From 03ed5e89372babca7f1061bef466f8bf7fdee62c Mon Sep 17 00:00:00 2001
From: Lorenz Brun <lorenz@brun.one>
Date: Mon, 16 Mar 2020 22:13:08 +0100
Subject: [PATCH 1/5] Provide native mounter implementation for Linux

---
 mount_linux.go | 148 +++++++++++++++++-
 1 file changed, 144 insertions(+), 4 deletions(-)

diff --git a/mount_linux.go b/mount_linux.go
index aaa592161d4..517bf0b2541 100644
--- a/mount_linux.go
+++ b/mount_linux.go
@@ -22,6 +22,7 @@ package mount
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -30,6 +31,7 @@ import (
 	"syscall"
 	"time"
 
+	"golang.org/x/sys/unix"
 	"k8s.io/klog/v2"
 	utilexec "k8s.io/utils/exec"
 	utilio "k8s.io/utils/io"
@@ -54,8 +56,10 @@ const (
 // for the linux platform.  This implementation assumes that the
 // kubelet is running in the host's root mount namespace.
 type Mounter struct {
-	mounterPath string
-	withSystemd bool
+	mounterPath            string
+	withSystemd            bool
+	withLinuxUtils         bool
+	nativeSupportedFstypes map[string]struct{}
 }
 
 var _ MounterForceUnmounter = &Mounter{}
@@ -65,11 +69,36 @@ var _ MounterForceUnmounter = &Mounter{}
 // mounterPath allows using an alternative to `/bin/mount` for mounting.
 func New(mounterPath string) Interface {
 	return &Mounter{
-		mounterPath: mounterPath,
-		withSystemd: detectSystemd(),
+		mounterPath:            mounterPath,
+		withSystemd:            detectSystemd(),
+		withLinuxUtils:         detectLinuxUtils(),
+		nativeSupportedFstypes: detectNativeSupportedFstypes(),
 	}
 }
 
+func (mounter *Mounter) mountNative(source string, target string, fstype string, options []string, sensitiveOptions []string) error {
+	flags, pflags, fsoptions := parseMountOptions(options)
+	if len(pflags) > 0 {
+		return fmt.Errorf("the native mounter is active and does not support mount propagation at the moment")
+	}
+
+	if !mounter.nativeSupportsFstype(fstype) && flags&unix.MS_BIND == 0 {
+		return fmt.Errorf("the native mounter is active and cannot mount filesystems of type \"%v\"", fstype)
+	}
+
+	if flags&unix.MS_BIND != 0 && flags & ^uintptr(unix.MS_BIND) != 0 {
+		if err := unix.Mount(source, target, "", unix.MS_BIND, ""); err != nil {
+			return fmt.Errorf("bind pre-mount failed: %w", err)
+		}
+		flags |= unix.MS_REMOUNT
+	}
+
+	if err := unix.Mount(source, target, fstype, flags, fsoptions); err != nil {
+		return fmt.Errorf("failed to mount filesystem: %w", err)
+	}
+	return nil
+}
+
 // Mount mounts source to target as fstype with given options. 'source' and 'fstype' must
 // be an empty string in case it's not required, e.g. for remount, or for auto filesystem
 // type, where kernel handles fstype for you. The mount 'options' is a list of options,
@@ -85,6 +114,10 @@ func (mounter *Mounter) Mount(source string, target string, fstype string, optio
 // method should be used by callers that pass sensitive material (like
 // passwords) as mount options.
 func (mounter *Mounter) MountSensitive(source string, target string, fstype string, options []string, sensitiveOptions []string) error {
+	if !mounter.withLinuxUtils {
+		return mounter.mountNative(source, target, fstype, options, sensitiveOptions)
+	}
+
 	// Path to mounter binary if containerized mounter is needed. Otherwise, it is set to empty.
 	// All Linux distros are expected to be shipped with a mount utility that a support bind mounts.
 	mounterPath := ""
@@ -116,6 +149,9 @@ func (mounter *Mounter) MountSensitiveWithoutSystemd(source string, target strin
 
 // MountSensitiveWithoutSystemdWithMountFlags is the same as MountSensitiveWithoutSystemd with additional mount flags.
 func (mounter *Mounter) MountSensitiveWithoutSystemdWithMountFlags(source string, target string, fstype string, options []string, sensitiveOptions []string, mountFlags []string) error {
+	if !mounter.withLinuxUtils {
+		return mounter.mountNative(source, target, fstype, options, sensitiveOptions)
+	}
 	mounterPath := ""
 	bind, bindOpts, bindRemountOpts, bindRemountOptsSensitive := MakeBindOptsSensitive(options, sensitiveOptions)
 	if bind {
@@ -138,6 +174,80 @@ func (mounter *Mounter) MountSensitiveWithoutSystemdWithMountFlags(source string
 	return mounter.doMount(mounterPath, defaultMountCommand, source, target, fstype, options, sensitiveOptions, mountFlags, false)
 }
 
