github/linuxkit
1
0
Fork 0
mirror of https://github.com/linuxkit/linuxkit.git synced 2025-07-27 12:38:11 +00:00
Code Issues Projects Releases Wiki Activity

iptables: close all the fds we inherit from docker

Browse Source 
Signed-off-by: David Scott <dave.scott@docker.com>
This commit is contained in:
David Scott 2016-06-17 14:40:09 +01:00
parent dfb97863c9
commit a294b0f9b0
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
alpine/packages/iptables/main.ml
View File

@ -35,16 +35,26 @@ let pid_filename { proto; dport; ip; port } =
let insert ({ proto; dport; ip; port } as p) = let insert ({ proto; dport; ip; port } as p) =
let filename = pid_filename p in let filename = pid_filename p in
logf "insert: creating a proxy for %s" filename; logf "insert: creating a proxy for %s" filename;
let args = [ _proxy; "-proto"; proto; "-container-ip"; ip; "-container-port"; port; "-host-ip"; "0.0.0.0"; "-host-port"; dport; "-i" ] in let args = [ _proxy; "-proto"; proto; "-container-ip"; ip; "-container-port"; port; "-host-ip"; "0.0.0.0"; "-host-port"; dport; "-i"; "-no-local-ip" ] in
let pid = Unix.fork () in let pid = Unix.fork () in
if pid != 0 then begin if pid == 0 then begin
logf "binary = %s args = %s" _proxy (String.concat "; " args);
(* Close the vast number of fds I've inherited from docker *)
for i = 0 to 1023 do
let fd : Unix.file_descr = Obj.magic i in
try Unix.close fd with Unix.Unix_error(Unix.EBADF, _, _) -> ()
done;
let null = Unix.openfile "/dev/null" [ Unix.O_RDWR ] 0 in
Unix.dup2 null Unix.stdin;
Unix.dup2 null Unix.stdout;
Unix.dup2 null Unix.stderr;
(try Unix.execv _proxy (Array.of_list args) with e -> logf "Failed with %s" (Printexc.to_string e));
exit 1
end else begin
(* write pid to a file (not atomically) *) (* write pid to a file (not atomically) *)
let oc = open_out filename in let oc = open_out filename in
output_string oc (string_of_int pid); output_string oc (string_of_int pid);
close_out oc; close_out oc
logf "binary = %s args = %s" _proxy (String.concat "; " args);
(try Unix.execv _proxy (Array.of_list args) with e -> logf "Failed with %s" (Printexc.to_string e));
exit 1
end end
let delete ({ proto; dport; ip; port } as p) = let delete ({ proto; dport; ip; port } as p) =