cri-o · openshift-merge-robot · Aug 11, 2020 · Jun 11, 2020 · Jun 11, 2020 · Jul 30, 2020
diff --git a/internal/findprocess/findprocess.go b/internal/findprocess/findprocess.go
diff --git a/internal/findprocess/findprocess_test.go b/internal/findprocess/findprocess_test.go
diff --git a/internal/findprocess/findprocess_unix.go b/internal/findprocess/findprocess_unix.go
diff --git a/internal/findprocess/findprocess_windows.go b/internal/findprocess/findprocess_windows.go
diff --git a/internal/lib/sandbox/namespaces.go b/internal/lib/sandbox/namespaces.go
@@ -18,6 +18,7 @@ const (
 	IPCNS         NSType = "ipc"
 	UTSNS         NSType = "uts"
 	USERNS        NSType = "user"
+	PIDNS         NSType = "pid"
 	numNamespaces        = 4
 )
 
@@ -274,6 +275,14 @@ func (s *Sandbox) UserNsJoin(nspath string) error {
 	return err
 }
 
+// PidNs specific functions
+
+// PidNsPath returns the path to the pid namespace of the sandbox.
+// If the sandbox uses the host namespace, the empty string is returned.
+func (s *Sandbox) PidNsPath() string {
+	return s.nsPath(nil, PIDNS)
+}
+
 // nsJoin checks if the current iface is nil, and if so gets the namespace at nsPath
 func nsJoin(nsPath string, nsType NSType, currentIface NamespaceIface) (NamespaceIface, error) {
 	if currentIface != nil {
@@ -294,7 +303,11 @@ func (s *Sandbox) nsPath(ns NamespaceIface, nsType NSType) string {
 func infraPid(infra *oci.Container) int {
 	pid := -1
 	if infra != nil {
-		pid = infra.State().Pid
+		var err error
+		pid, err = infra.Pid()
+		if err != nil {
+			logrus.Errorf("pid for infra container %s not found: %v", infra.ID(), err)
+		}
 	}
 	return pid
 }
@@ -303,9 +316,9 @@ func infraPid(infra *oci.Container) int {
 // calling a container.State() in batch operations
 func nsPathGivenInfraPid(ns NamespaceIface, nsType NSType, infraPid int) string {
 	// caller is responsible for checking if infraContainer
-	// is valid. If not, infraPid should be negative
+	// is valid. If not, infraPid should be less than or equal to 0
 	if ns == nil || ns.Get() == nil {
-		if infraPid >= 0 {
+		if infraPid > 0 {
 			return infraNsPath(nsType, infraPid)
 		}
 		return ""

diff --git a/internal/lib/sandbox/namespaces_test.go b/internal/lib/sandbox/namespaces_test.go
@@ -342,6 +342,13 @@ var _ = t.Describe("SandboxManagedNamespaces", func() {
 			// Then
 			Expect(ns).To(Equal(""))
 		})
+		It("should get nothing when pid not set", func() {
+			// Given
+			// When
+			ns := testSandbox.PidNsPath()
+			// Then
+			Expect(ns).To(Equal(""))
+		})
 		It("should get something when network is set", func() {
 			// Given
 			managedNamespaces := []sandbox.NSType{"net"}
@@ -427,6 +434,7 @@ var _ = t.Describe("SandboxManagedNamespaces", func() {
 			nsPaths := testSandbox.NamespacePaths()
 			// Then
 			Expect(len(nsPaths)).To(Equal(0))
+			Expect(testSandbox.PidNsPath()).To(BeEmpty())
 		})
 		It("should get something when infra set and pid running", func() {
 			// Given
@@ -438,6 +446,7 @@ var _ = t.Describe("SandboxManagedNamespaces", func() {
 				Expect(ns.Path()).To(ContainSubstring("/proc"))
 			}
 			Expect(len(nsPaths)).To(Equal(numManagedNamespaces))
+			Expect(testSandbox.PidNsPath()).To(ContainSubstring("/proc"))
 		})
 		It("should get nothing when infra set with pid not running", func() {
 			// Given
@@ -447,8 +456,9 @@ var _ = t.Describe("SandboxManagedNamespaces", func() {
 			nsPaths := testSandbox.NamespacePaths()
 			// Then
 			Expect(len(nsPaths)).To(Equal(0))
+			Expect(testSandbox.PidNsPath()).To(BeEmpty())
 		})
-		It("should get managed path despite infra set", func() {
+		It("should get managed path (except pid) despite infra set", func() {
 			// Given
 			setupInfraContainerWithPid(1)
 			getPath := pinNamespacesFunctor{
@@ -468,6 +478,8 @@ var _ = t.Describe("SandboxManagedNamespaces", func() {
 				Expect(ns.Path()).NotTo(ContainSubstring("/proc"))
 			}
 			Expect(len(nsPaths)).To(Equal(numManagedNamespaces))
+
+			Expect(testSandbox.PidNsPath()).To(ContainSubstring("/proc"))
 		})
 	})
 	t.Describe("NamespacePaths without infra", func() {
@@ -495,6 +507,8 @@ func setupInfraContainerWithPid(pid int) {
 	cstate.State = specs.State{
 		Pid: pid,
 	}
+	// eat error here because callers may send invalid pids to test against
+	_ = cstate.SetInitPid(pid) // nolint:errcheck
 	testContainer.SetState(cstate)
 
