123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106 |
- diff --git a/configure.ac b/configure.ac
- index 2c8154c..c0afee9 100644
- --- a/configure.ac
- +++ b/configure.ac
- @@ -1243,6 +1243,19 @@ case "$BLCR" in
- *) AC_MSG_ERROR([--enable-blcr should be yes or no]) ;;
- esac
-
- +dnl
- +dnl enable IPC isolation
- +dnl
- +AC_MSG_CHECKING([whether to build ipc isolation support])
- +AC_ARG_ENABLE(ipc-isolation,
- + [ --enable-ipc-isolation enable ipc isolation support],
- + IPC=$enableval,IPC=no)
- +AC_MSG_RESULT($IPC)
- +case "$IPC" in
- + yes) AC_DEFINE([IPC_ISOLATION], 1, [Define to enable ipc isolation support]) ;;
- + no) : ;;
- + *) AC_MSG_ERROR([--enable-ipc-isolation should be yes or no]) ;;
- +esac
-
- dnl
- dnl enable Nvidia gpu support
- diff --git a/src/include/pbs_error_db.h b/src/include/pbs_error_db.h
- index 8c7aac9..6a4e11c 100644
- --- a/src/include/pbs_error_db.h
- +++ b/src/include/pbs_error_db.h
- @@ -266,6 +266,7 @@ PbsErrClient(PBSE_JOB_NOT_IN_QUEUE, (char *)"Job not found in queue.")
- PbsErrClient(PBSE_LOGIN_BUSY, (char *)"Login node is currently too busy to run a job")
-
- /* pbs client errors ceiling (max_client_err + 1) */
- +PbsErrClient(PBSE_BADIPC, "Failure of IPC namespace unsharing")
- PbsErrClient(PBSE_CEILING, (char*)0)
- #endif
-
- diff --git a/src/lib/Libutils/u_users.c b/src/lib/Libutils/u_users.c
- index 5a0548a..50594ad 100644
- --- a/src/lib/Libutils/u_users.c
- +++ b/src/lib/Libutils/u_users.c
- @@ -9,6 +9,10 @@
- #include "log.h"
- #include "../Liblog/pbs_log.h"
-
- +#ifdef IPC_ISOLATION
- +#include <sched.h>
- +#endif
- +
- #define LDAP_RETRIES 5
-
- struct passwd *getpwnam_wrapper(const char *user_name);
- @@ -111,6 +115,12 @@ int setuid_ext(
-
- errno = 0;
-
- +#ifdef IPC_ISOLATION
- + rc = unshare(CLONE_NEWIPC)
- +
- + if (rc == 0)
- + {
- +#endif
- while (count < LDAP_RETRIES)
- {
- if (set_euid == TRUE)
- @@ -142,6 +152,9 @@ int setuid_ext(
- }
- }
- } /* end retry loop */
- +#ifdef IPC_ISOLATION
- + }
- +#endif
-
- return(rc);
- } /* END setuid_ext() */
- diff --git a/src/resmom/requests.c b/src/resmom/requests.c
- index f7cddb5..06cfd62 100644
- --- a/src/resmom/requests.c
- +++ b/src/resmom/requests.c
- @@ -121,6 +121,10 @@
- #include <sys/category.h>
- #endif
-
- +#ifdef IPC_ISOLATION
- +#include <sched.h>
- +#endif
- +
- #ifdef HAVE_WORDEXP
- #include <wordexp.h>
-
- @@ -482,6 +486,15 @@ static pid_t fork_to_user(
- return(-PBSE_BADGRP);
- }
-
- +#ifdef IPC_ISOLATION
- + if (unshare(CLONE_NEWIPC) != 0)
- + {
- + /* cannot isolate IPC namespace */
- +
- + return(-PBSE_BADIPC);
- + }
- +#endif
- +
- if (setuid_ext(useruid, FALSE) == -1)
- {
- /* cannot run as the user */
|