blob: c8750f583e80b57d78589f16a3afb3a5043c03c6 [file] [log] [blame]
From 03ed5e89372babca7f1061bef466f8bf7fdee62c Mon Sep 17 00:00:00 2001
From: Lorenz Brun <lorenz@brun.one>
Date: Mon, 16 Mar 2020 22:13:08 +0100
Subject: [PATCH 1/5] Provide native mounter implementation for Linux
---
mount_linux.go | 148 +++++++++++++++++-
1 file changed, 144 insertions(+), 4 deletions(-)
diff --git a/mount_linux.go b/mount_linux.go
index aaa592161d4..517bf0b2541 100644
--- a/mount_linux.go
+++ b/mount_linux.go
@@ -22,6 +22,7 @@ package mount
import (
"context"
"fmt"
+ "io/ioutil"
"os"
"os/exec"
"path/filepath"
@@ -30,6 +31,7 @@ import (
"syscall"
"time"
+ "golang.org/x/sys/unix"
"k8s.io/klog/v2"
utilexec "k8s.io/utils/exec"
utilio "k8s.io/utils/io"
@@ -54,8 +56,10 @@ const (
// for the linux platform. This implementation assumes that the
// kubelet is running in the host's root mount namespace.
type Mounter struct {
- mounterPath string
- withSystemd bool
+ mounterPath string
+ withSystemd bool
+ withLinuxUtils bool
+ nativeSupportedFstypes map[string]struct{}
}
var _ MounterForceUnmounter = &Mounter{}
@@ -65,11 +69,36 @@ var _ MounterForceUnmounter = &Mounter{}
// mounterPath allows using an alternative to `/bin/mount` for mounting.
func New(mounterPath string) Interface {
return &Mounter{
- mounterPath: mounterPath,
- withSystemd: detectSystemd(),
+ mounterPath: mounterPath,
+ withSystemd: detectSystemd(),
+ withLinuxUtils: detectLinuxUtils(),
+ nativeSupportedFstypes: detectNativeSupportedFstypes(),
}
}
+func (mounter *Mounter) mountNative(source string, target string, fstype string, options []string, sensitiveOptions []string) error {
+ flags, pflags, fsoptions := parseMountOptions(options)
+ if len(pflags) > 0 {
+ return fmt.Errorf("the native mounter is active and does not support mount propagation at the moment")
+ }
+
+ if !mounter.nativeSupportsFstype(fstype) && flags&unix.MS_BIND == 0 {
+ return fmt.Errorf("the native mounter is active and cannot mount filesystems of type \"%v\"", fstype)
+ }
+
+ if flags&unix.MS_BIND != 0 && flags & ^uintptr(unix.MS_BIND) != 0 {
+ if err := unix.Mount(source, target, "", unix.MS_BIND, ""); err != nil {
+ return fmt.Errorf("bind pre-mount failed: %w", err)
+ }
+ flags |= unix.MS_REMOUNT
+ }
+
+ if err := unix.Mount(source, target, fstype, flags, fsoptions); err != nil {
+ return fmt.Errorf("failed to mount filesystem: %w", err)
+ }
+ return nil
+}
+
// Mount mounts source to target as fstype with given options. 'source' and 'fstype' must
// be an empty string in case it's not required, e.g. for remount, or for auto filesystem
// type, where kernel handles fstype for you. The mount 'options' is a list of options,
@@ -85,6 +114,10 @@ func (mounter *Mounter) Mount(source string, target string, fstype string, optio
// method should be used by callers that pass sensitive material (like
// passwords) as mount options.
func (mounter *Mounter) MountSensitive(source string, target string, fstype string, options []string, sensitiveOptions []string) error {
+ if !mounter.withLinuxUtils {
+ return mounter.mountNative(source, target, fstype, options, sensitiveOptions)
+ }
+
// Path to mounter binary if containerized mounter is needed. Otherwise, it is set to empty.
// All Linux distros are expected to be shipped with a mount utility that a support bind mounts.
mounterPath := ""
@@ -116,6 +149,9 @@ func (mounter *Mounter) MountSensitiveWithoutSystemd(source string, target strin
// MountSensitiveWithoutSystemdWithMountFlags is the same as MountSensitiveWithoutSystemd with additional mount flags.
func (mounter *Mounter) MountSensitiveWithoutSystemdWithMountFlags(source string, target string, fstype string, options []string, sensitiveOptions []string, mountFlags []string) error {
+ if !mounter.withLinuxUtils {
+ return mounter.mountNative(source, target, fstype, options, sensitiveOptions)
+ }
mounterPath := ""
bind, bindOpts, bindRemountOpts, bindRemountOptsSensitive := MakeBindOptsSensitive(options, sensitiveOptions)
if bind {
@@ -138,6 +174,80 @@ func (mounter *Mounter) MountSensitiveWithoutSystemdWithMountFlags(source string
return mounter.doMount(mounterPath, defaultMountCommand, source, target, fstype, options, sensitiveOptions, mountFlags, false)
}
+// nativeSupportsFstype checks if the native mounter can mount the given fstype
+func (mounter *Mounter) nativeSupportsFstype(fstype string) bool {
+ _, ok := mounter.nativeSupportedFstypes[fstype]
+ return ok
+}
+
+// parseMountOptions parses the string and returns the flags, propagation
+// flags and any mount data that it contains.
