91 lines
2.6 KiB
Perl
91 lines
2.6 KiB
Perl
package Sys::Linux::Namespace;
|
|
# ABSTRACT: Sets up linux kernel namespaces
|
|
|
|
use strict;
|
|
use warnings;
|
|
|
|
use Sys::Linux::Mount qw/:all/;
|
|
use Sys::Linux::Unshare qw/:all/;
|
|
use POSIX qw/_exit/;
|
|
|
|
require Exporter;
|
|
our @ISA = qw/Exporter/;
|
|
|
|
our @EXPORT_OK=qw/namespace/;
|
|
|
|
sub namespace {
|
|
my ($options) = @_;
|
|
|
|
my $uflags = 0;
|
|
my $mflags = 0;
|
|
|
|
my $post_setup = sub {
|
|
# If we want a private /tmp, or private mount we need to recursively make every mount private. it CAN be done without that but this is more reliable.
|
|
if ($options->{private_mount} || $options->{private_tmp}) {
|
|
mount("/", "/", undef, MS_REC|MS_PRIVATE, undef);
|
|
}
|
|
|
|
if ($options->{private_tmp}) {
|
|
if (ref $options->{private_tmp} eq 'HASH') {
|
|
mount("/tmp", "/tmp", "tmpfs", MS_PRIVATE, $options->{private_tmp});
|
|
} elsif (ref $options->{private_tmp}) {
|
|
die "Bad ref type passed as private_tmp";
|
|
} else {
|
|
mount("/tmp", "/tmp", "tmpfs", 0, undef);
|
|
mount("/tmp", "/tmp", "tmpfs", MS_PRIVATE, undef);
|
|
}
|
|
}
|
|
};
|
|
|
|
if (ref $options->{pid} eq 'CODE') {
|
|
$uflags |= CLONE_NEWPID;
|
|
} elsif (ref $options->{pid}) {
|
|
die "New PID namespace requires a coderef";
|
|
}
|
|
|
|
if ($options->{mount} || $options->{private_mount} || $options->{private_tmp}) {
|
|
$uflags |= CLONE_NEWNS;
|
|
}
|
|
|
|
if ($options->{net}) {
|
|
die "TODO, need to setup network interfaces";
|
|
}
|
|
|
|
if (ref $options->{pid} eq 'CODE') {
|
|
my $mid_pid = fork();
|
|
|
|
unless($mid_pid == -1) {
|
|
if ($mid_pid) {
|
|
# Original Process
|
|
waitpid($mid_pid, 0); # WE MUST BLOCK
|
|
return; # don't run anything else in here
|
|
} else {
|
|
# Middle child process
|
|
unshare($uflags); # Setup the namespaces
|
|
$post_setup->();
|
|
my $child_pid = fork();
|
|
|
|
unless($child_pid == -1) {
|
|
if ($child_pid) {
|
|
waitpid($child_pid, 0);
|
|
} else {
|
|
$options->{pid}->();
|
|
}
|
|
|
|
# exit and do no cleanup, don't continue running the program, or any END{} blocks
|
|
# This is so that we don't cause anything to go wrong in the parent because something was left around
|
|
_exit(0);
|
|
} else {
|
|
die "Couldn't make PID 1: $!";
|
|
}
|
|
}
|
|
} else {
|
|
die "Couldn't fork $!";
|
|
}
|
|
} else {
|
|
unshare($uflags);
|
|
$post_setup->();
|
|
}
|
|
}
|
|
|
|
1;
|