colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

bunpen: clone: place the clone flags behind an enum

Browse Source
This commit is contained in:
Colin
2024-08-30 11:37:45 +00:00
parent 3e5cb29a7d
commit d2bf8dbdbb
2 changed files with 35 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
pkgs/additional/bunpen/restrict/namespace.ha
View File

@@ -19,24 +19,24 @@ export fn namespace_restrict(what: *resources) void = {
// unshare as much as possible, by default:
let what_to_unshare =
rtext::CLONE_NEWCGROUP |
rtext::CLONE_NEWIPC |
rtext::CLONE_NEWNET |
rtext::CLONE_NEWNS |
rtext::CLONE_NEWPID |
rtext::CLONE_NEWUSER |
rtext::CLONE_NEWUTS
rtext::clone_flag::NEWCGROUP |
rtext::clone_flag::NEWIPC |
rtext::clone_flag::NEWNET |
rtext::clone_flag::NEWNS |
rtext::clone_flag::NEWPID |
rtext::clone_flag::NEWUSER |
rtext::clone_flag::NEWUTS
;
if (what.net) {
log::println("[namespace] keeping net namespace");
what_to_unshare &= ~rtext::CLONE_NEWNET;
what_to_unshare &= ~rtext::clone_flag::NEWNET;
};
if (what.pid) {
log::println("[namespace] keeping pid namespace");
what_to_unshare &= ~rtext::CLONE_NEWPID;
what_to_unshare &= ~rtext::clone_flag::NEWPID;
};
log::printfln("[namespace] unshare {}", what_to_unshare);
log::printfln("[namespace] unshare {}", what_to_unshare: u64);
rtext::unshare(what_to_unshare)!;
// before mounting anything, set up the uids and gids in this namespace.

46
pkgs/additional/bunpen/rtext/unshare.ha
View File

@@ -1,39 +1,43 @@
// vim: set shiftwidth=2 :
use rt;
//// for use with `setns`, `unshare`, `clone` syscalls
// new time namespace. calling process is NOT moved into the namespace.
export const CLONE_NEWTIME: u64 = 0x00000080;
// for use with `setns`, `unshare`, `clone` syscalls
export type clone_flag = enum u64 {
// new time namespace. calling process is NOT moved into the namespace.
NEWTIME = 0x00000080,
// new mount namespace.
// CLONE_NEWNS implies CLONE_FS.
export const CLONE_NEWNS: u64 = 0x00020000;
// new mount namespace.
// NEWNS implies FS.
NEWNS = 0x00020000,
export const CLONE_NEWCGROUP: u64 = 0x02000000;
NEWCGROUP = 0x02000000,
// new utsname namespace
export const CLONE_NEWUTS: u64 = 0x04000000;
// new utsname namespace
NEWUTS = 0x04000000,
// CLONE_NEWIPC implies CLONE_SYSVSEM.
export const CLONE_NEWIPC: u64 = 0x08000000;
// NEWIPC implies SYSVSEM.
NEWIPC = 0x08000000,
// CLONE_NEWUSER implies CLONE_THREAD and CLONE_FS.
// calling process must NOT be multi-threaded.
export const CLONE_NEWUSER: u64 = 0x10000000;
// NEWUSER implies THREAD and FS.
// calling process must NOT be multi-threaded.
NEWUSER = 0x10000000,
// new process ID namespace. calling process is NOT moved into the namespace.
// the first new child spawned becomes pid 1 and has the role of init(1).
// CLONE_NEWPID implies CLONE_THREAD.
export const CLONE_NEWPID: u64 = 0x20000000;
// new process ID namespace. calling process is NOT moved into the namespace.
// the first new child spawned becomes pid 1 and has the role of init(1).
// NEWPID implies THREAD.
NEWPID = 0x20000000,
export const CLONE_NEWNET: u64 = 0x40000000;
NEWNET = 0x40000000,
// additional CLONE flags in kernel, omitted until i need them.
// additional CLONE flags in kernel, omitted until i need them.
};
// union of `clone_flag`
export type clone_flags = u64;
// export fn setns(ns_fd: i32, nstype: i32) (rt::errno | u64) = {
// return syscall(rt::SYS_setns, ns_fd: u64, nstype: u64);
// };
export fn unshare(flags: u64) (rt::errno | u64) = {
export fn unshare(flags: clone_flags) (rt::errno | u64) = {
return syscall(rt::SYS_unshare, flags);
};