cntr 2.0.0

A container debugging tool based on Linux mount API
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132

//! Shared container setup utilities
//!
//! This module provides common functionality for entering container namespaces
//! and setting up security context (LSM, cgroups, capabilities).

use anyhow::{Context, bail};
use nix::unistd::{self, Pid};

use crate::capabilities;
use crate::cgroup;
use crate::namespace;
use crate::procfs::ProcStatus;
use crate::result::Result;

/// Enter all container namespaces
///
/// Opens and enters mount, UTS, cgroup, PID, net, IPC, and user namespaces.
/// Returns true if USER namespace was entered.
fn enter_namespaces(container_pid: Pid) -> Result<bool> {
    // Detect supported namespaces
    let supported_namespaces =
        namespace::supported_namespaces().context("failed to list namespaces")?;

    if !supported_namespaces.contains(namespace::MOUNT.name) {
        bail!("the system has no support for mount namespaces");
    }

    // Open mount namespace
    let mount_namespace = namespace::MOUNT
        .open(container_pid)
        .context("could not access mount namespace")?;

    // Open other namespaces
    let mut other_namespaces = Vec::new();
    let mut user_ns_entered = false;
    let other_kinds = &[
        namespace::UTS,
        namespace::CGROUP,
        namespace::PID,
        namespace::NET,
        namespace::IPC,
        namespace::USER,
    ];

    for kind in other_kinds {
        if !supported_namespaces.contains(kind.name) {
            continue;
        }
        if kind.is_same(container_pid) {
            continue;
        }

        let ns = kind
            .open(container_pid)
            .with_context(|| format!("failed to open {} namespace", kind.name))?;

        // Track if USER namespace was successfully opened
        if kind.name == namespace::USER.name {
            user_ns_entered = true;
        }

        other_namespaces.push(ns);
    }

    // Enter mount namespace first
    mount_namespace
        .apply()
        .context("failed to enter mount namespace")?;

    // Enter other namespaces
    for ns in other_namespaces {
        ns.apply().context("failed to apply namespace")?;
    }

    Ok(user_ns_entered)
}

/// Apply security context (UID/GID, capabilities, LSM)
///
/// Sets UID/GID, drops capabilities, and applies LSM profile.
pub(crate) fn apply_security_context(
    process_status: &mut ProcStatus,
    in_user_namespace: bool,
) -> Result<()> {
    // Set UID/GID
    if in_user_namespace {
        // Try to clear supplementary groups, but ignore errors as this may fail
        // in some sandboxes even when not explicitly denied
        let _ = unistd::setgroups(&[]);
        unistd::setgid(process_status.gid).context("could not set group id")?;
        unistd::setuid(process_status.uid).context("could not set user id")?;
    }

    // Drop capabilities
    capabilities::drop(
        process_status.effective_capabilities,
        process_status.last_cap,
    )
    .context("failed to apply capabilities")?;

    Ok(())
}

/// Complete container setup: cgroup, namespaces, and security context
///
/// This is a convenience function that performs all setup steps:
/// 1. Moves to container's cgroup
/// 2. Enters all container namespaces
/// 3. Applies security context (UID/GID, capabilities, LSM)
pub(crate) fn enter_container(process_status: &mut ProcStatus) -> Result<()> {
    // Move to container's cgroup
    cgroup::move_to(unistd::getpid(), process_status.global_pid)
        .context("failed to change cgroup")?;

    // Enter namespaces
    let in_user_ns = enter_namespaces(process_status.global_pid).with_context(|| {
        format!(
            "failed to enter namespaces for PID {}",
            process_status.global_pid
        )
    })?;

    // Apply security context
    apply_security_context(process_status, in_user_ns).with_context(|| {
        format!(
            "failed to apply security context (UID={}, GID={})",
            process_status.uid, process_status.gid
        )
    })?;

    Ok(())
}