Skip to content

Commit 070f2bd

Browse files
mipo57mipo57
committed
[CRun] Added crun package
Added a crun package with patches that allow for using it as a library
1 parent a316b8d commit 070f2bd

12 files changed

Lines changed: 328 additions & 39 deletions

‎package/Config.in‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1873,6 +1873,7 @@ menu "System tools"
18731873
source "package/kmod/Config.in"
18741874
source "package/kvmtool/Config.in"
18751875
source "package/lxc/Config.in"
1876+
source "package/crun/Config.in"
18761877
source "package/monit/Config.in"
18771878
source "package/ncdu/Config.in"
18781879
source "package/numactl/Config.in"

‎package/crun/0001-Preparing-for-library-build.patch‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
From 9d14b28d5c5748abd3d073fbf65dd4cb6b50fdec Mon Sep 17 00:00:00 2001
2+
From: Michal Pogoda <michalpogoda@hotmail.com>
3+
Date: Tue, 17 Mar 2020 16:55:20 +0100
4+
Subject: [PATCH 1/2] Preparing for library build
5+
6+
---
7+
Makefile.am | 19 +++++++++++++++++++
8+
configure.ac | 5 ++++-
9+
libcrun.pc.in | 11 +++++++++++
10+
libocispec/Makefile.am | 13 +++----------
11+
src/libcrun/container.c | 2 +-
12+
5 files changed, 38 insertions(+), 12 deletions(-)
13+
create mode 100644 libcrun.pc.in
14+
15+
diff --git a/Makefile.am b/Makefile.am
16+
index 8f96a4f..5e86199 100644
17+
--- a/Makefile.am
18+
+++ b/Makefile.am
19+
@@ -38,6 +38,25 @@ libcrun_la_SOURCES = src/libcrun/utils.c \
20+
libcrun_la_CFLAGS = -I $(abs_top_builddir)/libocispec/src -I $(abs_top_srcdir)/libocispec/src
21+
libcrun_la_LIBADD = libocispec/libocispec.la
22+
23+
+pkginclude_HEADERS = src/libcrun/container.h \
24+
+ config.h \
25+
+ src/libcrun/error.h \
26+
+ src/libcrun/status.h \
27+
+ src/libcrun/utils.h \
28+
+ libocispec/src/runtime_spec_schema_config_schema.h \
29+
+ libocispec/src/runtime_spec_schema_config_linux.h \
30+
+ libocispec/src/runtime_spec_schema_config_solaris.h \
31+
+ libocispec/src/runtime_spec_schema_config_windows.h \
32+
+ libocispec/src/runtime_spec_schema_config_vm.h \
33+
+ libocispec/src/runtime_spec_schema_defs.h \
34+
+ libocispec/src/runtime_spec_schema_defs_linux.h \
35+
+ libocispec/src/runtime_spec_schema_defs_windows.h \
36+
+ libocispec/src/runtime_spec_schema_defs_vm.h \
37+
+ libocispec/src/json_common.h
38+
+
39+
+pkgconfigdir = @pkgconfigdir@
40+
+pkgconfig_DATA = libcrun.pc
41+
+
42+
if PYTHON_BINDINGS
43+
pyexec_LTLIBRARIES = python_crun.la
44+
python_crun_la_SOURCES = python/crun_python.c
45+
diff --git a/configure.ac b/configure.ac
46+
index ea6ed11..cab11ec 100644
47+
--- a/configure.ac
48+
+++ b/configure.ac
49+
@@ -123,7 +123,10 @@ AC_SEARCH_LIBS([argp_parse], [argp], [], [AC_MSG_ERROR([*** argp functions not f
50+
AM_CONDITIONAL([PYTHON_BINDINGS], [test "x$with_python_bindings" = "xyes"])
