-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
A raw fork/exec driver that provides no isolation. #237
Merged
Merged
Changes from all commits
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
1098e56
Privileged exec driver
dadgar 7caa30b
Change name from pexec to raw_exec; hamming distance one seemed like …
dadgar 60346ae
Actually add the files
dadgar c4e4861
Documentation
dadgar bbdceca
Better parsing of raw_exec option and updated docs
dadgar File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,201 @@ | ||
package driver | ||
|
||
import ( | ||
"fmt" | ||
"os" | ||
"os/exec" | ||
"path/filepath" | ||
"runtime" | ||
"strconv" | ||
"strings" | ||
"time" | ||
|
||
"github.com/hashicorp/nomad/client/allocdir" | ||
"github.com/hashicorp/nomad/client/config" | ||
"github.com/hashicorp/nomad/client/driver/args" | ||
"github.com/hashicorp/nomad/nomad/structs" | ||
) | ||
|
||
const ( | ||
// The option that enables this driver in the Config.Options map. | ||
rawExecConfigOption = "driver.raw_exec.enable" | ||
|
||
// Null files to use as stdin. | ||
unixNull = "/dev/null" | ||
windowsNull = "nul" | ||
) | ||
|
||
// The RawExecDriver is a privileged version of the exec driver. It provides no | ||
// resource isolation and just fork/execs. The Exec driver should be preferred | ||
// and this should only be used when explicitly needed. | ||
type RawExecDriver struct { | ||
DriverContext | ||
} | ||
|
||
// rawExecHandle is returned from Start/Open as a handle to the PID | ||
type rawExecHandle struct { | ||
proc *os.Process | ||
waitCh chan error | ||
doneCh chan struct{} | ||
} | ||
|
||
// NewRawExecDriver is used to create a new raw exec driver | ||
func NewRawExecDriver(ctx *DriverContext) Driver { | ||
return &RawExecDriver{*ctx} | ||
} | ||
|
||
func (d *RawExecDriver) Fingerprint(cfg *config.Config, node *structs.Node) (bool, error) { | ||
// Check that the user has explicitly enabled this executor. | ||
enabled, err := strconv.ParseBool(cfg.ReadDefault(rawExecConfigOption, "false")) | ||
if err != nil { | ||
return false, fmt.Errorf("Failed to parse %v option: %v", rawExecConfigOption, err) | ||
} | ||
|
||
if enabled { | ||
d.logger.Printf("[WARN] driver.raw_exec: raw exec is enabled. Only enable if needed") | ||
node.Attributes["driver.raw_exec"] = "1" | ||
return true, nil | ||
} | ||
|
||
return false, nil | ||
} | ||
|
||
func (d *RawExecDriver) Start(ctx *ExecContext, task *structs.Task) (DriverHandle, error) { | ||
// Get the command | ||
command, ok := task.Config["command"] | ||
if !ok || command == "" { | ||
return nil, fmt.Errorf("missing command for raw_exec driver") | ||
} | ||
|
||
// Get the tasks local directory. | ||
taskName := d.DriverContext.taskName | ||
taskDir, ok := ctx.AllocDir.TaskDirs[taskName] | ||
if !ok { | ||
return nil, fmt.Errorf("Could not find task directory for task: %v", d.DriverContext.taskName) | ||
} | ||
taskLocal := filepath.Join(taskDir, allocdir.TaskLocal) | ||
|
||
// Get the environment variables. | ||
envVars := TaskEnvironmentVariables(ctx, task) | ||
|
||
// Look for arguments | ||
var cmdArgs []string | ||
if argRaw, ok := task.Config["args"]; ok { | ||
parsed, err := args.ParseAndReplace(argRaw, envVars.Map()) | ||
if err != nil { | ||
return nil, err | ||
} | ||
cmdArgs = append(cmdArgs, parsed...) | ||
} | ||
|
||
// Setup the command | ||
cmd := exec.Command(command, cmdArgs...) | ||
