Disable runc-dmz by default #4174

rata · 2024-01-18T17:06:06Z

There are several issues that we caught at the last minute. Several maintainers said it seems safer to disable it by default, so let's do that.

runc-dmz is marked as experimental and besides the build tag you need to opt-in with RUNC_DMZ=true to use it.

Future PRs can go further and maybe even remove the buildtag, simplifying the CI (and the time it takes to run).

cc @cyphar @kolyshkin @lifubang

rata · 2024-01-18T17:27:54Z

Grr, there are some github actions that compile with no_dmz, that of course are of no use now. I'll be on PTO starting tomorrow EOD, can someone please pick this up and carry it to the merge line? :)

See dac4171 for what was added by DMZ.

cyphar · 2024-01-18T21:56:50Z

I was about to write a similar PR 😅. I'll close this once I send that one. I'll also be on PTO from next week.

cyphar

To properly switch to making runc-dmz opt-in, more work is needed to remove some of the checks we've added as well as changing the logic of the RUNC_DMZ environment variable.

I will send a patch for this tomorrow.

rata · 2024-01-26T16:50:44Z

@cyphar as you didn't open a PR, I've changed this one to do that. Let me know what you think, and feel free to open a PR that replaces this.

kolyshkin · 2024-01-31T18:47:06Z

tests/integration/run.bats

@@ -127,20 +127,20 @@ function teardown() {
 	[ "${lines[0]}" = "410" ]
 }

-@test "runc run [runc-dmz]" {
-	runc --debug run test_hello
+@test "RUNC_DMZ=true runc run [runc-dmz]" {


Suggested change

@test "RUNC_DMZ=true runc run [runc-dmz]" {

@test "[RUNC_DMZ=true] runc run" {

rata · 2024-02-01T11:38:43Z

Suse mirrors are breaking the github actions, but it was passing all the tests before

rata · 2024-02-01T11:39:18Z

@kolyshkin for some reason I can't answer to your comment, but I've fixed it. PTAL :)

kolyshkin · 2024-02-01T18:27:58Z

@rata @cyphar To me, using both build tag and an env var seems to be an overkill. I think we can drop the build tag entirely (and maybe also as well as selinux compat feature).

rata · 2024-02-02T12:52:00Z

@kolyshkin I agree, that is why I mentioned it in the PR description. But I wouldn't do it in 1.2, as we are introducing the machinery to cross-compile C, just for runc-dmz. I would have the build-tag in case there si an issue (cross-compiling C is not as easy as cross-compiling go) and we haven't ever released with this machinery.

I would keep it, if it fails people can easily avoid it and build anyways (with the same behavior as runc-dmz is disabled by default), we can see the bug reports and fix it without a huge impact as they have other trivial alternatives.

In 1.3 we can remove the build-tag (even if we don't remove runc-dmz) and that is all.

What do you think?

kolyshkin · 2024-02-03T00:04:21Z

we are introducing the machinery to cross-compile C, just for runc-dmz

Maybe I do not understand, what do you mean by "cross-compile"? We compile runc-dmz for the same architecture as the main runc (and we already have some C code in runc, see libcontainer/nsenter). IOW, we do not cross-compile runc-dmz (unless we also cross-compile runc).

Perhaps we can leave runc_nodmz as is, meaning dmz is compiled in and the resulting binary is is dmz-capable by default. If someone is having trouble with compilation because of runc-dmz, they can add runc_nodmz build tag.

The next step is what to do about enabling dmz during runtime. We have agreed that we should have it disabled by default. I'm not sure if using an environment variable is the best way to do that -- I remember @crosbymichael being very against using environment to affect how a command works (but I don't remember why exactly, maybe Michael himself or @thaJeztah can shed some light). But for now, let's say, we want RUNC_DMZ=yes or somesuch to be present in the environment for runc to invoke dmz.

kolyshkin · 2024-02-03T00:06:34Z

Maybe I do not understand, what do you mean by "cross-compile"? We compile runc-dmz for the same architecture as the main runc (and we already have some C code in runc, see libcontainer/nsenter). IOW, we do not cross-compile runc-dmz (unless we also cross-compile runc).

