fix(sandbox): undo tmpfs overlay when setns fails during SPIFFE mount namespace setup#2184
Open
zanetworker wants to merge 1 commit into
Open
Conversation
zanetworker
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
Collaborator
|
/ok to test bec39d9 |
… namespace setup On OpenShift and other container runtimes that do not grant CAP_SYS_ADMIN, setns(CLONE_NEWNS) fails with EPERM after create_supervisor_identity_mount_namespace has already mounted an empty tmpfs over the SPIFFE workload API socket directory. PID 1 remains stuck in the new mount namespace where the tmpfs hides the socket, making it invisible to all processes. Fix: when setns() fails, call umount2(MNT_DETACH) to remove the tmpfs overlay before returning the error, so the SPIFFE socket stays accessible even without namespace isolation. Also wire up prepare_supervisor_identity_mount_namespace_from_env in main.rs and make it gracefully degrade on error instead of aborting the supervisor. Additionally, the mount namespace manipulation can corrupt the kernel's /proc/self/exe resolution, causing it to return the init container's binary path (e.g. /openshell-sandbox) instead of the agent container's exec path. The proxy's ancestor integrity check stats this path on every request and denies all traffic when the file doesn't exist. After the mount namespace setup, create a symlink from the stale path to the real binary so the integrity check passes. Signed-off-by: Adel Zaalouk <azaalouk@redhat.com>
zanetworker
force-pushed
the
fix/spiffe-mount-namespace-setns-eperm
branch
from
bec39d9 to
4d0c97a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
setns(CLONE_NEWNS)fails withEPERM(common on OpenShift and hardened K8s withoutCAP_SYS_ADMIN),create_supervisor_identity_mount_namespaceleaves an empty tmpfs mounted over the SPIFFE workload API socket directory. Since PID 1 is stuck in the new mount namespace, the socket becomes invisible to all processes in the container, even though the CSI volume is healthy.umount2(MNT_DETACH)in thesetns()error path to remove the tmpfs overlay before returning, keeping the SPIFFE socket accessible.prepare_supervisor_identity_mount_namespace_from_envcall inmain.rsand makes it gracefully degrade (warn + continue) instead of aborting the supervisor on error.Related Issue
N/A (discovered during SPIFFE + token grant integration testing on OpenShift)
Changes
crates/openshell-supervisor-process/src/process.rs:create_supervisor_identity_mount_namespace: onsetns()failure,umount2(target, MNT_DETACH)before returning errorprepare_supervisor_identity_mount_namespace_from_env: catch errors, log warning, set namespace toNone, continuecrates/openshell-sandbox/src/main.rs: callprepare_supervisor_identity_mount_namespace_from_env()before tracing setupTesting
/spiffe-workload-api/spire-agent.sockis visible inside sandbox containercargo test --workspace)Checklist
cargo fmtcleancargo clippyclean