README
¶
nsenter
Credits
This package was taken from runc and adapted for the needs of the seccomp agent.
Source: https://github.com/opencontainers/runc/blob/master/libcontainer/nsenter/README.md
How does it work?
The nsenter package registers a special init constructor that is called before
the Go runtime has a chance to boot. This provides us the ability to setns on
existing namespaces and avoid the issues that the Go runtime has with multiple
threads. This constructor will be called if this package is registered,
imported, in your go application.
The nsenter package will import "C" and it uses cgo
package. In cgo, if the import of "C" is immediately preceded by a comment, that comment,
called the preamble, is used as a header when compiling the C parts of the package.
So every time we import package nsenter, the C code function nsexec() would be
called.
Because nsexec() must be run before the Go runtime in order to use the
Linux kernel namespace, you must import this library into a package if
you plan to use libcontainer directly. Otherwise Go will not execute
the nsexec() constructor, which means that the re-exec will not cause
the namespaces to be joined.
Documentation
¶
Index ¶
- func Init()
- func OpenCwd(pid uint32) (*os.File, error)
- func OpenNamespace(pid uint32, nstype string) (*os.File, error)
- func OpenRoot(pid uint32) (*os.File, error)
- func RegisterModule(name string, f RunFunc) bool
- func Run(root, cwd, mntns, netns, pidns *os.File, i interface{}) ([]byte, error)
- type ModuleXXX
- type RunFunc
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Init ¶
func Init()
Init checks if the process has re-executed itself and must run a registered module. Init() needs to be called explicitely from main() to ensure it is called after all other init() functions.
func OpenCwd ¶
OpenCwd opens a /proc/pid/cwd file. It is done separately to Run() so that the caller can call libseccomp.NotifIDValid() in between.
func OpenNamespace ¶
OpenNamespaces opens a namespace file. It is done separately to Run() so that the caller can call libseccomp.NotifIDValid() in between.
func OpenRoot ¶
OpenRoot opens a /proc/pid/root file. It is done separately to Run() so that the caller can call libseccomp.NotifIDValid() in between.
Source Files