feat(gvisor): prototype container start receiver

cmd/gvisor-start-probe/main_linux.go

@@ -0,0 +1,78 @@
+//go:build linux
+
+// Command gvisor-start-probe is a controlled experiment for the SecCheck
+// container/start point. It does not enable gVisor collection in node-agent.
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"github.com/kubescape/node-agent/pkg/gvisor"
+)
+
+func main() {
+	os.Exit(run())
+}
+
+func run() (exitCode int) {
+	socket := flag.String("socket", "/run/kubescape/gvisor-events.sock", "private Unix socket for the SecCheck remote sink")
+	containerID := flag.String("container-id", "", "exact container ID obtained independently from the local runtime before start")
+	flag.Parse()
+	if *containerID == "" {
+		fmt.Fprintln(os.Stderr, "container-id is required")
+		return 2
+	}
+	output, err := newJSONOutput(os.Stdout)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "gvisor start probe output: %v\n", err)
+		return 1
+	}
+	defer func() {
+		if err := output.Close(); err != nil {
+			fmt.Fprintf(os.Stderr, "gvisor start probe output cleanup: %v\n", err)
+			exitCode = 1
+		}
+	}()
+	signalCtx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	ctx, cancel := context.WithCancel(signalCtx)
+	defer cancel()
+	outputErrors := make(chan error, 1)
+	receiver := &gvisor.Receiver{
+		SocketPath: *socket,
+		Resolve: func(id string) bool {
+			return id == *containerID
+		},
+		OnStart: func(ctx context.Context, start gvisor.Start) {
+			if err := output.Encode(ctx, start); err != nil {
+				if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) ||
+					(ctx.Err() != nil && errors.Is(err, os.ErrDeadlineExceeded)) {
+					return
+				}
+				select {
+				case outputErrors <- err:
+				default:
+				}
+				cancel()
+			}
+		},
+	}
+	runErr := receiver.Run(ctx)
+	select {
+	case err := <-outputErrors:
+		fmt.Fprintf(os.Stderr, "gvisor start probe output: %v\n", err)
+		return 1
+	default:
+	}
+	if runErr != nil {
+		fmt.Fprintf(os.Stderr, "gvisor start probe: %v\n", runErr)
+		return 1
+	}
+	return 0
+}

