mountfd 0.1.0

data/sig/mountfd.rbs

@@ -0,0 +1,119 @@
+module Mountfd
+  VERSION: String
+  AT_FDCWD: Integer
+
+  class Error < StandardError
+  end
+
+  class UnsupportedError < Error
+  end
+
+  class ConfigError < Error
+    attr_reader diagnostics: Array[Diagnostic]
+    def initialize: (String message, ?Array[Diagnostic] diagnostics) -> void
+  end
+
+  class MountError < ConfigError
+  end
+
+  class IdmapError < Error
+  end
+
+  class Diagnostic
+    attr_reader level: :error | :warning | :info
+    attr_reader text: String
+    def self.parse: (String raw) -> Array[Diagnostic]
+    def to_s: () -> String
+  end
+
+  module Attributes
+    def self.build: (Hash[Symbol | String, untyped] attributes) -> [Integer, Integer]
+    def self.flags: (Integer | Array[Symbol | String] names) -> Integer
+    def self.propagation: (Symbol | String | nil value) -> Integer
+  end
+
+  class FsContext
+    attr_reader diagnostics: Array[Diagnostic]
+    def self.open: [T] (String filesystem, ?flags: Integer) { (FsContext) -> T } -> T
+                 | (String filesystem, ?flags: Integer) -> FsContext
+    def self.pick: (String path, ?flags: Integer) -> FsContext
+    def initialize: (String filesystem, ?flags: Integer, ?handle: untyped) -> void
+    def fileno: () -> Integer
+    def closed?: () -> bool
+    def warnings: () -> Array[Diagnostic]
+    def set: (String | Symbol key, ?untyped value) -> FsContext
+    def set_flag: (String | Symbol key) -> FsContext
+    def set_path: (String | Symbol key, String path, ?dfd: Integer) -> FsContext
+    def set_fd: (String | Symbol key, _Fileno io) -> FsContext
+    def set_binary: (String | Symbol key, String bytes) -> FsContext
+    def create!: (?exclusive: bool) -> FsContext
+    def reconfigure!: () -> FsContext
+    def mount: (?attrs: Hash[Symbol, untyped]) -> DetachedMount
+    def close: () -> nil
+  end
+
+  interface _Fileno
+    def fileno: () -> Integer
+  end
+
+  class DetachedMount
+    def fileno: () -> Integer
+    def closed?: () -> bool
+    def discard: () -> nil
+    def close: () -> nil
+    def set_attributes: (?set: Integer | Array[Symbol], ?clr: Integer | Array[Symbol], ?propagation: Symbol?, ?idmap: _Fileno?, ?recursive: bool) -> DetachedMount
+    def idmap!: (_Fileno userns) -> DetachedMount
+    def attach: (String path, ?beneath: bool) -> AttachedMount
+  end
+
+  class AttachedMount
+    attr_reader path: String
+  end
+
+  class UserNamespace
+    def self.create: (?uid: untyped, ?gid: untyped, ?helper: :auto | bool) -> UserNamespace
+    def self.from_pid: (Integer pid) -> UserNamespace
+    def self.from_path: (String path) -> UserNamespace
+    def self.normalize: (untyped mapping) -> Array[[Integer, Integer, Integer]]
+    def fileno: () -> Integer
+    def closed?: () -> bool
+    def close: () -> nil
+  end
+
+  class MountInfo
+    attr_reader mnt_id: Integer
+    attr_reader parent_id: Integer
+    attr_reader mnt_root: String
+    attr_reader mount_point: String
+    attr_reader fs_type: String
+    attr_reader source: String?
+    attr_reader options: Array[String]
+    attr_reader propagation: Hash[Symbol, Integer | bool]
+    attr_reader attrs: Array[Symbol]
+    attr_reader dev_major: Integer
+    attr_reader dev_minor: Integer
+    def idmapped?: () -> bool
+    def readonly?: () -> bool
+  end
+
+  module Namespace
+    def self.reexec_user!: () -> nil
+    def self.unshare_mount!: (?propagation: :private | nil) -> nil
+    def self.unshare_user!: (?map_root: bool) -> nil
+  end
+
+  def self.supported?: () -> bool
+  def self.features: () -> Array[Symbol]
+  def self.pending_mounts: () -> Array[DetachedMount]
+  def self.open_tree: [T] (String path, ?recursive: bool) { (DetachedMount) -> T } -> T
+                    | (String path, ?recursive: bool) -> DetachedMount
+  def self.mount: (String source, String target, ?type: String, ?options: Hash[Symbol | String, untyped], ?attrs: Hash[Symbol, untyped]) -> AttachedMount
+  def self.bind: (String source, String target, ?recursive: bool, ?attrs: Hash[Symbol, untyped], ?idmap: UserNamespace | Hash[Symbol, untyped]?) -> AttachedMount
+  def self.umount: (String path, ?detach: bool, ?force: bool) -> nil
+  def self.pivot_root: (String new_root, String put_old) -> nil
+  def self.set_attributes: (String path, ?attrs: Hash[Symbol, untyped], ?propagation: Symbol?, ?recursive: bool) -> nil
+  def self.replace: (String path) { () -> DetachedMount } -> AttachedMount
+  def self.mounts: (?ns: (Integer | _Fileno)?, ?backend: :statmount | :mountinfo) -> Array[MountInfo]
+  def self.mounts_backend: () -> (:statmount | :mountinfo)
+  def self.mount_at: (String path, ?ns: (Integer | _Fileno)?, ?backend: :statmount | :mountinfo) -> MountInfo?
+end

