void test_signal_container() { printf("\nTesting signal_container\n"); fflush(stdout); fflush(stderr); pid_t child = fork(); if (child == -1) { printf("FAIL: fork failed\n"); exit(1); } else if (child == 0) { if (change_user(user_detail->pw_uid, user_detail->pw_gid) != 0) { exit(1); } sleep(3600); exit(0); } else { printf("Child container launched as %" PRId64 "\n", (int64_t)child); if (signal_container_as_user(yarn_username, child, SIGQUIT) != 0) { exit(1); } int status = 0; if (waitpid(child, &status, 0) == -1) { printf("FAIL: waitpid failed - %s\n", strerror(errno)); exit(1); } if (!WIFSIGNALED(status)) { printf("FAIL: child wasn't signalled - %d\n", status); exit(1); } if (WTERMSIG(status) != SIGQUIT) { printf("FAIL: child was killed with %d instead of %d\n", WTERMSIG(status), SIGQUIT); exit(1); } } }
void test_signal_container_group() { printf("\nTesting group signal_container\n"); fflush(stdout); fflush(stderr); pid_t child = fork(); if (child == -1) { printf("FAIL: fork failed\n"); exit(1); } else if (child == 0) { setpgid(0,0); if (change_user(user_detail->pw_uid, user_detail->pw_gid) != 0) { exit(1); } sleep(3600); exit(0); } printf("Child container launched as %" PRId64 "\n", (int64_t)child); // there's a race condition for child calling change_user and us // calling signal_container_as_user, hence sleeping sleep(3); if (signal_container_as_user(yarn_username, child, SIGKILL) != 0) { exit(1); } int status = 0; if (waitpid(child, &status, 0) == -1) { printf("FAIL: waitpid failed - %s\n", strerror(errno)); exit(1); } if (!WIFSIGNALED(status)) { printf("FAIL: child wasn't signalled - %d\n", status); exit(1); } if (WTERMSIG(status) != SIGKILL) { printf("FAIL: child was killed with %d instead of %d\n", WTERMSIG(status), SIGKILL); exit(1); } }
int main(int argc, char **argv) { open_log_files(); assert_valid_setup(argv[0]); int operation; int ret = validate_arguments(argc, argv, &operation); if (ret != 0) { flush_and_close_log_files(); return ret; } int exit_code = 0; switch (operation) { case CHECK_SETUP: //we already did this exit_code = 0; break; case MOUNT_CGROUPS: exit_code = 0; while (optind < argc && exit_code == 0) { exit_code = mount_cgroup(argv[optind++], cmd_input.cgroups_hierarchy); } break; case TRAFFIC_CONTROL_MODIFY_STATE: exit_code = traffic_control_modify_state(cmd_input.traffic_control_command_file); break; case TRAFFIC_CONTROL_READ_STATE: exit_code = traffic_control_read_state(cmd_input.traffic_control_command_file); break; case TRAFFIC_CONTROL_READ_STATS: exit_code = traffic_control_read_stats(cmd_input.traffic_control_command_file); break; case RUN_DOCKER: exit_code = run_docker(cmd_input.docker_command_file); break; case RUN_AS_USER_INITIALIZE_CONTAINER: exit_code = set_user(cmd_input.run_as_user_name); if (exit_code != 0) { break; } exit_code = initialize_app(cmd_input.yarn_user_name, cmd_input.app_id, cmd_input.cred_file, extract_values(cmd_input.local_dirs), extract_values(cmd_input.log_dirs), argv + optind); break; case RUN_AS_USER_LAUNCH_DOCKER_CONTAINER: if (cmd_input.traffic_control_command_file != NULL) { //apply tc rules before switching users and launching the container exit_code = traffic_control_modify_state(cmd_input.traffic_control_command_file); if( exit_code != 0) { //failed to apply tc rules - break out before launching the container break; } } exit_code = set_user(cmd_input.run_as_user_name); if (exit_code != 0) { break; } exit_code = launch_docker_container_as_user(cmd_input.yarn_user_name, cmd_input.app_id, cmd_input.container_id, cmd_input.current_dir, cmd_input.script_file, cmd_input.cred_file, cmd_input.pid_file, extract_values(cmd_input.local_dirs), extract_values(cmd_input.log_dirs), cmd_input.docker_command_file, cmd_input.resources_key, cmd_input.resources_values); break; case RUN_AS_USER_LAUNCH_CONTAINER: if (cmd_input.traffic_control_command_file != NULL) { //apply tc rules before switching users and launching the container exit_code = traffic_control_modify_state(cmd_input.traffic_control_command_file); if( exit_code != 0) { //failed to apply tc rules - break out before launching the container break; } } exit_code = set_user(cmd_input.run_as_user_name); if (exit_code != 0) { break; } exit_code = launch_container_as_user(cmd_input.yarn_user_name, cmd_input.app_id, cmd_input.container_id, cmd_input.current_dir, cmd_input.script_file, cmd_input.cred_file, cmd_input.pid_file, extract_values(cmd_input.local_dirs), extract_values(cmd_input.log_dirs), cmd_input.resources_key, cmd_input.resources_values); free(cmd_input.resources_key); free(cmd_input.resources_value); free(cmd_input.resources_values); break; case RUN_AS_USER_SIGNAL_CONTAINER: exit_code = set_user(cmd_input.run_as_user_name); if (exit_code != 0) { break; } exit_code = signal_container_as_user(cmd_input.yarn_user_name, cmd_input.container_pid, cmd_input.signal); break; case RUN_AS_USER_DELETE: exit_code = set_user(cmd_input.run_as_user_name); if (exit_code != 0) { break; } exit_code = delete_as_user(cmd_input.yarn_user_name, cmd_input.dir_to_be_deleted, argv + optind); break; } flush_and_close_log_files(); return exit_code; }
int main(int argc, char **argv) { int invalid_args = 0; int do_check_setup = 0; int do_mount_cgroups = 0; LOGFILE = stdout; ERRORFILE = stderr; if (argc > 1) { if (strcmp("--mount-cgroups", argv[1]) == 0) { do_mount_cgroups = 1; } } // Minimum number of arguments required to run // the std. container-executor commands is 4 // 4 args not needed for checksetup option if (argc < 4 && !do_mount_cgroups) { invalid_args = 1; if (argc == 2) { const char *arg1 = argv[1]; if (strcmp("--checksetup", arg1) == 0) { invalid_args = 0; do_check_setup = 1; } } } if (invalid_args != 0) { display_usage(stdout); return INVALID_ARGUMENT_NUMBER; } int command; const char * app_id = NULL; const char * container_id = NULL; const char * cred_file = NULL; const char * script_file = NULL; const char * current_dir = NULL; const char * pid_file = NULL; int exit_code = 0; char * dir_to_be_deleted = NULL; char *executable_file = get_executable(); char *orig_conf_file = HADOOP_CONF_DIR "/" CONF_FILENAME; char *conf_file = resolve_config_path(orig_conf_file, argv[0]); char *local_dirs, *log_dirs; char *resources, *resources_key, *resources_value; if (conf_file == NULL) { fprintf(ERRORFILE, "Configuration file %s not found.\n", orig_conf_file); exit(INVALID_CONFIG_FILE); } if (check_configuration_permissions(conf_file) != 0) { exit(INVALID_CONFIG_FILE); } read_config(conf_file); free(conf_file); // look up the node manager group in the config file char *nm_group = get_value(NM_GROUP_KEY); if (nm_group == NULL) { fprintf(ERRORFILE, "Can't get configured value for %s.\n", NM_GROUP_KEY); exit(INVALID_CONFIG_FILE); } struct group *group_info = getgrnam(nm_group); if (group_info == NULL) { fprintf(ERRORFILE, "Can't get group information for %s - %s.\n", nm_group, strerror(errno)); fflush(LOGFILE); exit(INVALID_CONFIG_FILE); } set_nm_uid(getuid(), group_info->gr_gid); // if we are running from a setuid executable, make the real uid root setuid(0); // set the real and effective group id to the node manager group setgid(group_info->gr_gid); if (check_executor_permissions(executable_file) != 0) { fprintf(ERRORFILE, "Invalid permissions on container-executor binary.\n"); return INVALID_CONTAINER_EXEC_PERMISSIONS; } if (do_check_setup != 0) { // basic setup checks done // verified configs available and valid // verified executor permissions return 0; } if (do_mount_cgroups) { optind++; char *hierarchy = argv[optind++]; int result = 0; while (optind < argc && result == 0) { result = mount_cgroup(argv[optind++], hierarchy); } return result; } //checks done for user name if (argv[optind] == NULL) { fprintf(ERRORFILE, "Invalid user name.\n"); return INVALID_USER_NAME; } int ret = set_user(argv[optind]); if (ret != 0) { return ret; } // this string is used for building pathnames, the // process management is done based on the 'user_detail' // global, which was set by 'set_user()' above optind = optind + 1; char *yarn_user_name = argv[optind]; if (yarn_user_name == NULL) { fprintf(ERRORFILE, "Invalid yarn user name.