From 06d42781cbfc3d9baa7155b480e22b9f4164ab91 Mon Sep 17 00:00:00 2001 From: zhongtao Date: Tue, 12 Dec 2023 20:24:57 +0800 Subject: [PATCH 52/64] modify the default value of ISULAD_TMPDIR to /var/lib/isulad Signed-off-by: zhongtao --- src/cmd/isulad/main.c | 13 +++++++------ src/common/constants.h | 2 ++ src/contrib/config/iSulad.sysconfig | 4 ++-- .../modules/container/leftover_cleanup/cleanup.c | 6 +++--- src/daemon/modules/image/oci/utils_images.c | 2 +- src/utils/cutils/utils_verify.c | 5 +++++ src/utils/cutils/utils_verify.h | 2 ++ src/utils/tar/util_archive.c | 9 +++++---- 8 files changed, 27 insertions(+), 16 deletions(-) diff --git a/src/cmd/isulad/main.c b/src/cmd/isulad/main.c index 95454e2a..d33e4004 100644 --- a/src/cmd/isulad/main.c +++ b/src/cmd/isulad/main.c @@ -1295,8 +1295,8 @@ static int ensure_isulad_tmpdir_security() char *isulad_tmp_dir = NULL; isulad_tmp_dir = getenv("ISULAD_TMPDIR"); - if (!util_valid_str(isulad_tmp_dir)) { - isulad_tmp_dir = "/tmp"; + if (!util_valid_isulad_tmpdir(isulad_tmp_dir)) { + isulad_tmp_dir = DEFAULT_ISULAD_TMPDIR; } if (do_ensure_isulad_tmpdir_security(isulad_tmp_dir) != 0) { @@ -1304,14 +1304,15 @@ static int ensure_isulad_tmpdir_security() return -1; } - if (strcmp(isulad_tmp_dir, "/tmp") == 0) { + if (strcmp(isulad_tmp_dir, DEFAULT_ISULAD_TMPDIR) == 0) { return 0; } // No matter whether ISULAD_TMPDIR is set or not, - // ensure the "/tmp" directory is a safe directory - if (do_ensure_isulad_tmpdir_security("/tmp") != 0) { - WARN("Failed to ensure the /tmp directory is a safe directory"); + // ensure the DEFAULT_ISULAD_TMPDIR directory is a safe directory + // TODO: if isula is no longer tarred in the future, we can delete it. + if (do_ensure_isulad_tmpdir_security(DEFAULT_ISULAD_TMPDIR) != 0) { + WARN("Failed to ensure the default ISULAD_TMPDIR : %s directory is a safe directory", DEFAULT_ISULAD_TMPDIR); } return 0; diff --git a/src/common/constants.h b/src/common/constants.h index 5f12ae25..27d4956e 100644 --- a/src/common/constants.h +++ b/src/common/constants.h @@ -129,6 +129,8 @@ extern "C" { #define OCI_IMAGE_GRAPH_ROOTPATH_NAME "storage" +#define DEFAULT_ISULAD_TMPDIR "/var/lib/isulad" + #ifdef ENABLE_GRPC_REMOTE_CONNECT #define DEFAULT_TCP_HOST "tcp://localhost:2375" #define DEFAULT_TLS_HOST "tcp://localhost:2376" diff --git a/src/contrib/config/iSulad.sysconfig b/src/contrib/config/iSulad.sysconfig index 43ba7cbd..25099480 100644 --- a/src/contrib/config/iSulad.sysconfig +++ b/src/contrib/config/iSulad.sysconfig @@ -22,5 +22,5 @@ #SYSMONITOR_OPTIONS='-H tcp://127.0.0.1:2375 --tlsverify --tlscacert=/root/.iSulad/ca.pem --tlscert=/root/.iSulad/cert.pem --tlskey=/root/.iSulad/key.pem' # Location used for temporary files, such as those created by isula load and pull operations. -# Default is /var/tmp. Can be overridden by setting the following env variable. -# ISULAD_TMPDIR=/var/tmp +# Default is /var/lib/isulad. Can be overridden by setting the following env variable. +# ISULAD_TMPDIR=/var/lib/isulad diff --git a/src/daemon/modules/container/leftover_cleanup/cleanup.c b/src/daemon/modules/container/leftover_cleanup/cleanup.c index 9a38ffc2..af5f0eee 100644 --- a/src/daemon/modules/container/leftover_cleanup/cleanup.c +++ b/src/daemon/modules/container/leftover_cleanup/cleanup.c @@ -203,12 +203,12 @@ void do_isulad_tmpdir_cleaner(void) char *isula_tmp_dir = NULL; isula_tmp_dir = getenv("ISULAD_TMPDIR"); - if (util_valid_str(isula_tmp_dir)) { + if (util_valid_isulad_tmpdir(isula_tmp_dir)) { cleanup_path(isula_tmp_dir); } // No matter whether ISULAD_TMPDIR is set or not, - // clean up the "/tmp" directory to prevent the mount point from remaining - cleanup_path("/tmp"); + // clean up the DEFAULT_ISULAD_TMPDIR directory to prevent the mount point from remaining + cleanup_path(DEFAULT_ISULAD_TMPDIR); return; } diff --git a/src/daemon/modules/image/oci/utils_images.c b/src/daemon/modules/image/oci/utils_images.c index f92ee59a..d94388bd 100644 --- a/src/daemon/modules/image/oci/utils_images.c +++ b/src/daemon/modules/image/oci/utils_images.c @@ -595,7 +595,7 @@ char *oci_get_isulad_tmpdir(const char *root_dir) } env_dir = getenv("ISULAD_TMPDIR"); - if (util_valid_str(env_dir)) { + if (util_valid_isulad_tmpdir(env_dir)) { isulad_tmpdir = util_path_join(env_dir, "isulad_tmpdir"); } else { isulad_tmpdir = util_path_join(root_dir, "isulad_tmpdir"); diff --git a/src/utils/cutils/utils_verify.c b/src/utils/cutils/utils_verify.c index f4ce3199..7f2db48b 100644 --- a/src/utils/cutils/utils_verify.c +++ b/src/utils/cutils/utils_verify.c @@ -744,6 +744,11 @@ bool util_valid_volume_name(const char *name) return util_reg_match(patten, name) == 0; } +bool util_valid_isulad_tmpdir(const char *dir) +{ + return util_valid_str(dir) && strcmp(dir, "/tmp") != 0; +} + #ifdef ENABLE_IMAGE_SEARCH bool util_valid_search_name(const char *name) { diff --git a/src/utils/cutils/utils_verify.h b/src/utils/cutils/utils_verify.h index 54d1ce71..bafd2a82 100644 --- a/src/utils/cutils/utils_verify.h +++ b/src/utils/cutils/utils_verify.h @@ -124,6 +124,8 @@ bool util_valid_sysctl(const char *sysctl_key); bool util_valid_volume_name(const char *name); +bool util_valid_isulad_tmpdir(const char *dir); + #ifdef ENABLE_IMAGE_SEARCH bool util_valid_search_name(const char *name); #endif diff --git a/src/utils/tar/util_archive.c b/src/utils/tar/util_archive.c index 82e940a5..e8fad391 100644 --- a/src/utils/tar/util_archive.c +++ b/src/utils/tar/util_archive.c @@ -134,7 +134,7 @@ static void do_disable_unneccessary_caps() // Add flock when bind mount and make it private. // Because bind mount usually makes safedir shared mount point, // and sometimes it will cause "mount point explosion". -// E.g. concurrently execute isula cp /tmp/ : +// E.g. concurrently execute isula cp DEFAULT_ISULAD_TMPDIR/ : static int bind_mount_with_flock(const char *flock_path, const char *dstdir, const char *tmp_dir) { __isula_auto_close int fd = -1; @@ -192,9 +192,10 @@ static int make_safedir_is_noexec(const char *flock_path, const char *dstdir, ch int nret; isulad_tmpdir_env = getenv("ISULAD_TMPDIR"); - if (!util_valid_str(isulad_tmpdir_env)) { - // if not setted isulad tmpdir, just use /tmp - isulad_tmpdir_env = "/tmp"; + if (!util_valid_isulad_tmpdir(isulad_tmpdir_env)) { + INFO("if not setted isulad tmpdir or setted unvalid dir, use DEFAULT_ISULAD_TMPDIR"); + // if not setted isulad tmpdir, just use DEFAULT_ISULAD_TMPDIR + isulad_tmpdir_env = DEFAULT_ISULAD_TMPDIR; } nret = snprintf(isula_tmpdir, PATH_MAX, "%s/isulad_tmpdir", isulad_tmpdir_env); -- 2.42.0