feat: Add namespace isolation support for proxy processes

e2e/runtime_test.go

@@ -128,6 +128,48 @@ func TestRuntimeWriteProcessPid(t *testing.T) {
 	assertFileContent(t, pidFilePath, fmt.Sprintf("%d", pid))
 }
 
+func TestRuntimeProxyKeepsHostNamespaceWhenNotRoot(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("this test must be run as non-root")
+	}
+	rootDir := t.TempDir()
+	remoteprocName := "a-lovely-blue-device"
+	sim := remoteproc.NewSimulator(rootDir).WithName(remoteprocName)
+	if err := sim.Start(); err != nil {
+		t.Fatalf("failed to run simulator: %s", err)
+	}
+	defer func() { _ = sim.Stop() }()
+
+	bin, err := repo.BuildRuntimeBin(t.TempDir(), rootDir, nil)
+	require.NoError(t, err)
+
+	const containerName = "good-looking-container"
+	bundlePath := t.TempDir()
+
+	require.NoError(t, generateBundle(
+		bundlePath,
+		remoteprocName,
+		specs.LinuxNamespace{Type: specs.MountNamespace},
+	))
+
+	_, err = invokeRuntime(bin, "create", "--bundle", bundlePath, containerName)
+	require.NoError(t, err)
+	defer func() {
+		_, _ = invokeRuntime(bin, "delete", containerName)
+	}()
+
+	state, err := getContainerState(bin, containerName)
+	require.NoError(t, err)
+	require.Greater(t, state.Pid, 0)
+
+	hostMountNS, err := os.Readlink("/proc/self/ns/mnt")
+	require.NoError(t, err)
+	proxyMountNS, err := os.Readlink(fmt.Sprintf("/proc/%d/ns/mnt", state.Pid))
+	require.NoError(t, err)
+
+	assert.Equal(t, hostMountNS, proxyMountNS)
+}
+
 func assertContainerStatus(t testing.TB, bin repo.RuntimeBin, containerName string, wantStatus specs.ContainerState) {
 	t.Helper()
 	state, err := getContainerState(bin, containerName)
@@ -156,7 +198,7 @@ func getContainerState(bin repo.RuntimeBin, containerName string) (specs.State,
 	return state, nil
 }
 
-func generateBundle(targetDir string, remoteprocName string) error {
+func generateBundle(targetDir string, remoteprocName string, namespaces ...specs.LinuxNamespace) error {
 	const bundleRoot = "rootfs"
 	const firmwareName = "hello_world.elf"
 
@@ -179,6 +221,7 @@ func generateBundle(targetDir string, remoteprocName string) error {
 		Annotations: map[string]string{
 			"remoteproc.name": remoteprocName,
 		},
+		Linux: &specs.Linux{Namespaces: namespaces},
 	}
 
 	specPath := filepath.Join(targetDir, "config.json")

internal/proxy/proxy.go

@@ -5,17 +5,75 @@ import (
 	"os"
 	"os/exec"
 	"syscall"
+
+	"github.com/opencontainers/runtime-spec/specs-go"
+	"golang.org/x/sys/unix"
 )
 
-func NewProcess(devicePath string) (int, error) {
+var namespaceFlags = map[specs.LinuxNamespaceType]uintptr{
+	specs.CgroupNamespace:  unix.CLONE_NEWCGROUP,
+	specs.IPCNamespace:     unix.CLONE_NEWIPC,
+	specs.MountNamespace:   unix.CLONE_NEWNS,
+	specs.NetworkNamespace: unix.CLONE_NEWNET,
+	specs.PIDNamespace:     unix.CLONE_NEWPID,
+	specs.TimeNamespace:    unix.CLONE_NEWTIME,
+	specs.UserNamespace:    unix.CLONE_NEWUSER,
+	specs.UTSNamespace:     unix.CLONE_NEWUTS,
+}
+
+var namespaceCloneFlagsFn = namespaceCloneFlags
+
+func namespaceCloneFlags(spec *specs.Spec) (uintptr, error) {
+	if spec == nil {
+		return 0, nil
+	}
+
+	var flags uintptr
+	for _, ns := range spec.Linux.Namespaces {
+		if ns.Path != "" {
+			continue
+		}
+		flag, ok := namespaceFlags[ns.Type]
+		if !ok {
+			return 0, fmt.Errorf("unknown namespace type %q", ns.Type)
+		}
+		flags |= flag
+	}
+	return flags, nil
+}
+
+func effectiveNamespaceFlags(isRoot bool, spec *specs.Spec) (uintptr, error) {
+	flags, err := namespaceCloneFlagsFn(spec)
+	if err != nil {
+		return 0, err
+	}
+
+	if !isRoot {
+		if flags != 0 {
+			fmt.Fprintln(os.Stderr, "[WARN] running non-root; namespace isolation disabled")
+		}
+		return 0, nil
+	}
+
+	return flags, nil
+}
+
+func NewProcess(spec *specs.Spec, devicePath string) (int, error) {
 	execPath, err := os.Executable()
 	if err != nil {
 		return -1, fmt.Errorf("failed to get executable path: %w", err)
 	}
 