Having said that, yes, we do cross-compile runc ourselves (that includes C stuff in runc-dmz and libct/nsenter) as we want to provide release binaries for multiple architectures. That doesn't mean that most users do it -- I suspect they all compile natively (that's what I'd do).

rata · 2024-02-05T14:06:36Z

But for now, let's say, we want RUNC_DMZ=yes or somesuch to be present in the environment for runc to invoke dmz

@kolyshkin I've updated it to do just that.

rata · 2024-02-09T09:27:12Z

Rebased now that tests should be fixed in main. PTAL

AkihiroSuda · 2024-02-09T15:21:02Z

libcontainer/dmz/dmz_linux.go

-	if os.Getenv("RUNC_DMZ") == "legacy" {
-		logrus.Debugf("RUNC_DMZ=legacy set -- switching back to classic /proc/self/exe cloning")
+	// Only RUNC_DMZ=true enables runc_dmz
+	if os.Getenv("RUNC_DMZ") != "true" {


Can we use strconv.ParseBool

@AkihiroSuda it returns an error which we need to handle and also errors out when parsing "". So, the code becomes a mess for, IMHO, no good reason:

- // Setting RUNC_DMZ=legacy disables this dmz method. - if os.Getenv("RUNC_DMZ") == "legacy" { - logrus.Debugf("RUNC_DMZ=legacy set -- switching back to classic /proc/self/exe cloning") + // Only RUNC_DMZ=true enables runc_dmz + runcDmz := os.Getenv("RUNC_DMZ") + if runcDmz == "" { + logrus.Debugf("RUNC_DMZ is not set -- switching back to classic /proc/self/exe cloning") return nil, ErrNoDmzBinary } + if dmzEnabled, err := strconv.ParseBool(runcDmz); err == nil && !dmzEnabled { + logrus.Debugf("RUNC_DMZ is not true -- switching back to classic /proc/self/exe cloning") + return nil, ErrNoDmzBinary + } else if err != nil { + return nil, fmt.Errorf("parsing RUNC_DMZ: %w", err) + } +

Do you really think it is worth it?

Yes, to allow RUNC_DMZ=1

Updated to do that!

kolyshkin · 2024-02-12T22:48:40Z

tests/integration/exec.bats

@@ -323,14 +323,14 @@ function check_exec_debug() {
 	[ "$status" -eq 0 ]
 }

-@test "RUNC_DMZ=legacy runc exec [execve error]" {
+@test "RUNC_DMZ=false runc exec [execve error]" {


So, why setting RUNC_DMZ=false here if this is the default?

IMHO it seems better to be explicit when the test needs that. If we switch the default later to enabled, it will be painful to realize which tests we need to add the RUNC_DMZ=false.

Not because of failing tests, those are easy fix (although pointless overhead, imho), but cases exactly like this one are the tricky ones, that we want to test it with and without runc_dmz. When we switch the default, we need to find these cases where now we need to disable it. Otherwise test will just pass and we won't be testing that case (we will be testing twice with it enabled, the default and the test requesting it enabled).

But that is my personal preference. I've updated to remove it, to match yours :)

That mistake is very simple to make, I was doing it here 🙈

I've fixed it, but if you decide you prefer the explicit false/true, I have it ready in another branch locally.

Let me know what you think

tests/integration/run.bats

tests/integration/selinux.bats

rata · 2024-02-14T18:11:36Z

@kolyshkin PTAL

AkihiroSuda · 2024-02-28T05:29:18Z

ping @cyphar @kolyshkin PTAL

lifubang · 2024-02-28T11:00:36Z

This PR changes the buildtag from runc_nodmz to runc_dmz, the build-tag is enabled by default but runc-dmz is only used when RUNC_DMZ=true is set.

I see this sentence in your PR description, but I think this is not implemented in your PR. @rata

And there is another small issue in the main branch: https://github.com/opencontainers/runc/blob/main/Makefile#L82 , could you please fix it in this PR as well? It should be:

rm -f runc runc-* libcontainer/dmz/binary/runc-dmz

rata · 2024-02-28T14:43:09Z

I see this sentence in your PR description, but I think this is not implemented in your PR. @rata

Yes, I changed it as @kolyshkin asked. I've updated the PR description to reflect the current state.

And there is another small issue in the main branch: https://github.com/opencontainers/runc/blob/main/Makefile#L82 , could you please fix it in this PR as well? It should be:

Fixed, thanks!