data/tools/dump_constants.c

@@ -0,0 +1,54 @@
+#include "compat.h"
+#include <stdio.h>
+
+#define DUMP(name) printf(#name "=%llu\n", (unsigned long long)(name))
+
+int main(void)
+{
+    DUMP(FSOPEN_CLOEXEC);
+    DUMP(FSPICK_CLOEXEC);
+    DUMP(FSPICK_SYMLINK_NOFOLLOW);
+    DUMP(FSPICK_NO_AUTOMOUNT);
+    DUMP(FSPICK_EMPTY_PATH);
+    DUMP(FSCONFIG_SET_FLAG);
+    DUMP(FSCONFIG_SET_STRING);
+    DUMP(FSCONFIG_SET_BINARY);
+    DUMP(FSCONFIG_SET_PATH);
+    DUMP(FSCONFIG_SET_PATH_EMPTY);
+    DUMP(FSCONFIG_SET_FD);
+    DUMP(FSCONFIG_CMD_CREATE);
+    DUMP(FSCONFIG_CMD_RECONFIGURE);
+    DUMP(FSCONFIG_CMD_CREATE_EXCL);
+    DUMP(FSMOUNT_CLOEXEC);
+    DUMP(OPEN_TREE_CLONE);
+    DUMP(OPEN_TREE_CLOEXEC);
+    DUMP(MOVE_MOUNT_F_SYMLINKS);
+    DUMP(MOVE_MOUNT_F_AUTOMOUNTS);
+    DUMP(MOVE_MOUNT_F_EMPTY_PATH);
+    DUMP(MOVE_MOUNT_T_SYMLINKS);
+    DUMP(MOVE_MOUNT_T_AUTOMOUNTS);
+    DUMP(MOVE_MOUNT_T_EMPTY_PATH);
+    DUMP(MOVE_MOUNT_SET_GROUP);
+    DUMP(MOVE_MOUNT_BENEATH);
+    DUMP(MOUNT_ATTR_RDONLY);
+    DUMP(MOUNT_ATTR_NOSUID);
+    DUMP(MOUNT_ATTR_NODEV);
+    DUMP(MOUNT_ATTR_NOEXEC);
+    DUMP(MOUNT_ATTR__ATIME);
+    DUMP(MOUNT_ATTR_RELATIME);
+    DUMP(MOUNT_ATTR_NOATIME);
+    DUMP(MOUNT_ATTR_STRICTATIME);
+    DUMP(MOUNT_ATTR_NODIRATIME);
+    DUMP(MOUNT_ATTR_IDMAP);
+    DUMP(MOUNT_ATTR_NOSYMFOLLOW);
+    DUMP(AT_RECURSIVE);
+    DUMP(AT_EMPTY_PATH);
+    DUMP(MS_UNBINDABLE);
+    DUMP(MS_REC);
+    DUMP(MS_PRIVATE);
+    DUMP(MS_SLAVE);
+    DUMP(MS_SHARED);
+    DUMP(CLONE_NEWNS);
+    DUMP(CLONE_NEWUSER);
+    return 0;
+}

data/tools/generate_constants.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+
+abort "Linux headers are required" unless RUBY_PLATFORM.include?("linux")
+
+root = File.expand_path("..", __dir__)
+values = Dir.mktmpdir do |directory|
+  executable = File.join(directory, "dump_constants")
+  command = [ENV.fetch("CC", "cc"), "-I#{File.join(root, "ext/mountfd")}",
+             File.join(__dir__, "dump_constants.c"), "-o", executable]
+  abort "failed to compile constant dumper" unless system(*command)
+
+  IO.popen([executable], &:read)
+end
+
+definitions = values.lines(chomp: true).map do |line|
+  name, value = line.split("=", 2)
+  %(    DEF("#{name}", #{value}ULL);)
+end.join("\n")
+
+File.write(File.join(root, "ext/mountfd/constants.c"), <<~C)
+  /* Generated by tools/generate_constants.rb from Linux UAPI headers. */
+  #include "ruby.h"
+
+  void mountfd_define_constants(VALUE native)
+  {
+  #define DEF(name, value) rb_define_const(native, name, ULL2NUM(value))
+  #{definitions}
+  #undef DEF
+  }
+C