51+
AM_CONDITIONAL([CRIU_SUPPORT], [test "x$have_criu" = "xyes"])
52+
53+
-AC_CONFIG_FILES([Makefile rpm/crun.spec])
54+
+PKG_INSTALLDIR
55+
+AC_SUBST(pkgconfigdir)
56+
+
57+
+AC_CONFIG_FILES([Makefile rpm/crun.spec libcrun.pc])
58+
59+
AC_CONFIG_SUBDIRS([libocispec])
60+
AC_OUTPUT
61+
diff --git a/libcrun.pc.in b/libcrun.pc.in
62+
new file mode 100644
63+
index 0000000..54ee2eb
64+
--- /dev/null
65+
+++ b/libcrun.pc.in
66+
@@ -0,0 +1,11 @@
67+
+prefix=@prefix@
68+
+exec_prefix=@exec_prefix@
69+
+libdir=@libdir@
70+
+includedir=@includedir@
71+
+
72+
+Name: LibCRun
73+
+Description: Library for running the OCI containers
74+
+Version: 0.1.13
75+
+Requires: libseccomp libcap yajl
76+
+Cflags: -I${includedir}/crun -I${includedir}
77+
+Libs: -L${libdir} -lseccomp -lcap -lyajl -lcrun
78+
\ No newline at end of file
79+
diff --git a/libocispec/Makefile.am b/libocispec/Makefile.am
80+
index 65bed45..53a8b32 100644
81+
--- a/libocispec/Makefile.am
82+
+++ b/libocispec/Makefile.am
83+
@@ -4,8 +4,7 @@ AM_CFLAGS = $(WARN_CFLAGS) -I$(top_srcdir)/src -I$(top_builddir)/src
84+
85+
GITIGNOREFILES = build-aux/ gtk-doc.make config.h.in aclocal.m4
86+
87+
-noinst_LTLIBRARIES = libocispec.la
88+
-noinst_LIBRARIES = libocispec.a
89+
+lib_LTLIBRARIES = libocispec.la
90+
91+
SOURCE_FILES = src/json_common.c \
92+
src/image_spec_schema_config_schema.c \
93+
@@ -25,9 +24,8 @@ SOURCE_FILES = src/json_common.c \
94+
src/runtime_spec_schema_defs_vm.c \
95+
src/runtime_spec_schema_defs_windows.c \
96+
src/runtime_spec_schema_state_schema.c \
97+
- src/image_manifest_items_image_manifest_items_schema.c \
98+
- src/json_common.c
99+
-
100+
+ src/image_manifest_items_image_manifest_items_schema.c
101+
+
102+
HEADER_FILES = $(SOURCE_FILES:.c=.h)
103+
104+
src/json_common.h src/json_common.c:
105+
@@ -61,15 +59,10 @@ BUILT_SOURCES = $(HEADER_FILES) $(SOURCE_FILES)
106+
libocispec_la_SOURCES = $(SOURCE_FILES) \
107+
src/read-file.c
108+
109+
-libocispec_a_SOURCES =
110+
-
111+
CLEANFILES += $(HEADER_FILES) $(SOURCE_FILES)
112+
113+
TESTS_LDADD = libocispec.la $(SELINUX_LIBS) $(YAJL_LIBS)
114+
115+
-libocispec.a: libocispec.la
116+
- $(LIBTOOL) --mode=link $(GCC) libocispec.la -o libocispec.a
117+
-
118+
tests_test_1_SOURCES = tests/test-1.c
119+
tests_test_1_LDADD = $(TESTS_LDADD)
120+
121+
diff --git a/src/libcrun/container.c b/src/libcrun/container.c
122+
index 22cb41f..7f7dafc 100644
123+
--- a/src/libcrun/container.c
124+
+++ b/src/libcrun/container.c
125+
@@ -1778,7 +1778,7 @@ libcrun_container_run (libcrun_context_t *context, libcrun_container_t *containe
126+
crun_set_output_handler (log_write_to_stderr, NULL, false);
127+
libcrun_fail_with_error ((*err)->status, "%s", (*err)->msg);
128+
}
129+
- exit (ret);
130+
+ _exit (ret);
131+
}
132+
133+
int
134+
--
135+
2.20.1
136+