+	isRoot := os.Geteuid() == 0
+	namespaceFlags, err := effectiveNamespaceFlags(isRoot, spec)
+	if err != nil {
+		return -1, err
+	}
+
 	cmd := exec.Command(execPath, "proxy", "--device-path", devicePath)
 	cmd.SysProcAttr = &syscall.SysProcAttr{
-		Setpgid: true,
+		Setpgid:    true,
+		Cloneflags: namespaceFlags,
 	}
 
 	if err := cmd.Start(); err != nil {

internal/proxy/proxy_test.go

@@ -0,0 +1,110 @@
+package proxy
+
+import (
+	"errors"
+	"io"
+	"os"
+	"testing"
+
+	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/stretchr/testify/assert"
+	"golang.org/x/sys/unix"
+)
+
+func stubNamespaceCloneFlags(t *testing.T, fn func(*specs.Spec) (uintptr, error)) {
+	t.Helper()
+	original := namespaceCloneFlagsFn
+	namespaceCloneFlagsFn = fn
+	t.Cleanup(func() {
+		namespaceCloneFlagsFn = original
+	})
+}
+
+func TestNamespaceCloneFlags(t *testing.T) {
+	t.Run("returns zero when spec is nil", func(t *testing.T) {
+		got, err := namespaceCloneFlags(nil)
+
+		assert.NoError(t, err)
+		assert.Equal(t, uintptr(0), got)
+	})
+
+	t.Run("marks for creation namespaces where paths are not provided", func(t *testing.T) {
+		spec := &specs.Spec{
+			Linux: &specs.Linux{
+				Namespaces: []specs.LinuxNamespace{
+					{Type: specs.NetworkNamespace},
+					{Type: specs.PIDNamespace, Path: "/proc/self/ns/pid"},
+					{Type: specs.UTSNamespace},
+				},
+			},
+		}
+
+		got, err := namespaceCloneFlags(spec)
+
+		assert.NoError(t, err)
+		want := uintptr(unix.CLONE_NEWNET | unix.CLONE_NEWUTS)
+		assert.Equal(t, want, got)
+	})
+
+	t.Run("errors with unknown namespace types", func(t *testing.T) {
+		spec := &specs.Spec{
+			Linux: &specs.Linux{
+				Namespaces: []specs.LinuxNamespace{
+					{Type: specs.LinuxNamespaceType("unknown")},
+				},
+			},
+		}
+
+		_, err := namespaceCloneFlags(spec)
+
+		assert.Error(t, err)
+		assert.Equal(t, "unknown namespace type \"unknown\"", err.Error())
+	})
+}
+
+func TestEffectiveNamespaceFlags(t *testing.T) {
+	t.Run("returns clone flags when running as root", func(t *testing.T) {
+		stubNamespaceCloneFlags(t, func(spec *specs.Spec) (uintptr, error) {
+			return 0x1507, nil
+		})
+
+		got, err := effectiveNamespaceFlags(true, &specs.Spec{})
+
+		assert.NoError(t, err)
+		assert.Equal(t, uintptr(0x1507), got)
+	})
+
+	t.Run("warns and does not set namespace if root is not set but flags are given", func(t *testing.T) {
+		stubNamespaceCloneFlags(t, func(spec *specs.Spec) (uintptr, error) {
+			return 0x2, nil
+		})
+
+		stderr := os.Stderr
+		reader, writer, err := os.Pipe()
+		assert.NoError(t, err)
+		os.Stderr = writer
+		t.Cleanup(func() {
+			os.Stderr = stderr
+		})
+
+		got, err := effectiveNamespaceFlags(false, &specs.Spec{})
+		assert.NoError(t, err)
+		assert.Equal(t, uintptr(0), got)
+
+		assert.NoError(t, writer.Close())
+		out, readErr := io.ReadAll(reader)
+		assert.NoError(t, readErr)
+		assert.Contains(t, string(out), "[WARN] running non-root; namespace isolation disabled")
+		assert.NoError(t, reader.Close())
+	})
+
+	t.Run("propagates namespaceCloneFlags errors", func(t *testing.T) {
+		expected := errors.New("error!")
+		stubNamespaceCloneFlags(t, func(spec *specs.Spec) (uintptr, error) {
+			return 0, expected
+		})
+
+		_, err := effectiveNamespaceFlags(true, &specs.Spec{})
+		assert.ErrorIs(t, err, expected)
+	})
+}

internal/runtime/create.go

@@ -46,7 +46,7 @@ func Create(containerID string, bundlePath string, pidFile string) error {
 		}
 	}()
 
-	pid, err := proxy.NewProcess(devicePath)
+	pid, err := proxy.NewProcess(spec, devicePath)
 	if err != nil {
 		return fmt.Errorf("failed to start proxy process: %w", err)
 	}