Skip to content

CFE-3429: Use current process ID to investigate proc filesystem to workaround in-container non-root owned symlinks (3.24) #5780

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 5 commits into
base: 3.24.x
Choose a base branch
from
Draft

CFE-3429: Use current process ID to investigate proc filesystem to workaround in-container non-root owned symlinks (3.24) #5780

wants to merge 5 commits into from

Conversation

craigcomstock
Copy link
Contributor

  • Use current process ID to investigate proc filesystem to workaround in-container non-root owned symlinks
  • Added error message when netstat file is not found during UNIX interface discovery.
  • Move GetRelocatedProcdirRoot() from libntech and add GetProcdirPid()
  • Added env var pid override in proc-net acceptance test To align with change to reading /proc//...
  • bump libntech to master

Jakob Riepler and others added 5 commits April 23, 2025 14:53
@craigcomstock
Use current process ID to investigate proc filesystem to workaround i…
600363e 
…n-container non-root owned symlinks

Note man 5 proc mentions how the symlinks work:

       /proc/self
              When a process accesses this magic symbolic link, it resolves to the process's own /proc/pid directory.

and also:

              With  the  advent  of network namespaces, various information relating to the network stack is virtualized (see net‐
              work_namespaces(7)).  Thus, since Linux 2.6.25, /proc/net is a symbolic link to the directory /proc/self/net,  which
              contains  the  same files and directories as listed below.  However, these files and directories now expose informa‐
              tion for the network namespace of which the process is a member.

So this change seems like a good workaround for linux systems and CFEngine's requirement that symlinks be owned by the running pid.

Ticket: CFE-3429
Changelog: title
Signed-off-by: Craig Comstock <[email protected]>
(cherry picked from commit 031972b)
@craigcomstock
Added error message when netstat file is not found during UNIX interf…
8411fb3 
…ace discovery.

Ticket: CFE-3429
Changelog: none
(cherry picked from commit 8441e84)
@craigcomstock
Move GetRelocatedProcdirRoot() from libntech and add GetProcdirPid()
7b993f2 
These have checks for environment variables to override to support testing.

Ticket: CFE-3429
Changelog: none
(cherry picked from commit 628055f)
@craigcomstock
Added env var pid override in proc-net acceptance test
ab27283 
To align with change to reading /proc/<pid>/...

Ticket: CFE-3429
Changelog: none
(cherry picked from commit 8470d79)
@craigcomstock
bump libntech to master
5811870
@craigcomstock craigcomstock mentioned this pull request Apr 23, 2025
Merged
@cf-bottom
Copy link

Thanks for submitting a pull request! Maybe @larsewi can review this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
after-release
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@craigcomstock @cf-bottom