‎package/crun/0002-Fix-cpuacct-not-beeing-created.patch‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
From b8c2ac52796824ba32329617f2113f26e88a2e1b Mon Sep 17 00:00:00 2001
2+
From: Michal Pogoda <michalpogoda@hotmail.com>
3+
Date: Thu, 9 Apr 2020 16:07:43 +0200
4+
Subject: [PATCH 2/2] Fix cpuacct not beeing created
5+
6+
---
7+
src/libcrun/cgroup.c | 2 +-
8+
1 file changed, 1 insertion(+), 1 deletion(-)
9+
10+
diff --git a/src/libcrun/cgroup.c b/src/libcrun/cgroup.c
11+
index 6947eaf..9a5d34d 100644
12+
--- a/src/libcrun/cgroup.c
13+
+++ b/src/libcrun/cgroup.c
14+
@@ -39,7 +39,7 @@
15+
16+
static const cgroups_subsystem_t cgroups_subsystems[] = { "cpuset", "cpu", "devices", "pids", "memory",
17+
"net_cls,net_prio", "freezer", "blkio",
18+
- "hugetlb", "cpu,cpuacct", "perf_event",
19+
+ "hugetlb", "cpu", "cpuacct", "perf_event",
20+
"unified", NULL};
21+
22+
const cgroups_subsystem_t *
23+
--
24+
2.20.1
25+

‎package/crun/Config.in‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
config BR2_PACKAGE_CRUN
2+
bool "crun"
3+
select BR2_PACKAGE_YAJL
4+
select BR2_PACKAGE_LIBSECCOMP
5+
select BR2_PACKAGE_LIBCAP
6+
help
7+
this package installs 'crun', which is a
8+
runc reimplementation in C

‎package/crun/crun.mk‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
################################################################################
2+
#
3+
# crun
4+
#
5+
################################################################################
6+
7+
CRUN_VERSION = 0.13
8+
CRUN_SITE = https://github.com/containers/crun/releases/download/$(CRUN_VERSION)
9+
CRUN_LICENSE = GPLv2+
10+
CRUN_LICENSE_FILES = COPYING
11+
CRUN_INSTALL_STAGING = YES
12+
CRUN_DEPENDENCIES = host-python3 yajl libcap libseccomp
13+
14+
CRUN_CONF_OPTS = --disable-systemd --enable-shared
15+
CRUN_CONF_ENV = PYTHON=python3
16+
17+
$(eval $(autotools-package))

‎package/libseccomp/0001-remove-static.patch‎

Lines changed: 29 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,40 @@
1-
Do not force static link, it breaks build with
2-
# BR2_STATIC_LIBS is not set
1+
From 5d010fb06eae43b284e5ccc322f6de47eb42b751 Mon Sep 17 00:00:00 2001
2+
From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
3+
Date: Sat, 2 Jun 2018 13:45:22 +0200
4+
Subject: [PATCH] remove static
5+
6+
Do not force static link of tools, it breaks build with:
37
BR2_SHARED_LIBS=y
48

9+
Patch retrieved from
10+
https://git.buildroot.net/buildroot/tree/package/libseccomp/0001-remove-static.patch
11+
and slighly updated to work with 2.3.3
12+
13+
[Upstream status: https://github.com/seccomp/libseccomp/pull/121]
14+
515
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
16+
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
17+
[Peter: updated for v2.4.0 which adds scmp_api_level]
18+
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
19+
---
20+
tools/Makefile.am | 3 ---
21+
1 file changed, 3 deletions(-)
622