\n"); return INVALID_USER_NAME; } optind = optind + 1; command = atoi(argv[optind++]); fprintf(LOGFILE, "main : command provided %d\n",command); fprintf(LOGFILE, "main : user is %s\n", user_detail->pw_name); fprintf(LOGFILE, "main : requested yarn user is %s\n", yarn_user_name); fflush(LOGFILE); switch (command) { case INITIALIZE_CONTAINER: if (argc < 9) { fprintf(ERRORFILE, "Too few arguments (%d vs 9) for initialize container\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } app_id = argv[optind++]; cred_file = argv[optind++]; local_dirs = argv[optind++];// good local dirs as a comma separated list log_dirs = argv[optind++];// good log dirs as a comma separated list exit_code = initialize_app(yarn_user_name, app_id, cred_file, extract_values(local_dirs), extract_values(log_dirs), argv + optind); break; case LAUNCH_CONTAINER: if (argc != 13) { fprintf(ERRORFILE, "Wrong number of arguments (%d vs 13) for launch container\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } app_id = argv[optind++]; container_id = argv[optind++]; current_dir = argv[optind++]; script_file = argv[optind++]; cred_file = argv[optind++]; pid_file = argv[optind++]; local_dirs = argv[optind++];// good local dirs as a comma separated list log_dirs = argv[optind++];// good log dirs as a comma separated list resources = argv[optind++];// key,value pair describing resources char *resources_key = malloc(strlen(resources)); char *resources_value = malloc(strlen(resources)); if (get_kv_key(resources, resources_key, strlen(resources)) < 0 || get_kv_value(resources, resources_value, strlen(resources)) < 0) { fprintf(ERRORFILE, "Invalid arguments for cgroups resources: %s", resources); fflush(ERRORFILE); free(resources_key); free(resources_value); return INVALID_ARGUMENT_NUMBER; } char** resources_values = extract_values(resources_value); exit_code = launch_container_as_user(yarn_user_name, app_id, container_id, current_dir, script_file, cred_file, pid_file, extract_values(local_dirs), extract_values(log_dirs), resources_key, resources_values); free(resources_key); free(resources_value); break; case SIGNAL_CONTAINER: if (argc != 6) { fprintf(ERRORFILE, "Wrong number of arguments (%d vs 6) for " \ "signal container\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } else { char* end_ptr = NULL; char* option = argv[optind++]; int container_pid = strtol(option, &end_ptr, 10); if (option == end_ptr || *end_ptr != '\0') { fprintf(ERRORFILE, "Illegal argument for container pid %s\n", option); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } option = argv[optind++]; int signal = strtol(option, &end_ptr, 10); if (option == end_ptr || *end_ptr != '\0') { fprintf(ERRORFILE, "Illegal argument for signal %s\n", option); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } exit_code = signal_container_as_user(yarn_user_name, container_pid, signal); } break; case DELETE_AS_USER: dir_to_be_deleted = argv[optind++]; exit_code= delete_as_user(yarn_user_name, dir_to_be_deleted, argv + optind); break; default: fprintf(ERRORFILE, "Invalid command %d not supported.",command); fflush(ERRORFILE); exit_code = INVALID_COMMAND_PROVIDED; } fclose(LOGFILE); fclose(ERRORFILE); return exit_code; }
int main(int argc, char **argv) { int invalid_args = 0; int do_check_setup = 0; LOGFILE = stdout; ERRORFILE = stderr; // Minimum number of arguments required to run // the std. worker-launcher commands is 3 // 3 args not needed for checksetup option if (argc < 3) { invalid_args = 1; if (argc == 2) { const char *arg1 = argv[1]; if (strcmp("--checksetup", arg1) == 0) { invalid_args = 0; do_check_setup = 1; } } } if (invalid_args != 0) { display_usage(stdout); return INVALID_ARGUMENT_NUMBER; } const char * command = NULL; const char * working_dir = NULL; int exit_code = 0; char *executable_file = get_executable(); char *orig_conf_file = STRINGIFY(EXEC_CONF_DIR) "/" CONF_FILENAME; char *conf_file = realpath(orig_conf_file, NULL); if (conf_file == NULL) { fprintf(ERRORFILE, "Configuration file %s not found.\n", orig_conf_file); exit(INVALID_CONFIG_FILE); } if (do_check_setup) { fprintf(LOGFILE, "Using configuration file %s \n", conf_file); } if (check_configuration_permissions(conf_file) != 0) { exit(INVALID_CONFIG_FILE); } read_config(conf_file); // look up the worker launcher group in the config file char *wl_group = get_value(LAUNCHER_GROUP_KEY); if (wl_group == NULL) { fprintf(ERRORFILE, "Can't get configured value for %s.