diff options
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/app/finalise.go | 10 | ||||
| -rw-r--r-- | internal/app/shim.go | 23 |
2 files changed, 14 insertions, 19 deletions
diff --git a/internal/app/finalise.go b/internal/app/finalise.go index ec2d0a9a..3d6ec38d 100644 --- a/internal/app/finalise.go +++ b/internal/app/finalise.go @@ -83,8 +83,8 @@ func (k *outcome) finalise(ctx context.Context, msg container.Msg, id *state.ID, k.ct = ct } - // allowed identity range 0 to 9999, this is checked again in hsu - if config.Identity < 0 || config.Identity > 9999 { + // this is checked again in hsu + if config.Identity < hst.IdentityMin || config.Identity > hst.IdentityMax { return newWithMessage(fmt.Sprintf("identity %d out of range", config.Identity)) } @@ -187,9 +187,9 @@ func (k *outcome) finalise(ctx context.Context, msg container.Msg, id *state.ID, // enforce bounds and default early if s.Container.WaitDelay <= 0 { - kp.waitDelay = hst.DefaultWaitDelay - } else if s.Container.WaitDelay > hst.MaxWaitDelay { - kp.waitDelay = hst.MaxWaitDelay + kp.waitDelay = hst.WaitDelayDefault + } else if s.Container.WaitDelay > hst.WaitDelayMax { + kp.waitDelay = hst.WaitDelayMax } else { kp.waitDelay = s.Container.WaitDelay } diff --git a/internal/app/shim.go b/internal/app/shim.go index de53b975..4927f5c5 100644 --- a/internal/app/shim.go +++ b/internal/app/shim.go @@ -15,6 +15,7 @@ import ( "hakurei.app/container" "hakurei.app/container/seccomp" + "hakurei.app/hst" ) //#include "shim-signal.h" @@ -23,27 +24,21 @@ import "C" const shimEnv = "HAKUREI_SHIM" type shimParams struct { - // monitor pid, checked against ppid in signal handler + // Priv side pid, checked against ppid in signal handler for the syscall.SIGCONT hack. Monitor int - // duration to wait for after interrupting a container's initial process before the container is killed; - // zero value defaults to [DefaultShimWaitDelay], values exceeding [MaxShimWaitDelay] becomes [MaxShimWaitDelay] + // Duration to wait for after interrupting a container's initial process before the container is killed. + // Limits are enforced on the priv side. WaitDelay time.Duration - // finalised container params + // Finalised container params. + // TODO(ophestra): transmit outcomeState instead (params to shim) Container *container.Params - // verbosity pass through + // Verbosity pass through. Verbose bool } -const ( - // ShimExitRequest is returned when the monitor process requests shim exit. - ShimExitRequest = 254 - // ShimExitOrphan is returned when the shim is orphaned before monitor delivers a signal. - ShimExitOrphan = 3 -) - // ShimMain is the main function of the shim process and runs as the unconstrained target user. func ShimMain() { log.SetPrefix("shim: ") @@ -107,12 +102,12 @@ func ShimMain() { // setup has not completed, terminate immediately msg.Resume() - os.Exit(ShimExitRequest) + os.Exit(hst.ShimExitRequest) return case 1: // got SIGCONT after adoption: monitor died before delivering signal msg.BeforeExit() - os.Exit(ShimExitOrphan) + os.Exit(hst.ShimExitOrphan) return case 2: // unreachable |