7-
diff -uNr libseccomp-2.2.0.org/tests/Makefile.am libseccomp-2.2.0/tests/Makefile.am
8-
--- libseccomp-2.2.0.org/tests/Makefile.am 2015-02-11 21:57:11.000000000 +0100
9-
+++ libseccomp-2.2.0/tests/Makefile.am 2015-03-29 16:03:49.668946652 +0200
10-
@@ -16,7 +16,6 @@
11-
# along with this library; if not, see <http://www.gnu.org/licenses>.
12-
#
13-
14-
-AM_LDFLAGS = -static
15-
LDADD = util.la ../src/libseccomp.la
16-
17-
check_LTLIBRARIES = util.la
18-
diff -uNr libseccomp-2.2.0.org/tools/Makefile.am libseccomp-2.2.0/tools/Makefile.am
19-
--- libseccomp-2.2.0.org/tools/Makefile.am 2015-02-11 21:57:11.000000000 +0100
20-
+++ libseccomp-2.2.0/tools/Makefile.am 2015-03-29 16:03:46.164992302 +0200
21-
@@ -33,8 +33,6 @@
22-
scmp_bpf_sim_SOURCES = scmp_bpf_sim.c bpf.h util.h
23+
diff --git a/tools/Makefile.am b/tools/Makefile.am
24+
index f768365..5f9d571 100644
25+
--- a/tools/Makefile.am
26+
+++ b/tools/Makefile.am
27+
@@ -37,10 +37,7 @@ scmp_bpf_sim_SOURCES = scmp_bpf_sim.c bpf.h util.h
28+
scmp_api_level_SOURCES = scmp_api_level.c
2329

2430
scmp_sys_resolver_LDADD = ../src/libseccomp.la
2531
-scmp_sys_resolver_LDFLAGS = -static
2632
scmp_arch_detect_LDADD = ../src/libseccomp.la
2733
-scmp_arch_detect_LDFLAGS = -static
2834
scmp_bpf_disasm_LDADD = util.la
2935
scmp_bpf_sim_LDADD = util.la
36+
scmp_api_level_LDADD = ../src/libseccomp.la
37+
-scmp_api_level_LDFLAGS = -static
38+
--
39+
2.11.0
40+

‎package/libseccomp/0002-Circumvent-bug-in-uClibc-ng-syscall-on-x86_64-system.patch‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
From 613e601bb4b50dc359b41f162a5b629449e4bbea Mon Sep 17 00:00:00 2001
2+
From: Carlos Santos <casantos@redhat.com>
3+
Date: Fri, 18 Oct 2019 22:02:49 -0300
4+
Subject: [PATCH] Circumvent bug in uClibc-ng syscall() on x86_64 systems
5+
6+
On uClibc at least up to v1.0.32, syscall() for x86_64 is defined in
7+
libc/sysdeps/linux/x86_64/syscall.S as
8+
9+
syscall:
10+
movq %rdi, %rax /* Syscall number -> rax. */
11+
movq %rsi, %rdi /* shift arg1 - arg5. */
12+
movq %rdx, %rsi
13+
movq %rcx, %rdx
14+
movq %r8, %r10
15+
movq %r9, %r8
16+
movq 8(%rsp),%r9 /* arg6 is on the stack. */
17+
syscall /* Do the system call. */
18+
cmpq $-4095, %rax /* Check %rax for error. */
19+
jae __syscall_error /* Branch forward if it failed. */
20+
ret /* Return to caller. */
21+
22+
And __syscall_error is defined in
23+
libc/sysdeps/linux/x86_64/__syscall_error.c as
24+
25+
int __syscall_error(void) attribute_hidden;
26+
int __syscall_error(void)
27+
{
28+
register int err_no __asm__ ("%rcx");
29+
__asm__ ("mov %rax, %rcx\n\t"
30+
"neg %rcx");
31+
__set_errno(err_no);
32+
return -1;
33+
}
34+
35+
Notice that __syscall_error returns -1 as a 32-bit int in %rax, a 64-bit
36+
register i.e. 0x00000000ffffffff (decimal 4294967295). When this value
37+
is compared to -1 in _sys_chk_seccomp_flag_kernel() the result is false,
38+
leading the function to always return 0.
39+
40+
Prevent the error by coercing the return value of syscall() to int in a
41+
temporary variable before comparing it to -1. We could use just an (int)
42+
cast but the variable makes the code more readable and the machine code
43+
generated by the compiler is the same in both cases.
44+
45+
All other syscall() invocations were inspected and they either already
46+
coerce the result to int or do not compare it to -1.
47+
48+
The same problem probably occurs on other 64-bit systems but so far only
49+
x86_64 was tested.
50+
51+
A bug report is being submitted to uClibc.
52+
53+
Signed-off-by: Carlos Santos <casantos@redhat.com>
54+
---
55+
src/system.c | 8 +++++---
56+
1 file changed, 5 insertions(+), 3 deletions(-)
57+
58+
diff --git a/src/system.c b/src/system.c
59+
index 8e5aafc..811b401 100644
60+
--- a/src/system.c
61+
+++ b/src/system.c
62+
@@ -215,10 +215,12 @@ static int _sys_chk_seccomp_flag_kernel(int flag)
63+
/* this is an invalid seccomp(2) call because the last argument
64+
* is NULL, but depending on the errno value of EFAULT we can
65+
* guess if the filter flag is supported or not */
66+
- if (sys_chk_seccomp_syscall() == 1 &&
67+
- syscall(_nr_seccomp, SECCOMP_SET_MODE_FILTER, flag, NULL) == -1 &&
68+
- errno == EFAULT)
69+
+ int rc;
70+
+ if (sys_chk_seccomp_syscall() == 1) {
71+
+ rc = syscall(_nr_seccomp, SECCOMP_SET_MODE_FILTER, flag, NULL);
72+
+ if (rc == -1 && errno == EFAULT)
73+
return 1;
74+
+ }
75+
76+
return 0;
77+
}
78+
--
79+
2.18.1
80+