cmd.Dir = taskDir | ||
cmd.Env = envVars.List() | ||
|
||
// Capture the stdout/stderr and redirect stdin to /dev/null | ||
stdoutFilename := filepath.Join(taskLocal, fmt.Sprintf("%s.stdout", taskName)) | ||
stderrFilename := filepath.Join(taskLocal, fmt.Sprintf("%s.stderr", taskName)) | ||
stdinFilename := unixNull | ||
if runtime.GOOS == "windows" { | ||
stdinFilename = windowsNull | ||
} | ||
|
||
stdo, err := os.OpenFile(stdoutFilename, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0666) | ||
if err != nil { | ||
return nil, fmt.Errorf("Error opening file to redirect stdout: %v", err) | ||
} | ||
|
||
stde, err := os.OpenFile(stderrFilename, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0666) | ||
if err != nil { | ||
return nil, fmt.Errorf("Error opening file to redirect stderr: %v", err) | ||
} | ||
|
||
stdi, err := os.OpenFile(stdinFilename, os.O_CREATE|os.O_RDONLY, 0666) | ||
if err != nil { | ||
return nil, fmt.Errorf("Error opening file to redirect stdin: %v", err) | ||
} | ||
|
||
cmd.Stdout = stdo | ||
cmd.Stderr = stde | ||
cmd.Stdin = stdi | ||
|
||
if err := cmd.Start(); err != nil { | ||
return nil, fmt.Errorf("failed to start command: %v", err) | ||
} | ||
|
||
// Return a driver handle | ||
h := &rawExecHandle{ | ||
proc: cmd.Process, | ||
doneCh: make(chan struct{}), | ||
waitCh: make(chan error, 1), | ||
} | ||
go h.run() | ||
return h, nil | ||
} | ||
|
||
func (d *RawExecDriver) Open(ctx *ExecContext, handleID string) (DriverHandle, error) { | ||
// Split the handle | ||
pidStr := strings.TrimPrefix(handleID, "PID:") | ||
pid, err := strconv.Atoi(pidStr) | ||
if err != nil { | ||
return nil, fmt.Errorf("failed to parse handle '%s': %v", handleID, err) | ||
} | ||
|
||
// Find the process | ||
proc, err := os.FindProcess(pid) | ||
if proc == nil || err != nil { | ||
return nil, fmt.Errorf("failed to find PID %d: %v", pid, err) | ||
} | ||
|
||
// Return a driver handle | ||
h := &rawExecHandle{ | ||
proc: proc, | ||
doneCh: make(chan struct{}), | ||
waitCh: make(chan error, 1), | ||
} | ||
go h.run() | ||
return h, nil | ||
} | ||
|
||
func (h *rawExecHandle) ID() string { | ||
// Return a handle to the PID | ||
return fmt.Sprintf("PID:%d", h.proc.Pid) | ||
} | ||
|
||
func (h *rawExecHandle) WaitCh() chan error { | ||
return h.waitCh | ||
} | ||
|
||
func (h *rawExecHandle) Update(task *structs.Task) error { | ||
// Update is not possible | ||
return nil | ||
} | ||
|
||
// Kill is used to terminate the task. We send an Interrupt | ||
// and then provide a 5 second grace period before doing a Kill on supported | ||
// OS's, otherwise we kill immediately. | ||
func (h *rawExecHandle) Kill() error { | ||
if runtime.GOOS == "windows" { | ||
return h.proc.Kill() | ||
} | ||
|
||
h.proc.Signal(os.Interrupt) | ||
select { | ||
case <-h.doneCh: | ||
return nil | ||
case <-time.After(5 * time.Second): | ||
return h.proc.Kill() | ||
} | ||
} | ||
|
||
func (h *rawExecHandle) run() { | ||
ps, err := h.proc.Wait() | ||
close(h.doneCh) | ||
if err != nil { | ||
h.waitCh <- err | ||
} else if !ps.Success() { | ||
h.waitCh <- fmt.Errorf("task exited with error") | ||
} | ||
close(h.waitCh) | ||
} |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we verify that this directory exists before writing files to it?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tasks are only added in that map after they have been made. So we are safe here