From 8b69bcd2154fdc7903aceca662e9694588c982f2 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 26 Mar 2025 06:19:19 +0900 Subject: sandbox: cache kernel.cap_last_cap value Signed-off-by: Ophestra --- sandbox/sysctl.go | 47 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 sandbox/sysctl.go (limited to 'sandbox/sysctl.go') diff --git a/sandbox/sysctl.go b/sandbox/sysctl.go new file mode 100644 index 00000000..22046b65 --- /dev/null +++ b/sandbox/sysctl.go @@ -0,0 +1,47 @@ +package sandbox + +import ( + "bytes" + "log" + "os" + "strconv" + "sync" +) + +var ( + kernelOverflowuid int + kernelOverflowgid int + kernelCapLastCap int + + sysctlOnce sync.Once +) + +const ( + kernelOverflowuidPath = "/proc/sys/kernel/overflowuid" + kernelOverflowgidPath = "/proc/sys/kernel/overflowgid" + kernelCapLastCapPath = "/proc/sys/kernel/cap_last_cap" +) + +func mustReadSysctl() { + if v, err := os.ReadFile(kernelOverflowuidPath); err != nil { + log.Fatalf("cannot read %q: %v", kernelOverflowuidPath, err) + } else if kernelOverflowuid, err = strconv.Atoi(string(bytes.TrimSpace(v))); err != nil { + log.Fatalf("cannot interpret %q: %v", kernelOverflowuidPath, err) + } + + if v, err := os.ReadFile(kernelOverflowgidPath); err != nil { + log.Fatalf("cannot read %q: %v", kernelOverflowgidPath, err) + } else if kernelOverflowgid, err = strconv.Atoi(string(bytes.TrimSpace(v))); err != nil { + log.Fatalf("cannot interpret %q: %v", kernelOverflowgidPath, err) + } + + if v, err := os.ReadFile(kernelCapLastCapPath); err != nil { + log.Fatalf("cannot read %q: %v", kernelCapLastCapPath, err) + } else if kernelCapLastCap, err = strconv.Atoi(string(bytes.TrimSpace(v))); err != nil { + log.Fatalf("cannot interpret %q: %v", kernelCapLastCapPath, err) + } +} + +func OverflowUid() int { sysctlOnce.Do(mustReadSysctl); return kernelOverflowuid } +func OverflowGid() int { sysctlOnce.Do(mustReadSysctl); return kernelOverflowgid } +func LastCap() uintptr { sysctlOnce.Do(mustReadSysctl); return uintptr(kernelCapLastCap) } -- cgit v1.3.1