‎package/libseccomp/Config.in‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,28 @@
1+
config BR2_PACKAGE_LIBSECCOMP_ARCH_SUPPORTS
2+
bool
3+
default y if BR2_aarch64
4+
default y if BR2_arm || BR2_armeb
5+
default y if BR2_mips || BR2_mipsel || BR2_mips64 || BR2_mips64el
6+
default y if BR2_i386 || BR2_x86_64
7+
default y if BR2_powerpc64 || BR2_powerpc
8+
19
config BR2_PACKAGE_LIBSECCOMP
210
bool "libseccomp"
3-
depends on BR2_aarch64 || BR2_mips || BR2_mipsel || BR2_mips64 || \
4-
BR2_mips64el || BR2_i386 || BR2_x86_64 || BR2_powerpc64 || \
5-
BR2_powerpc
11+
depends on BR2_PACKAGE_LIBSECCOMP_ARCH_SUPPORTS
612
depends on BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_12
713
help
814
High level interface to the Linux Kernel's seccomp filter
915

10-
The libseccomp library provides an easy to use, platform independent,
11-
interface to the Linux Kernel's syscall filtering mechanism: seccomp.
12-
The libseccomp API is designed to abstract away the underlying BPF
13-
based syscall filter language and present a more conventional
14-
function-call based filtering interface that should be familiar to,
15-
and easily adopted by application developers.
16+
The libseccomp library provides an easy to use, platform
17+
independent, interface to the Linux Kernel's syscall filtering
18+
mechanism: seccomp. The libseccomp API is designed to abstract
19+
away the underlying BPF based syscall filter language and
20+
present a more conventional function-call based filtering
21+
interface that should be familiar to, and easily adopted by
22+
application developers.
1623

1724
https://github.com/seccomp/libseccomp
1825

1926
comment "libseccomp needs a toolchain w/ headers >= 3.12"
20-
depends on BR2_aarch64 || BR2_mips || BR2_mipsel || BR2_mips64 || \
21-
BR2_mips64el || BR2_i386 || BR2_x86_64
27+
depends on BR2_PACKAGE_LIBSECCOMP_ARCH_SUPPORTS
2228
depends on !BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_12

‎package/libseccomp/libseccomp.hash‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
# Locally calculated
2-
sha256 09864282ae579c34bd5ef75ef3487200adfecaa51f5cffc7c7ad1ed2f89f5d6c libseccomp-v2.3.1.tar.gz
2+
sha256 36aa502c0461ae9efc6c93ec2430d6badd9bf91ecbe73806baf7b7c6f687ab4f libseccomp-2.4.1.tar.gz
3+
sha256 102900208eef27b766380135906d431dba87edaa7ec6aa72e6ebd3dd67f3a97b LICENSE

0 commit comments

Comments
 (0)