *snap_name); 109 110 /** 111 * Fork off a helper process for mount namespace capture. 112 * 113 * This function forks the helper process. It needs to be paired with 114 * sc_wait_for_helper which instructs the helper to shut down and waits for 115 * that to happen. 116 * 117 * For rationale for forking and using a helper process please see 118 * https://lists.linuxfoundation.org/pipermail/containers/2013-August/033386.html 119 **/ 120 void sc_fork_helper(struct sc_mount_ns *group, struct sc_apparmor *apparmor); 121 122 /** 123 * Preserve prepared namespace group. 124 * 125 * This function signals the child support process for namespace capture to 126 * perform the capture. 127 * 128 * Technically this function writes to pipe that causes the child process to 129 * wake up and bind mount /proc/$ppid/ns/mnt to 130 * /run/snapd/ns/${group_name}.mnt. 131 * 132 * The helper process will wait for subsequent commands. Please call 133 * sc_wait_for_helper() to terminate it. 134 **/ 135 void sc_preserve_populated_mount_ns(struct sc_mount_ns *group); 136 137 void sc_preserve_populated_per_user_mount_ns(struct sc_mount_ns *group); 138 139 /** 140 * Ask the helper process to terminate and wait for it to finish. 141 * 142 * This function asks the helper process to exit by writing an appropriate 143 * command to the pipe used for the inter process communication between the 144 * main snap-confine process and the helper and then waits for the process to 145 * terminate cleanly. 146 **/ 147 void sc_wait_for_helper(struct sc_mount_ns *group); 148 149 void sc_store_ns_info(const sc_invocation * inv); 150 151 #endif