technocloud-public/nginx-unit
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
2,401 Commits 1 Branch 0 Tags
1a31863f8295182ca66aa96a9438ca947ce84aba
Commit Graph

7 Commits

Author SHA1 Message Date
Andrew Clayton
1388d311c6 Isolation: Remove nxt_clone(). 
Since the previous commit, this is no longer used.

Reviewed-by: Alejandro Colomar <alx@nginx.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
 2023-02-17 21:24:18 +00:00
Andrew Clayton
3ecdd2c69c Isolation: Rename NXT_HAVE_CLONE -> NXT_HAVE_LINUX_NS. 
Due to the need to replace our use of clone/__NR_clone on Linux with
fork(2)/unshare(2) for enabling Linux namespaces(7) to keep the
pthreads(7) API working.  Let's rename NXT_HAVE_CLONE to
NXT_HAVE_LINUX_NS, i.e name it after the feature, not how it's
implemented, then in future if we change how we do namespaces again we
don't have to rename this.

Reviewed-by: Alejandro Colomar <alx@nginx.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
 2023-02-17 21:24:18 +00:00
Alejandro Colomar
5015b05fc4 Replaced Linux syscall macros by libc macros. 
User-space programs should use the SYS_*form, as documented in
syscall(2).  That also adds compatibility to non-Linux systems.
 2022-07-18 19:09:30 +02:00
Alejandro Colomar
a3d19f71a2 Fixed indentation. 
Some lines (incorrectly) had an indentation of 3 or 5, or 7 or 9,
or 11 or 13, or 15 or 17 spaces instead of 4, 8, 12, or 16.  Fix them.

Found with:

$ find src -type f | xargs grep -n '^   [^ ]';
$ find src -type f | xargs grep -n '^     [^ *]';
$ find src -type f | xargs grep -n '^       [^ ]';
$ find src -type f | xargs grep -n '^         [^ *]';
$ find src -type f | xargs grep -n '^           [^ +]';
$ find src -type f | xargs grep -n '^             [^ *+]';
$ find src -type f | xargs grep -n '^               [^ +]';
$ find src -type f | xargs grep -n '^                 [^ *+]';
 2022-04-26 12:38:48 +02:00
Tiago Natel
411daeaa53 Isolation: allowed the use of credentials with unpriv userns. 
The setuid/setgid syscalls requires root capabilities but if the kernel
supports unprivileged user namespace then the child process has the full
set of capabilities in the new namespace, then we can allow setting "user"
and "group" in such cases (this is a common security use case).

Tests were added to ensure user gets meaningful error messages for
uid/gid mapping misconfigurations.
 2019-12-06 16:52:50 +00:00
Tiago Natel
7f389c814a Closing leaking file descriptor. 
Found by Coverity (CID 349484).
 2019-09-20 13:16:33 +00:00
Tiago de Bem Natel de Moura
c554941b4f Initial applications isolation support using Linux namespaces. 2019-09-19 15:25:23 +03:00