Repository: opencontainers/runc
File: libcontainer/dmz/dmz_linux.go (Go)

Code before:
//go:build !runc_nodmz
// +build !runc_nodmz

package dmz

import (
	"bytes"
	"debug/elf"
	"embed"
	"os"
	"sync"

	"github.com/sirupsen/logrus"
)

// Try to build the runc-dmz binary on "go generate". If it fails (or
// libcontainer is being imported as a library), the embed.FS will not contain
// the file, which will then cause us to fall back to a clone of
// /proc/self/exe.
//
// There is an empty file called runc-dmz-dummy-file.txt in libcontainer/dmz in
// order to work around the restriction that go:embed requires at least one
// file to match the pattern.
//
//go:generate sh -c "make -B binary/runc-dmz"
//go:embed binary
var runcDmzFs embed.FS

// A cached copy of the contents of runc-dmz.
var (
	runcDmzBinaryOnce    sync.Once
	runcDmzBinaryIsValid bool
	runcDmzBinary        []byte
)

// Binary returns a cloned copy (see CloneBinary) of a very minimal C program
// that just does an execve() of its arguments. This is used in the final
// execution step of the container execution as an intermediate process before
// the container process is execve'd. This allows for protection against
// CVE-2019-5736 without requiring a complete copy of the runc binary. Each
// call to Binary will return a new copy.
//
// If the runc-dmz binary is not embedded into the runc binary, Binary will
// return ErrNoDmzBinary as the error.
func Binary(tmpDir string) (*os.File, error) {
	// Setting RUNC_DMZ=legacy disables this dmz method.
	if os.Getenv("RUNC_DMZ") == "legacy" {
		logrus.Debugf("RUNC_DMZ=legacy set -- switching back to classic /proc/self/exe cloning")

Review comment (suggestion):
A nit. AFAIK we don't need `runc-dmz-dummy-file.txt` in `libcontainer/dmz` anymore since we have `.gitignore` in there (which, by the way, is also being embedded).

Or, we need to do
```diff
-//go:embed binary
+//go:embed binary/runc-*
```
so that `.gitignore` is not included. 

Either way is fine.

Code after:
//go:build !runc_nodmz
// +build !runc_nodmz

package dmz

import (
	"bytes"
	"debug/elf"
	"embed"
	"os"
	"sync"

	"github.com/sirupsen/logrus"
)

// Try to build the runc-dmz binary on "go generate". If it fails (or
// libcontainer is being imported as a library), the embed.FS will not contain
// the file, which will then cause us to fall back to a clone of
// /proc/self/exe.
//
// There is an empty file called dummy-file.txt in libcontainer/dmz/binary in
// order to work around the restriction that go:embed requires at least one
// file to match the pattern.
//
//go:generate make -B binary/runc-dmz
//go:embed binary
var runcDmzFs embed.FS

// A cached copy of the contents of runc-dmz.
var (
	runcDmzBinaryOnce    sync.Once
	runcDmzBinaryIsValid bool
	runcDmzBinary        []byte
)

// Binary returns a cloned copy (see CloneBinary) of a very minimal C program
// that just does an execve() of its arguments. This is used in the final
// execution step of the container execution as an intermediate process before
// the container process is execve'd. This allows for protection against
// CVE-2019-5736 without requiring a complete copy of the runc binary. Each
// call to Binary will return a new copy.
//
// If the runc-dmz binary is not embedded into the runc binary, Binary will
// return ErrNoDmzBinary as the error.
func Binary(tmpDir string) (*os.File, error) {
	// Setting RUNC_DMZ=legacy disables this dmz method.
	if os.Getenv("RUNC_DMZ") == "legacy" {
		logrus.Debugf("RUNC_DMZ=legacy set -- switching back to classic /proc/self/exe cloning")