 	Expect(testSandbox.SetInfraContainer(testContainer)).To(BeNil())

diff --git a/internal/oci/container.go b/internal/oci/container.go
@@ -27,6 +27,7 @@ const defaultStopSignalInt = 15
 var (
 	defaultStopSignal   = strconv.Itoa(defaultStopSignalInt)
 	ErrContainerStopped = errors.New("container is already stopped")
+	ErrNotFound         = errors.New("container process not found")
 )
 
 // Container represents a runtime container.
@@ -78,6 +79,11 @@ type ContainerState struct {
 	ExitCode  *int32    `json:"exitCode,omitempty"`
 	OOMKilled bool      `json:"oomKilled,omitempty"`
 	Error     string    `json:"error,omitempty"`
+	InitPid   int       `json:"initPid,omitempty"`
+	// The unix start time of the container's init PID.
+	// This is used to track whether the PID we have stored
+	// is the same as the corresponding PID on the host.
+	InitStartTime int `json:"initStartTime,omitempty"`
 }
 
 // NewContainer creates a container object.
@@ -154,6 +160,12 @@ func (c *Container) StopSignal() syscall.Signal {
 }
 
 // FromDisk restores container's state from disk
+// Calls to FromDisk should always be preceded by call to Runtime.UpdateContainerStatus.
+// This is because FromDisk() initializes the InitStartTime for the saved container state
+// when CRI-O is being upgraded to a version that supports tracking PID,
+// but does no verification the container is actually still running. If we assume the container
+// is still running, we could incorrectly think a process with the same PID running on the host
+// is our container. A call to `$runtime state` will protect us against this.
 func (c *Container) FromDisk() error {
 	jsonSource, err := os.Open(c.StatePath())
 	if err != nil {
@@ -162,7 +174,37 @@ func (c *Container) FromDisk() error {
 	defer jsonSource.Close()
 
 	dec := json.NewDecoder(jsonSource)
-	return dec.Decode(c.state)
+	tmpState := &ContainerState{}
+	if err := dec.Decode(tmpState); err != nil {
+		return err
+	}
+
+	// this is to handle the situation in which we're upgrading
+	// versions of cri-o, and we didn't used to have this information in the state
+	if tmpState.InitPid == 0 && tmpState.InitStartTime == 0 && tmpState.Pid != 0 {
+		if err := tmpState.SetInitPid(tmpState.Pid); err != nil {
+			return err
+		}
+		logrus.Infof("PID information for container %s updated to %d %d", c.id, tmpState.InitPid, tmpState.InitStartTime)
+	}
+	c.state = tmpState
+	return nil
+}
+
+// SetInitPid initializes the InitPid and InitStartTime for the container state
+// given a PID.
+// These values should be set once, and not changed again.
+func (cstate *ContainerState) SetInitPid(pid int) error {
+	if cstate.InitPid != 0 || cstate.InitStartTime != 0 {
+		return errors.Errorf("pid and start time already initialized: %d %d", cstate.InitPid, cstate.InitStartTime)
+	}
+	cstate.InitPid = pid
+	startTime, err := getPidStartTime(pid)
+	if err != nil {
+		return err
+	}
+	cstate.InitStartTime = startTime
+	return nil
 }
 
 // StatePath returns the containers state.json path
@@ -346,6 +388,74 @@ func (c *Container) exitFilePath() string {
 	return filepath.Join(c.dir, "exit")
 }
 
+// IsAlive is a function that checks if a container's init PID exists.
+// It is used to check a container state when we don't want a `$runtime state` call
+func (c *Container) IsAlive() bool {
+	_, err := c.pid()
+	if err != nil {
+		logrus.Errorf("checking if PID of %s is running failed: %v", c.id, err)
+		return false
+	}
+
+	return true
+}
+
+// Pid returns the container's init PID.
+// It will fail if the saved PID no longer belongs to the container.
+func (c *Container) Pid() (int, error) {
+	c.opLock.Lock()
+	defer c.opLock.Unlock()
+	return c.pid()
+}
+
+// pid returns the container's init PID.
+// It checks that we have an InitPid defined in the state, that PID can be found
+// and it is the same process that was originally started by the runtime.
+func (c *Container) pid() (int, error) {
+	if c.state == nil {
+		return 0, errors.New("state not initialized")
+	}
+	if c.state.InitPid <= 0 {
+		return 0, errors.New("PID not initialized")
+	}
+
+	// container has stopped (as pid is initialized but the runc state has overwritten it)
+	if c.state.Pid == 0 {
+		return 0, ErrNotFound
+	}
+
+	if err := c.verifyPid(); err != nil {
+		return 0, err
+	}
+	return c.state.InitPid, nil
+}
+
+// verifyPid checks that the start time for the process on the node is the same
+// as the start time we saved after creating the container.
+// This is the simplest way to verify we are operating on the container
+// process, and haven't run into PID wrap.
+func (c *Container) verifyPid() error {
+	startTime, err := getPidStartTime(c.state.InitPid)
+	if err != nil {
+		return err
+	}
+
+	if startTime != c.state.InitStartTime {
+		return errors.New("PID running but not the original container. PID wrap may have occurred")
+	}
+	return nil
+}
+
+// getPidStartTime reads the kernel's /proc entry for stime for PID.
+func getPidStartTime(pid int) (int, error) {
+	var st unix.Stat_t
+	if err := unix.Stat(fmt.Sprintf("/proc/%d", pid), &st); err != nil {
+		return 0, errors.Wrapf(ErrNotFound, err.Error())
+	}
+
+	return int(st.Ctim.Sec), nil
+}
+
 // ShouldBeStopped checks whether the container state is in a place
 // where attempting to stop it makes sense
 // a container is not stoppable if it's paused or stopped