+// Taken from libcontainer/specconv/spec_linux.go (Apache 2.0) and modified
+func parseMountOptions(options []string) (uintptr, []uintptr, string) {
+ var (
+ flag uintptr
+ pgflag []uintptr
+ data []string
+ )
+ flags := map[string]struct {
+ clear bool
+ flag uintptr
+ }{
+ "async": {true, syscall.MS_SYNCHRONOUS},
+ "atime": {true, syscall.MS_NOATIME},
+ "bind": {false, syscall.MS_BIND},
+ "defaults": {false, 0},
+ "dev": {true, syscall.MS_NODEV},
+ "diratime": {true, syscall.MS_NODIRATIME},
+ "dirsync": {false, syscall.MS_DIRSYNC},
+ "exec": {true, syscall.MS_NOEXEC},
+ "mand": {false, syscall.MS_MANDLOCK},
+ "noatime": {false, syscall.MS_NOATIME},
+ "nodev": {false, syscall.MS_NODEV},
+ "nodiratime": {false, syscall.MS_NODIRATIME},
+ "noexec": {false, syscall.MS_NOEXEC},
+ "nomand": {true, syscall.MS_MANDLOCK},
+ "norelatime": {true, syscall.MS_RELATIME},
+ "nostrictatime": {true, syscall.MS_STRICTATIME},
+ "nosuid": {false, syscall.MS_NOSUID},
+ "rbind": {false, syscall.MS_BIND | syscall.MS_REC},
+ "relatime": {false, syscall.MS_RELATIME},
+ "remount": {false, syscall.MS_REMOUNT},
+ "ro": {false, syscall.MS_RDONLY},
+ "rw": {true, syscall.MS_RDONLY},
+ "strictatime": {false, syscall.MS_STRICTATIME},
+ "suid": {true, syscall.MS_NOSUID},
+ "sync": {false, syscall.MS_SYNCHRONOUS},
+ }
+ propagationFlags := map[string]uintptr{
+ "private": syscall.MS_PRIVATE,
+ "shared": syscall.MS_SHARED,
+ "slave": syscall.MS_SLAVE,
+ "unbindable": syscall.MS_UNBINDABLE,
+ "rprivate": syscall.MS_PRIVATE | syscall.MS_REC,
+ "rshared": syscall.MS_SHARED | syscall.MS_REC,
+ "rslave": syscall.MS_SLAVE | syscall.MS_REC,
+ "runbindable": syscall.MS_UNBINDABLE | syscall.MS_REC,
+ }
+ for _, o := range options {
+ // If the option does not exist in the flags table or the flag
+ // is not supported on the platform,
+ // then it is a data value for a specific fs type
+ if f, exists := flags[o]; exists && f.flag != 0 {
+ if f.clear {
+ flag &= ^f.flag
+ } else {
+ flag |= f.flag
+ }
+ } else if f, exists := propagationFlags[o]; exists && f != 0 {
+ pgflag = append(pgflag, f)
+ } else {
+ data = append(data, o)
+ }
+ }
+ return flag, pgflag, strings.Join(data, ",")
+}
+
// doMount runs the mount command. mounterPath is the path to mounter binary if containerized mounter is used.
// sensitiveOptions is an extension of options except they will not be logged (because they may contain sensitive material)
// systemdMountRequired is an extension of option to decide whether uses systemd mount.
@@ -223,6 +333,30 @@ func detectSystemd() bool {
return true
}
+// detectLinuxUtils detects if the host operating system has the mount and unmount commands present
+func detectLinuxUtils() bool {
+ _, err := exec.LookPath("mount")
+ return err == nil
+}
+
+func detectNativeSupportedFstypes() map[string]struct{} {
+ nativeSupportedFstypes := make(map[string]struct{})
+ filesystemsRaw, err := ioutil.ReadFile("/proc/filesystems")
+ if err != nil {
+ return nativeSupportedFstypes
+ }
+ filesystemLines := strings.Split(string(filesystemsRaw), "\n")
+ for _, line := range filesystemLines {
+ fields := strings.Fields(line)
+ if len(fields) != 2 {
+ continue
+ }
+ filesystem := fields[1]
+ nativeSupportedFstypes[filesystem] = struct{}{}
+ }
+ return nativeSupportedFstypes
+}
+
// MakeMountArgs makes the arguments to the mount(8) command.
// options MUST not contain sensitive material (like passwords).
func MakeMountArgs(source, target, fstype string, options []string) (mountArgs []string) {
@@ -292,6 +426,12 @@ func AddSystemdScopeSensitive(systemdRunPath, mountName, command string, args []
// Unmount unmounts the target.
func (mounter *Mounter) Unmount(target string) error {
klog.V(4).Infof("Unmounting %s", target)
+ if !mounter.withLinuxUtils {
+ if err := unix.Unmount(target, unix.UMOUNT_NOFOLLOW); err != nil {
+ return fmt.Errorf("unmount failed: %v", err)
+ }
+ return nil
+ }
command := exec.Command("umount", target)
output, err := command.CombinedOutput()
if err != nil {
--
2.25.1