Use resolved runsc executable path for nixos compatibility#13100
Use resolved runsc executable path for nixos compatibility#131000kenx wants to merge 2 commits intogoogle:masterfrom
Conversation
Signed-off-by: 0kenx <km@nxfi.app>
Signed-off-by: 0kenx <km@nxfi.app>
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
Can you elaborate here? There is a tradeoff here, which is that the path at |
2 participants
Summary
Use
specutils.ExePathinstead of/proc/self/exewhenrunscre-execs itself inside a new user namespace, and resolveExePathto the real executable path at startup with a conservative fallback to/proc/self/exe.Why
Some host-side execute allowlist policies cannot safely authorize procfs magic-link execution through
/proc/self/exe. Resolving the real executable path keeps helper and user-namespace re-execs on the same concrete binary path that the supervisor already authorized.Changes
/proc/self/exere-exec inMaybeRunAsRootwithExePath.ExePathfromos.Executable(), resolving symlinks when possible./proc/self/exeif resolution fails, returns a non-absolute path, points at a directory, or points at a non-executable file.Validation
gofmton changed files.git diff --check.