data/tools/research_idmap.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "mountfd"
+
+abort "Linux is required" unless Mountfd::Native.linux?
+
+Mountfd::Namespace.reexec_user!
+Mountfd::Namespace.unshare_mount!
+namespace = nil
+begin
+  namespace = Mountfd::UserNamespace.create(helper: false)
+  # ponytail: arbitrary nodev probes can block in get_tree; extend this list
+  # only with filesystems proven to be source-free in an isolated VM.
+  filesystems = %w[tmpfs ramfs hugetlbfs] & File.read("/proc/filesystems").split
+
+  puts "| filesystem | idmap |"
+  puts "|---|---|"
+  filesystems.each do |filesystem|
+    supported = false
+    mount = nil
+    begin
+      Mountfd::FsContext.open(filesystem) do |context|
+        context.create!
+        mount = context.mount
+        mount.idmap!(namespace)
+        supported = true
+      end
+    rescue Mountfd::Error, SystemCallError
+      # A source-free probe cannot configure every filesystem.
+    ensure
+      mount&.discard unless mount&.closed?
+    end
+    puts "| #{filesystem} | #{supported ? 'yes' : 'no/unavailable'} |"
+  end
+ensure
+  namespace&.close
+end

data/tools/vm/Makefile

@@ -0,0 +1,8 @@
+KVER ?= 6.12.20
+
+.PHONY: all test
+all: test
+
+test:
+	command -v vng >/dev/null
+	KVER=$(KVER) ./run.sh

data/tools/vm/config-fragment

@@ -0,0 +1,7 @@
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_USERFAULTFD=y
+CONFIG_BLK_DEV_UBLK=y
+CONFIG_PSI=y

data/tools/vm/run.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+set -eu
+
+cd -- "$(dirname -- "$0")/../.."
+
+kernel_version=${KVER:-6.12.20}
+bundle exec rake compile
+
+set -- env MOUNTFD_SYSTEM=1 MOUNTFD_MATRIX=1 RSPEC_STATUS_PATH=/tmp/mountfd-rspec-status
+if [ -n "${GEM_HOME:-}" ]; then
+  set -- "$@" "GEM_HOME=$GEM_HOME" "GEM_PATH=${GEM_PATH:-$GEM_HOME}"
+fi
+set -- "$@" bundle exec rspec spec/system/mountfd_system_spec.rb
+
+case "$kernel_version" in
+  5.10*) exec vng -v -r "v${kernel_version}" -a psi=0 -- "$@" ;;
+  *) exec vng -v -r "v${kernel_version}" -- "$@" ;;
+esac

metadata

@@ -0,0 +1,118 @@
+--- !ruby/object:Gem::Specification
+name: mountfd
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Yudai Takada
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake-compiler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rbs
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+- !ruby/object:Gem::Dependency
+  name: yard
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+description: Build, configure, inspect, and attach Linux mounts as file descriptors.
+email:
+- t.yudai92@gmail.com
+executables: []
+extensions:
+- ext/mountfd/extconf.rb
+extra_rdoc_files: []
+files:
+- LICENSE.txt
+- README.md
+- Rakefile
+- benchmark/mounts.rb
+- docs/kernel-notes.md
+- examples/atomic_swap.rb
+- examples/idmapped_volume.rb
+- examples/mini_container.rb
+- examples/readonly_sandbox.rb
+- ext/mountfd/compat.h
+- ext/mountfd/constants.c
+- ext/mountfd/extconf.rb
+- ext/mountfd/mount_info.c
+- ext/mountfd/mountfd.c
+- ext/mountfd/mountfd.h
+- ext/mountfd/namespace.c
+- ext/mountfd/user_namespace.c
+- lib/mountfd.rb
+- lib/mountfd/attributes.rb
+- lib/mountfd/core.rb
+- lib/mountfd/mount_info.rb
+- lib/mountfd/namespace.rb
+- lib/mountfd/user_namespace.rb
+- lib/mountfd/version.rb
+- sig/mountfd.rbs
+- tools/dump_constants.c
+- tools/generate_constants.rb
+- tools/research_idmap.rb
+- tools/vm/Makefile
+- tools/vm/config-fragment
+- tools/vm/run.sh
+homepage: https://github.com/ydah/mountfd#readme
+licenses:
+- MIT
+metadata:
+  allowed_push_host: https://rubygems.org
+  homepage_uri: https://github.com/ydah/mountfd#readme
+  source_code_uri: https://github.com/ydah/mountfd
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.19
+specification_version: 4
+summary: Ruby bindings for the Linux file-descriptor mount API
+test_files: []