If it is compiled, the user needs to opt-in with this env variable to use it. While we are there, remove the RUNC_DMZ=legacy as that is now the default. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

Signed-off-by: Rodrigo Campos <rodrigo@sdfg.com.ar>

rata · 2024-02-29T15:11:26Z

PTAL @lifubang

rata · 2024-03-06T17:58:13Z

@lifubang @kolyshkin friendly ping?

cyphar · 2024-03-07T04:53:14Z

Since RUNC_DMZ is now opt-in, IMHO we can remove the logic in libcontainer/dmz/selinux*.go. We must keep isDmzBinarySafe because we don't want an environment variable to make containers unsafe, but the compatibility logic isn't necessary if the user is explicitly opting in to the feature IMHO (for the same reason we are not going to add all of the capability-related compatibility code once we make runc-dmz opt-in).

WDYT @AkihiroSuda @kolyshkin?

Aside from that, looks good.

AkihiroSuda · 2024-03-12T04:27:51Z

Can we just merge this, release v1.2.0 RC, and work on refactoring in a follow-up PR?

cyphar

LGTM. I'll submit a separate patch removing the selinux logic...

rata force-pushed the rata/runc-dmz-disable branch 2 times, most recently from 79fd1ba to 6c47543 Compare January 18, 2024 17:20

cyphar requested changes Jan 23, 2024

View reviewed changes

rata force-pushed the rata/runc-dmz-disable branch from 6c47543 to 457c077 Compare January 26, 2024 16:38

rata requested a review from cyphar January 26, 2024 16:49

rata force-pushed the rata/runc-dmz-disable branch 2 times, most recently from c956a0a to d1ca579 Compare January 26, 2024 17:07

kolyshkin reviewed Jan 31, 2024

View reviewed changes

rata force-pushed the rata/runc-dmz-disable branch 3 times, most recently from e07265a to 5073630 Compare February 1, 2024 11:35

rata force-pushed the rata/runc-dmz-disable branch from 5073630 to 48fd3b8 Compare February 1, 2024 16:21

rata force-pushed the rata/runc-dmz-disable branch from 48fd3b8 to eb67815 Compare February 2, 2024 12:52

rata force-pushed the rata/runc-dmz-disable branch from eb67815 to 188e470 Compare February 5, 2024 13:40

rata force-pushed the rata/runc-dmz-disable branch from 188e470 to 51861e5 Compare February 5, 2024 14:06

rata requested a review from kolyshkin February 6, 2024 10:35

rata force-pushed the rata/runc-dmz-disable branch from 51861e5 to 9a6129e Compare February 9, 2024 09:25

rata force-pushed the rata/runc-dmz-disable branch 2 times, most recently from ac795bd to e1477d6 Compare February 9, 2024 13:09

AkihiroSuda reviewed Feb 9, 2024

View reviewed changes

rata force-pushed the rata/runc-dmz-disable branch from e1477d6 to 3df30bd Compare February 9, 2024 17:59

AkihiroSuda approved these changes Feb 9, 2024

View reviewed changes

kolyshkin reviewed Feb 12, 2024

View reviewed changes

tests/integration/run.bats Outdated Show resolved Hide resolved

kolyshkin reviewed Feb 12, 2024

View reviewed changes

tests/integration/run.bats Outdated Show resolved Hide resolved

kolyshkin reviewed Feb 12, 2024

View reviewed changes

tests/integration/selinux.bats Outdated Show resolved Hide resolved

rata force-pushed the rata/runc-dmz-disable branch from 3df30bd to c63f544 Compare February 14, 2024 18:06

rata force-pushed the rata/runc-dmz-disable branch 2 times, most recently from 34cb9c6 to 7630252 Compare February 15, 2024 13:28

rata requested a review from kolyshkin February 15, 2024 13:29

rata added 2 commits February 28, 2024 12:15

libct/dmz: Require RUNC_DMZ=true to opt-in

1dae66f

If it is compiled, the user needs to opt-in with this env variable to use it. While we are there, remove the RUNC_DMZ=legacy as that is now the default. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

contrib/cmd/memfd-bind: Mention runc-dmz needs RUNC_DMZ=true

46b7210

Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>

rata force-pushed the rata/runc-dmz-disable branch from 17797db to 83b4b94 Compare February 28, 2024 15:16