+// nativeSupportsFstype checks if the native mounter can mount the given fstype
+func (mounter *Mounter) nativeSupportsFstype(fstype string) bool {
+	_, ok := mounter.nativeSupportedFstypes[fstype]
+	return ok
+}
+
+// parseMountOptions parses the string and returns the flags, propagation
+// flags and any mount data that it contains.
+// Taken from libcontainer/specconv/spec_linux.go (Apache 2.0) and modified
+func parseMountOptions(options []string) (uintptr, []uintptr, string) {
+	var (
+		flag   uintptr
+		pgflag []uintptr
+		data   []string
+	)
+	flags := map[string]struct {
+		clear bool
+		flag  uintptr
+	}{
+		"async":         {true, syscall.MS_SYNCHRONOUS},
+		"atime":         {true, syscall.MS_NOATIME},
+		"bind":          {false, syscall.MS_BIND},
+		"defaults":      {false, 0},
+		"dev":           {true, syscall.MS_NODEV},
+		"diratime":      {true, syscall.MS_NODIRATIME},
+		"dirsync":       {false, syscall.MS_DIRSYNC},
+		"exec":          {true, syscall.MS_NOEXEC},
+		"mand":          {false, syscall.MS_MANDLOCK},
+		"noatime":       {false, syscall.MS_NOATIME},
+		"nodev":         {false, syscall.MS_NODEV},
+		"nodiratime":    {false, syscall.MS_NODIRATIME},
+		"noexec":        {false, syscall.MS_NOEXEC},
+		"nomand":        {true, syscall.MS_MANDLOCK},
+		"norelatime":    {true, syscall.MS_RELATIME},
+		"nostrictatime": {true, syscall.MS_STRICTATIME},
+		"nosuid":        {false, syscall.MS_NOSUID},
+		"rbind":         {false, syscall.MS_BIND | syscall.MS_REC},
+		"relatime":      {false, syscall.MS_RELATIME},
+		"remount":       {false, syscall.MS_REMOUNT},
+		"ro":            {false, syscall.MS_RDONLY},
+		"rw":            {true, syscall.MS_RDONLY},
+		"strictatime":   {false, syscall.MS_STRICTATIME},
+		"suid":          {true, syscall.MS_NOSUID},
+		"sync":          {false, syscall.MS_SYNCHRONOUS},
+	}
+	propagationFlags := map[string]uintptr{
+		"private":     syscall.MS_PRIVATE,
+		"shared":      syscall.MS_SHARED,
+		"slave":       syscall.MS_SLAVE,
+		"unbindable":  syscall.MS_UNBINDABLE,
+		"rprivate":    syscall.MS_PRIVATE | syscall.MS_REC,
+		"rshared":     syscall.MS_SHARED | syscall.MS_REC,
+		"rslave":      syscall.MS_SLAVE | syscall.MS_REC,
+		"runbindable": syscall.MS_UNBINDABLE | syscall.MS_REC,
+	}
+	for _, o := range options {
+		// If the option does not exist in the flags table or the flag
+		// is not supported on the platform,
+		// then it is a data value for a specific fs type
+		if f, exists := flags[o]; exists && f.flag != 0 {
+			if f.clear {
+				flag &= ^f.flag
+			} else {
+				flag |= f.flag
+			}
+		} else if f, exists := propagationFlags[o]; exists && f != 0 {
+			pgflag = append(pgflag, f)
+		} else {
+			data = append(data, o)
+		}
+	}
+	return flag, pgflag, strings.Join(data, ",")
+}
+
 // doMount runs the mount command. mounterPath is the path to mounter binary if containerized mounter is used.
 // sensitiveOptions is an extension of options except they will not be logged (because they may contain sensitive material)
 // systemdMountRequired is an extension of option to decide whether uses systemd mount.
@@ -223,6 +333,30 @@ func detectSystemd() bool {
 	return true
 }
 
+// detectLinuxUtils detects if the host operating system has the mount and unmount commands present
+func detectLinuxUtils() bool {
+	_, err := exec.LookPath("mount")
+	return err == nil
+}
+
+func detectNativeSupportedFstypes() map[string]struct{} {
+	nativeSupportedFstypes := make(map[string]struct{})
+	filesystemsRaw, err := ioutil.ReadFile("/proc/filesystems")
+	if err != nil {
+		return nativeSupportedFstypes
+	}
+	filesystemLines := strings.Split(string(filesystemsRaw), "\n")
+	for _, line := range filesystemLines {
+		fields := strings.Fields(line)
+		if len(fields) != 2 {
+			continue
+		}
+		filesystem := fields[1]
+		nativeSupportedFstypes[filesystem] = struct{}{}
+	}
+	return nativeSupportedFstypes
+}
+
 // MakeMountArgs makes the arguments to the mount(8) command.
 // options MUST not contain sensitive material (like passwords).
 func MakeMountArgs(source, target, fstype string, options []string) (mountArgs []string) {
@@ -292,6 +426,12 @@ func AddSystemdScopeSensitive(systemdRunPath, mountName, command string, args []
 // Unmount unmounts the target.
 func (mounter *Mounter) Unmount(target string) error {
 	klog.V(4).Infof("Unmounting %s", target)
+	if !mounter.withLinuxUtils {
+		if err := unix.Unmount(target, unix.UMOUNT_NOFOLLOW); err != nil {
+			return fmt.Errorf("unmount failed: %v", err)
+		}
+		return nil
+	}
 	command := exec.Command("umount", target)
 	output, err := command.CombinedOutput()
 	if err != nil {
-- 
2.25.1