From 420b5eb211f877baac9622e7bedde2948c043619 Mon Sep 17 00:00:00 2001
From: Michael Crosby <michael@crosbymichael.com>
Date: Wed, 19 Feb 2014 19:53:25 -0800
Subject: [PATCH] Add execin function to running a process in a namespace
 Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com>
 (github: crosbymichael)

---
 pkg/libcontainer/container.json     |   2 +-
 pkg/libcontainer/nsinit/execin.go   | 115 ++++++++++++++++++++++++++++
 pkg/libcontainer/nsinit/main.go     |   8 ++
 pkg/libcontainer/nsinit/ns_linux.go |   9 +++
 4 files changed, 133 insertions(+), 1 deletion(-)
 create mode 100644 pkg/libcontainer/nsinit/execin.go

diff --git a/pkg/libcontainer/container.json b/pkg/libcontainer/container.json
index 2abf01adb9..c5807a7b28 100644
--- a/pkg/libcontainer/container.json
+++ b/pkg/libcontainer/container.json
@@ -1,5 +1,5 @@
 {
-    "id": "koye",
+    "hostname": "koye",
     "command": {
         "args": [
             "/bin/bash"
diff --git a/pkg/libcontainer/nsinit/execin.go b/pkg/libcontainer/nsinit/execin.go
new file mode 100644
index 0000000000..362cf5afd5
--- /dev/null
+++ b/pkg/libcontainer/nsinit/execin.go
@@ -0,0 +1,115 @@
+package main
+
+import (
+	"fmt"
+	"github.com/dotcloud/docker/pkg/libcontainer"
+	"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
+	"github.com/dotcloud/docker/pkg/system"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"strconv"
+	"syscall"
+)
+
+func execinCommand(container *libcontainer.Container) (int, error) {
+	nspid, err := readPid()
+	if err != nil {
+		return -1, err
+	}
+
+	for _, ns := range container.Namespaces {
+		if err := system.Unshare(namespaceMap[ns]); err != nil {
+			return -1, err
+		}
+	}
+	fds, err := getNsFds(nspid, container)
+	closeFds := func() {
+		for _, f := range fds {
+			system.Closefd(f)
+		}
+	}
+	if err != nil {
+		closeFds()
+		return -1, err
+	}
+
+	for _, fd := range fds {
+		if fd > 0 {
+			if err := system.Setns(fd, 0); err != nil {
+				closeFds()
+				return -1, fmt.Errorf("setns %s", err)
+			}
+		}
+		system.Closefd(fd)
+	}
+
+	// if the container has a new pid and mount namespace we need to
+	// remount proc and sys to pick up the changes
+	if container.Namespaces.Contains(libcontainer.CLONE_NEWNS) &&
+		container.Namespaces.Contains(libcontainer.CLONE_NEWPID) {
+
+		pid, err := system.Fork()
+		if err != nil {
+			return -1, err
+		}
+		if pid == 0 {
+			// TODO: make all raw syscalls to be fork safe
+			if err := system.Unshare(syscall.CLONE_NEWNS); err != nil {
+				return -1, err
+			}
+			if err := remountProc(); err != nil {
+				return -1, fmt.Errorf("remount proc %s", err)
+			}
+			if err := remountSys(); err != nil {
+				return -1, fmt.Errorf("remount sys %s", err)
+			}
+			if err := capabilities.DropCapabilities(container); err != nil {
+				return -1, fmt.Errorf("drop capabilities %s", err)
+			}
+			if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
+				return -1, err
+			}
+		}
+		proc, err := os.FindProcess(pid)
+		if err != nil {
+			return -1, err
+		}
+		state, err := proc.Wait()
+		if err != nil {
+			return -1, err
+		}
+		os.Exit(state.Sys().(syscall.WaitStatus).ExitStatus())
+	}
+	if err := capabilities.DropCapabilities(container); err != nil {
+		return -1, fmt.Errorf("drop capabilities %s", err)
+	}
+	if err := system.Exec(container.Command.Args[0], container.Command.Args[0:], container.Command.Env); err != nil {
+		return -1, err
+	}
+	panic("unreachable")
+}
+
+func readPid() (int, error) {
+	data, err := ioutil.ReadFile(".nspid")
+	if err != nil {
+		return -1, err
+	}
+	pid, err := strconv.Atoi(string(data))
+	if err != nil {
+		return -1, err
+	}
+	return pid, nil
+}
+
+func getNsFds(pid int, container *libcontainer.Container) ([]uintptr, error) {
+	fds := make([]uintptr, len(container.Namespaces))
+	for i, ns := range container.Namespaces {
+		f, err := os.OpenFile(filepath.Join("/proc/", strconv.Itoa(pid), "ns", namespaceFileMap[ns]), os.O_RDONLY, 0)
+		if err != nil {
+			return fds, err
+		}
+		fds[i] = f.Fd()
+	}
+	return fds, nil
+}
diff --git a/pkg/libcontainer/nsinit/main.go b/pkg/libcontainer/nsinit/main.go
index c9f9d7bc8f..8fe700e064 100644
--- a/pkg/libcontainer/nsinit/main.go
+++ b/pkg/libcontainer/nsinit/main.go
@@ -37,6 +37,14 @@ func main() {
 		if err := initCommand(container, os.Args[2]); err != nil {
 			log.Fatal(err)
 		}
+	case "execin":
+		exitCode, err := execinCommand(container)
+		if err != nil {
+			log.Fatal(err)
+		}
+		os.Exit(exitCode)
+	default:
+		log.Fatalf("command not supported for nsinit %s", os.Args[1])
 	}
 }
 
diff --git a/pkg/libcontainer/nsinit/ns_linux.go b/pkg/libcontainer/nsinit/ns_linux.go
index 2392ffd770..a2809eb199 100644
--- a/pkg/libcontainer/nsinit/ns_linux.go
+++ b/pkg/libcontainer/nsinit/ns_linux.go
@@ -14,6 +14,15 @@ var namespaceMap = map[libcontainer.Namespace]int{
 	libcontainer.CLONE_NEWNET:  syscall.CLONE_NEWNET,
 }
 
+var namespaceFileMap = map[libcontainer.Namespace]string{
+	libcontainer.CLONE_NEWNS:   "mnt",
+	libcontainer.CLONE_NEWUTS:  "uts",
+	libcontainer.CLONE_NEWIPC:  "ipc",
+	libcontainer.CLONE_NEWUSER: "user",
+	libcontainer.CLONE_NEWPID:  "pid",
+	libcontainer.CLONE_NEWNET:  "net",
+}
+
 // getNamespaceFlags parses the container's Namespaces options to set the correct
 // flags on clone, unshare, and setns
 func getNamespaceFlags(namespaces libcontainer.Namespaces) (flag int) {