\n", LAUNCHER_GROUP_KEY); exit(INVALID_CONFIG_FILE); } struct group *group_info = getgrnam(wl_group); if (group_info == NULL) { fprintf(ERRORFILE, "Can't get group information for %s - %s.\n", wl_group, strerror(errno)); fflush(LOGFILE); exit(INVALID_CONFIG_FILE); } set_launcher_uid(getuid(), group_info->gr_gid); // if we are running from a setuid executable, make the real uid root setuid(0); // set the real and effective group id to the node manager group setgid(group_info->gr_gid); if (check_executor_permissions(executable_file) != 0) { fprintf(LOGFILE, "worker-launcher config file: %s \n", conf_file); free(conf_file); conf_file = NULL; fprintf(ERRORFILE, "ERROR: Invalid permissions on worker-launcher binary.\n"); return INVALID_CONTAINER_EXEC_PERMISSIONS; } free(conf_file); conf_file = NULL; if (do_check_setup != 0) { // basic setup checks done // verified configs available and valid // verified executor permissions return 0; } //checks done for user name if (argv[optind] == NULL) { fprintf(ERRORFILE, "Invalid user name.\n"); return INVALID_USER_NAME; } int ret = set_user(argv[optind]); if (ret != 0) { return ret; } optind = optind + 1; command = argv[optind++]; fprintf(LOGFILE, "main : command provided %s\n",command); fprintf(LOGFILE, "main : user is %s\n", user_detail->pw_name); fflush(LOGFILE); if (strcasecmp("code-dir", command) == 0) { if (argc != 4) { fprintf(ERRORFILE, "Incorrect number of arguments (%d vs 4) for code-dir\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } exit_code = setup_dir_permissions(argv[optind], 0); } else if (strcasecmp("artifacts-dir", command) == 0) { if (argc != 4) { fprintf(ERRORFILE, "Incorrect number of arguments (%d vs 4) for artifacts-dir\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } exit_code = setup_dir_permissions(argv[optind], 1); } else if (strcasecmp("blob", command) == 0) { if (argc != 4) { fprintf(ERRORFILE, "Incorrect number of arguments (%d vs 4) for blob\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } exit_code = setup_dir_permissions(argv[optind], 0); } else if (strcasecmp("rmr", command) == 0) { if (argc != 4) { fprintf(ERRORFILE, "Incorrect number of arguments (%d vs 4) for rmr\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } exit_code = recursive_delete(argv[optind], 1); } else if (strcasecmp("worker", command) == 0) { if (argc != 5) { fprintf(ERRORFILE, "Incorrect number of arguments (%d vs 5) for worker\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } working_dir = argv[optind++]; exit_code = setup_dir_permissions(working_dir, 1); if (exit_code == 0) { exit_code = exec_as_user(working_dir, argv[optind]); } } else if (strcasecmp("profiler", command) == 0) { if (argc != 5) { fprintf(ERRORFILE, "Incorrect number of arguments (%d vs 5) for profiler\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } working_dir = argv[optind++]; exit_code = exec_as_user(working_dir, argv[optind]); } else if (strcasecmp("signal", command) == 0) { if (argc != 5) { fprintf(ERRORFILE, "Incorrect number of arguments (%d vs 5) for signal\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } char* end_ptr = NULL; char* option = argv[optind++]; int container_pid = strtol(option, &end_ptr, 10); if (option == end_ptr || *end_ptr != '\0') { fprintf(ERRORFILE, "Illegal argument for container pid %s\n", option); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } option = argv[optind++]; int signal = strtol(option, &end_ptr, 10); if (option == end_ptr || *end_ptr != '\0') { fprintf(ERRORFILE, "Illegal argument for signal %s\n", option); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } exit_code = signal_container_as_user(user_detail->pw_name, container_pid, signal); } else { fprintf(ERRORFILE, "Invalid command %s not supported.",command); fflush(ERRORFILE); exit_code = INVALID_COMMAND_PROVIDED; } fclose(LOGFILE); fclose(ERRORFILE); return exit_code; }