Makefile: Fix runc-dmz removal

fc76b13

Signed-off-by: Rodrigo Campos <rodrigo@sdfg.com.ar>

rata force-pushed the rata/runc-dmz-disable branch from 83b4b94 to fc76b13 Compare February 28, 2024 18:38

lifubang added the status/2-code-review label Mar 4, 2024

cyphar approved these changes Mar 13, 2024

View reviewed changes

cyphar merged commit 1950892 into opencontainers:main Mar 13, 2024
45 checks passed

AkihiroSuda mentioned this pull request Mar 13, 2024

runc-dmz: Inheritable capabilities are dropped when they previously weren't #4125

Closed

cyphar mentioned this pull request Mar 13, 2024

dmz: remove SELinux special-casing #4220

Merged

lifubang mentioned this pull request Mar 14, 2024

fix runc-dmz bin path error in Makefile #4222

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Disable runc-dmz by default #4174

Disable runc-dmz by default #4174

rata commented Jan 18, 2024 •

edited

Loading

rata commented Jan 18, 2024 •

edited

Loading

cyphar commented Jan 18, 2024 •

edited

Loading

cyphar left a comment

rata commented Jan 26, 2024

kolyshkin Jan 31, 2024

rata commented Feb 1, 2024

rata commented Feb 1, 2024

kolyshkin commented Feb 1, 2024

rata commented Feb 2, 2024

kolyshkin commented Feb 3, 2024

kolyshkin commented Feb 3, 2024

rata commented Feb 5, 2024

rata commented Feb 9, 2024

AkihiroSuda Feb 9, 2024

rata Feb 9, 2024 •

edited

Loading

AkihiroSuda Feb 9, 2024

rata Feb 9, 2024

kolyshkin Feb 12, 2024

rata Feb 14, 2024 •

edited

Loading

rata Feb 15, 2024

rata commented Feb 14, 2024

AkihiroSuda commented Feb 28, 2024

lifubang commented Feb 28, 2024

rata commented Feb 28, 2024

rata commented Feb 29, 2024

rata commented Mar 6, 2024

cyphar commented Mar 7, 2024 •

edited

Loading

AkihiroSuda commented Mar 12, 2024

cyphar left a comment •

edited

Loading

	@test "RUNC_DMZ=true runc run [runc-dmz]" {
	@test "[RUNC_DMZ=true] runc run" {

Disable runc-dmz by default #4174

Disable runc-dmz by default #4174

Conversation

rata commented Jan 18, 2024 • edited Loading

rata commented Jan 18, 2024 • edited Loading

cyphar commented Jan 18, 2024 • edited Loading

cyphar left a comment

Choose a reason for hiding this comment

rata commented Jan 26, 2024

kolyshkin Jan 31, 2024

Choose a reason for hiding this comment

rata commented Feb 1, 2024

rata commented Feb 1, 2024

kolyshkin commented Feb 1, 2024

rata commented Feb 2, 2024

kolyshkin commented Feb 3, 2024

kolyshkin commented Feb 3, 2024

rata commented Feb 5, 2024

rata commented Feb 9, 2024

AkihiroSuda Feb 9, 2024

Choose a reason for hiding this comment

rata Feb 9, 2024 • edited Loading

Choose a reason for hiding this comment

AkihiroSuda Feb 9, 2024

Choose a reason for hiding this comment

rata Feb 9, 2024

Choose a reason for hiding this comment

kolyshkin Feb 12, 2024

Choose a reason for hiding this comment

rata Feb 14, 2024 • edited Loading

Choose a reason for hiding this comment

rata Feb 15, 2024

Choose a reason for hiding this comment

rata commented Feb 14, 2024

AkihiroSuda commented Feb 28, 2024

lifubang commented Feb 28, 2024

rata commented Feb 28, 2024

rata commented Feb 29, 2024

rata commented Mar 6, 2024

cyphar commented Mar 7, 2024 • edited Loading

AkihiroSuda commented Mar 12, 2024

cyphar left a comment • edited Loading

Choose a reason for hiding this comment

rata commented Jan 18, 2024 •

edited

Loading

rata commented Jan 18, 2024 •

edited

Loading

cyphar commented Jan 18, 2024 •

edited

Loading

rata Feb 9, 2024 •

edited

Loading

rata Feb 14, 2024 •

edited

Loading

cyphar commented Mar 7, 2024 •

edited

Loading

cyphar left a comment •

edited

Loading