0

I wish to run a docker container which runs a single os process, forks a clone of itself through invoking '/proc/self/exe'. This process will be launched by a user of the container, who may be a system or login user (whichever is more secure). To this end I believe I require a process run from a file with the CLONE_NEWUTS bit set, or for the process to be started by a superuser.

I do not wish to use a sudo capable user, nor do I wish to set the CAP_SYS_ADMIN bit on the file, as the CLONE_NEWUTS bit does not have a specific capability.

Here is some code:

package main

import (
  "os"
  "os/exec"
  "syscall"
  "fmt"
)

func main() {
  // this would not be a main, it would be a process listening on a channel piped into from serveHTTP
  switch os.Args[1] {
  case "run":
    run()
  case "child":
    child()
  default:
    panic("Unknown command")
  }
}

func run() {
  // fork a _clone_ process off in the command (execute the self process)
  cmd := exec.Command("/proc/self/exe", append([]string{"child"}, os.Args[2:]...)...)
  cmd.Stdin = os.Stdin
  cmd.Stdout = os.Stdout
  cmd.Stderr = os.Stderr
  cmd.SysProcAttr = &syscall.SysProcAttr{
    Cloneflags:  syscall.CLONE_NEWUTS | syscall.CLONE_NEWPID,
  }

  if err := cmd.Run(); err != nil {
    panic(err)
  }
}

func child() {
  // this would be one of the action functions
  fmt.Printf("running %v as %v\n", os.Args[2:], os.Getpid())

  cmd := exec.Command(os.Args[2], os.Args[3:]...)
  cmd.Stdin = os.Stdin
  cmd.Stdout = os.Stdout
  cmd.Stderr = os.Stderr
  if err := cmd.Run(); err != nil {
    panic(err)
  }
}

It's taken from a great talk and I can't find the link right now, it's on another machine's history.

In this incorrectly worded question: Allow a non-super-user run process to fork and clone itself (probably duplicate) @sourcejedi has partially illuminated me to the above issues with my plan.

  • 1
    The code is a better attempt to provide some redundancy. The code would be on-topic for this site if you were asking about some system calls in a C program, or possibly something very very close to how C would do it. Go doesn't count, sorry, Go v.s. clone flags is a whole thing due to "green threads", we don't speak that language here. – sourcejedi Apr 28 at 21:29
  • 1
    This is still really confusing. It doesn't explain why you want to hide the processes, it doesn't explain why you want to use a UTS namespace - which basically only lets you change the hostname!, it doesn't explain why you need those two namespaces to be isolated but none of the others. You could try deleting this and posting with code on StackOverflow.com, but they're busier & get very impatient playing 20 questions in the comments. – sourcejedi Apr 28 at 21:38
  • I understand, @sourcejedi, I will endeavour to ask a better question when I grok my issues, but I think it does belong in SE as I am hitting permissions/capabilities issues, not code issues. This MWE runs and works if run as su. Apologies, and many thanks again. – MarkJL Apr 28 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.