int main(int argc, char **argv) { int invalid_args = 0; int do_check_setup = 0; LOGFILE = stdout; ERRORFILE = stderr; // Minimum number of arguments required to run // the std. container-executor commands is 4 // 4 args not needed for checksetup option if (argc < 4) { invalid_args = 1; if (argc == 2) { const char *arg1 = argv[1]; if (strcmp("--checksetup", arg1) == 0) { invalid_args = 0; do_check_setup = 1; } } } if (invalid_args != 0) { display_usage(stdout); return INVALID_ARGUMENT_NUMBER; } int command; const char * app_id = NULL; const char * container_id = NULL; const char * cred_file = NULL; const char * script_file = NULL; const char * current_dir = NULL; const char * pid_file = NULL; int exit_code = 0; char * dir_to_be_deleted = NULL; char *executable_file = get_executable(); char *orig_conf_file = STRINGIFY(HADOOP_CONF_DIR) "/" CONF_FILENAME; char *conf_file = realpath(orig_conf_file, NULL); if (conf_file == NULL) { fprintf(ERRORFILE, "Configuration file %s not found.\n", orig_conf_file); exit(INVALID_CONFIG_FILE); } if (check_configuration_permissions(conf_file) != 0) { exit(INVALID_CONFIG_FILE); } read_config(conf_file); free(conf_file); // look up the node manager group in the config file char *nm_group = get_value(NM_GROUP_KEY); if (nm_group == NULL) { fprintf(ERRORFILE, "Can't get configured value for %s.\n", NM_GROUP_KEY); exit(INVALID_CONFIG_FILE); } struct group *group_info = getgrnam(nm_group); if (group_info == NULL) { fprintf(ERRORFILE, "Can't get group information for %s - %s.\n", nm_group, strerror(errno)); fflush(LOGFILE); exit(INVALID_CONFIG_FILE); } set_nm_uid(getuid(), group_info->gr_gid); // if we are running from a setuid executable, make the real uid root setuid(0); // set the real and effective group id to the node manager group setgid(group_info->gr_gid); if (check_executor_permissions(executable_file) != 0) { fprintf(ERRORFILE, "Invalid permissions on container-executor binary.\n"); return INVALID_CONTAINER_EXEC_PERMISSIONS; } if (do_check_setup != 0) { // basic setup checks done // verified configs available and valid // verified executor permissions return 0; } //checks done for user name if (argv[optind] == NULL) { fprintf(ERRORFILE, "Invalid user name.\n"); return INVALID_USER_NAME; } int ret = set_user(argv[optind]); if (ret != 0) { return ret; } optind = optind + 1; command = atoi(argv[optind++]); fprintf(LOGFILE, "main : command provided %d\n",command); fprintf(LOGFILE, "main : user is %s\n", user_detail->pw_name); fflush(LOGFILE); switch (command) { case INITIALIZE_CONTAINER: if (argc < 6) { fprintf(ERRORFILE, "Too few arguments (%d vs 6) for initialize container\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } app_id = argv[optind++]; cred_file = argv[optind++]; exit_code = initialize_app(user_detail->pw_name, app_id, cred_file, argv + optind); break; case LAUNCH_CONTAINER: if (argc < 9) { fprintf(ERRORFILE, "Too few arguments (%d vs 9) for launch container\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } app_id = argv[optind++]; container_id = argv[optind++]; current_dir = argv[optind++]; script_file = argv[optind++]; cred_file = argv[optind++]; pid_file = argv[optind++]; exit_code = launch_container_as_user(user_detail->pw_name, app_id, container_id, current_dir, script_file, cred_file, pid_file); break; case SIGNAL_CONTAINER: if (argc < 5) { fprintf(ERRORFILE, "Too few arguments (%d vs 5) for signal container\n", argc); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } else { char* end_ptr = NULL; char* option = argv[optind++]; int container_pid = strtol(option, &end_ptr, 10); if (option == end_ptr || *end_ptr != '\0') { fprintf(ERRORFILE, "Illegal argument for container pid %s\n", option); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } option = argv[optind++]; int signal = strtol(option, &end_ptr, 10); if (option == end_ptr || *end_ptr != '\0') { fprintf(ERRORFILE, "Illegal argument for signal %s\n", option); fflush(ERRORFILE); return INVALID_ARGUMENT_NUMBER; } exit_code = signal_container_as_user(user_detail->pw_name, container_pid, signal); } break; case DELETE_AS_USER: dir_to_be_deleted = argv[optind++]; exit_code= delete_as_user(user_detail->pw_name, dir_to_be_deleted, argv + optind); break; default: fprintf(ERRORFILE, "Invalid command %d not supported.",command); fflush(ERRORFILE); exit_code = INVALID_COMMAND_PROVIDED; } fclose(LOGFILE); fclose(ERRORFILE); return exit_code; }