nsenter: check cmdline for init argument

libcontainer/nsenter/log.c

@@ -20,7 +20,7 @@ void setup_logpipe(void)
 
 	i = getenv_int("_LIBCONTAINER_LOGPIPE");
 	if (i < 0) {
-		/* We are not runc init, or log pipe was not provided. */
+		/* Log pipe was not provided. */
 		return;
 	}
 	logfd = i;

libcontainer/nsenter/nsenter_test.go

@@ -17,7 +17,6 @@ import (
 )
 
 func TestNsenterValidPaths(t *testing.T) {
-	args := []string{"nsenter-exec"}
 	parent, child := newPipe(t)
 
 	namespaces := []string{
@@ -26,7 +25,7 @@ func TestNsenterValidPaths(t *testing.T) {
 	}
 	cmd := &exec.Cmd{
 		Path:       os.Args[0],
-		Args:       args,
+		Args:       initArgs,
 		ExtraFiles: []*os.File{child},
 		Env:        []string{"_LIBCONTAINER_INITPIPE=3"},
 		Stdout:     os.Stdout,
@@ -62,15 +61,14 @@ func TestNsenterValidPaths(t *testing.T) {
 }
 
 func TestNsenterInvalidPaths(t *testing.T) {
-	args := []string{"nsenter-exec"}
 	parent, child := newPipe(t)
 
 	namespaces := []string{
 		fmt.Sprintf("pid:/proc/%d/ns/pid", -1),
 	}
 	cmd := &exec.Cmd{
 		Path:       os.Args[0],
-		Args:       args,
+		Args:       initArgs,
 		ExtraFiles: []*os.File{child},
 		Env:        []string{"_LIBCONTAINER_INITPIPE=3"},
 	}
@@ -101,15 +99,14 @@ func TestNsenterInvalidPaths(t *testing.T) {
 }
 
 func TestNsenterIncorrectPathType(t *testing.T) {
-	args := []string{"nsenter-exec"}
 	parent, child := newPipe(t)
 
 	namespaces := []string{
 		fmt.Sprintf("net:/proc/%d/ns/pid", os.Getpid()),
 	}
 	cmd := &exec.Cmd{
 		Path:       os.Args[0],
-		Args:       args,
+		Args:       initArgs,
 		ExtraFiles: []*os.File{child},
 		Env:        []string{"_LIBCONTAINER_INITPIPE=3"},
 	}
@@ -140,7 +137,6 @@ func TestNsenterIncorrectPathType(t *testing.T) {
 }
 
 func TestNsenterChildLogging(t *testing.T) {
-	args := []string{"nsenter-exec"}
 	parent, child := newPipe(t)
 	logread, logwrite := newPipe(t)
 
@@ -150,7 +146,7 @@ func TestNsenterChildLogging(t *testing.T) {
 	}
 	cmd := &exec.Cmd{
 		Path:       os.Args[0],
-		Args:       args,
+		Args:       initArgs,
 		ExtraFiles: []*os.File{child, logwrite},
 		Env:        []string{"_LIBCONTAINER_INITPIPE=3", "_LIBCONTAINER_LOGPIPE=4"},
 		Stdout:     os.Stdout,
@@ -187,8 +183,10 @@ func TestNsenterChildLogging(t *testing.T) {
 	reapChildren(t, parent)
 }
 
+var initArgs = []string{"nsexec-test", "init"}
+
 func init() {
-	if strings.HasPrefix(os.Args[0], "nsenter-") {
+	if len(os.Args) == len(initArgs) && os.Args[1] == initArgs[1] {
 		os.Exit(0)
 	}
 }

libcontainer/nsenter/nsexec.c

@@ -547,13 +547,50 @@ static void update_timens_offsets(pid_t pid, char *map, size_t map_len)
 		bail("failed to update /proc/%d/timens_offsets", pid);
 }
 
+/* Check if the binary is called with the sole "init" argument by reading
+ * the /proc/self/cmdline file (as argc/argv is not available).
+ */
+static int in_init(void)
+{
+	const char expect[] = "init";
+	/* Assuming the binary path can't be longer than PATH_MAX,
+	 * read enough to check for the argument expected.
+	 */
+	char buf[PATH_MAX + sizeof(expect) + 1];
+
+	int f = open("/proc/self/cmdline", O_RDONLY | O_CLOEXEC);
+	if (f < 0)
+		bail("open /proc/self/cmdline");
+
+	int c = read(f, buf, sizeof(buf));
+	if (c < 0)
+		bail("read /proc/self/cmdline");
+
+	close(f);
+
+	char *arg = memchr(buf, '\0', c);
+	if (arg == NULL) {	/* Should never happen. */
+		return 0;
+	}
+	/* Check the size of remaining cmdline matches the expected argument. */
+	if (c - (arg - buf) != sizeof(expect) + 1) {
+		return 0;
+	}
+
+	return (memcmp(arg + 1, expect, sizeof(expect)) == 0);
+}
+
 void nsexec(void)
 {
 	int pipenum;
 	jmp_buf env;
 	int sync_child_pipe[2], sync_grandchild_pipe[2];
 	struct nlconfig_t config = { 0 };
 
+	if (!in_init()) {
+		return;
+	}
+
 	/*
 	 * Setup a pipe to send logs to the parent. This should happen
 	 * first, because bail will use that pipe.
@@ -566,10 +603,8 @@ void nsexec(void)
 	 * after the setup is done.
 	 */
 	pipenum = getenv_int("_LIBCONTAINER_INITPIPE");
-	if (pipenum < 0) {
-		/* We are not a runc init. Just return to go runtime. */
-		return;
-	}
+	if (pipenum < 0)
+		bail("missing init pipe");
 
 	/*
 	 * Inform the parent we're past initial setup.