cmd/gvisor-start-probe/main_linux_test.go

@@ -0,0 +1,133 @@
+//go:build linux
+
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"golang.org/x/sys/unix"
+	"google.golang.org/protobuf/encoding/protowire"
+)
+
+func TestProbeRestoresInheritedOutputFlags(t *testing.T) {
+	probeBinary := filepath.Join(t.TempDir(), "gvisor-start-probe")
+	build := exec.Command("go", "build", "-buildvcs=false", "-o", probeBinary, ".")
+	if output, err := build.CombinedOutput(); err != nil {
+		t.Fatalf("building probe: %v\n%s", err, output)
+	}
+	for _, mode := range []struct {
+		name  string
+		flags int
+	}{{"blocking", 0}, {"nonblocking", unix.O_NONBLOCK}} {
+		for _, scenario := range []string{"signal_exit", "invalid_socket_directory", "closed_output"} {
+			name := mode.name + "/" + scenario
+			t.Run(name, func(t *testing.T) {
+				fds := make([]int, 2)
+				if err := unix.Pipe2(fds, unix.O_CLOEXEC|mode.flags); err != nil {
+					t.Fatal(err)
+				}
+				reader := os.NewFile(uintptr(fds[0]), "reader")
+				writer := os.NewFile(uintptr(fds[1]), "writer")
+				defer reader.Close()
+				defer writer.Close()
+				if scenario == "closed_output" {
+					if err := reader.Close(); err != nil {
+						t.Fatal(err)
+					}
+				}
+				original, err := unix.FcntlInt(uintptr(fds[1]), unix.F_GETFL, 0)
+				if err != nil {
+					t.Fatal(err)
+				}
+				dir := t.TempDir()
+				if err := os.Chmod(dir, 0700); err != nil {
+					t.Fatal(err)
+				}
+				path := filepath.Join(dir, "events.sock")
+				if scenario == "invalid_socket_directory" {
+					path = filepath.Join(dir, "missing", "events.sock")
+				}
+				ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+				defer cancel()
+				cmd := exec.CommandContext(ctx, probeBinary, "--socket", path, "--container-id", "known")
+				cmd.Stdout = writer
+				var stderr bytes.Buffer
+				cmd.Stderr = &stderr
+				if err := cmd.Start(); err != nil {
+					t.Fatal(err)
+				}
+				if scenario != "invalid_socket_directory" {
+					deadline := time.Now().Add(3 * time.Second)
+					for {
+						if _, err := os.Lstat(path); err == nil {
+							break
+						}
+						if time.Now().After(deadline) {
+							_ = cmd.Process.Kill()
+							_ = cmd.Wait()
+							t.Fatalf("probe did not create socket: %s", stderr.String())
+						}
+						time.Sleep(20 * time.Millisecond)
+					}
+					if scenario == "closed_output" {
+						client := connectProbe(t, path)
+						handshake := protowire.AppendTag(nil, 1, protowire.VarintType)
+						handshake = protowire.AppendVarint(handshake, 1)
+						if _, err := unix.Write(client, handshake); err != nil {
+							t.Fatal(err)
+						}
+						if _, err := unix.Read(client, make([]byte, 32)); err != nil {
+							t.Fatal(err)
+						}
+						frame := make([]byte, 8)
+						binary.LittleEndian.PutUint16(frame[:2], 8)
+						binary.LittleEndian.PutUint16(frame[2:4], 1)
+						frame = protowire.AppendTag(frame, 2, protowire.BytesType)
+						frame = protowire.AppendString(frame, "known")
+						if _, err := unix.Write(client, frame); err != nil {
+							t.Fatal(err)
+						}
+						unix.Close(client)
+					} else if err := cmd.Process.Signal(syscall.SIGTERM); err != nil {
+						t.Fatal(err)
+					}
+				}
+				err = cmd.Wait()
+				if ctx.Err() != nil {
+					t.Fatalf("probe did not exit: %v", ctx.Err())
+				}
+				if scenario != "signal_exit" {
+					if cmd.ProcessState.ExitCode() != 1 || stderr.Len() == 0 {
+						t.Fatalf("expected probe failure: exit=%d stderr=%s", cmd.ProcessState.ExitCode(), stderr.String())
+					}
+					if scenario == "closed_output" && !strings.Contains(stderr.String(), "gvisor start probe output:") {
+						t.Fatalf("missing output failure diagnostic: %s", stderr.String())
+					}
+				} else if err != nil {
+					t.Fatalf("normal probe exit: %v\n%s", err, stderr.String())
+				}
+				after, err := unix.FcntlInt(uintptr(fds[1]), unix.F_GETFL, 0)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if after != original {
+					t.Fatalf("probe changed parent's output flags: before=%#x after=%#x", original, after)
+				}
+				if scenario != "invalid_socket_directory" {
+					if _, err := os.Lstat(path); !os.IsNotExist(err) {
+						t.Fatalf("socket remains after exit: %v", err)
+					}
+				}
+			})
+		}
+	}
+}

cmd/gvisor-start-probe/output_linux.go

@@ -0,0 +1,80 @@
+//go:build linux
+
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/kubescape/node-agent/pkg/gvisor"
+	"golang.org/x/sys/unix"
+)
+
+type jsonOutput struct {
+	file      *os.File
+	encoder   *json.Encoder
+	fd        uintptr
+	flags     int
+	closeOnce sync.Once
+	closeErr  error
+}
+
+func newJSONOutput(output *os.File) (*jsonOutput, error) {
+	// Inherited stdout may be a blocking pipe. Register a nonblocking duplicate
+	// with Go's poller so a write deadline can interrupt a full pipe. The probe
+	// must restore the shared flags before exiting. SyscallConn avoids Fd(),
+	// which can itself switch a Go-managed pipe back to blocking mode.
+	raw, err := output.SyscallConn()
+	if err != nil {
+		return nil, err
+	}
+	var flags, fd int
+	var setupErr error
+	if err := raw.Control(func(original uintptr) {
+		flags, setupErr = unix.FcntlInt(original, unix.F_GETFL, 0)
+		if setupErr == nil {
+			fd, setupErr = unix.FcntlInt(original, unix.F_DUPFD_CLOEXEC, 0)
+		}
+	}); err != nil {
+		return nil, err
+	}
+	if setupErr != nil {
+		return nil, setupErr
+	}
+	if err := unix.SetNonblock(fd, true); err != nil {
+		unix.Close(fd)
+		return nil, err
+	}
+	file := os.NewFile(uintptr(fd), "probe-output")
+	return &jsonOutput{file: file, encoder: json.NewEncoder(file), fd: uintptr(fd), flags: flags}, nil
+}
+
+// Close restores the inherited file description after all output has finished.
+func (o *jsonOutput) Close() error {
+	o.closeOnce.Do(func() {
+		_, restoreErr := unix.FcntlInt(o.fd, unix.F_SETFL, o.flags)
+		o.closeErr = errors.Join(restoreErr, o.file.Close())
+	})
+	return o.closeErr
+}
+
+func (o *jsonOutput) Encode(ctx context.Context, start gvisor.Start) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	interrupted := make(chan struct{})
+	stop := context.AfterFunc(ctx, func() {
+		// Regular files do not support deadlines; pipes and sockets do.
+		_ = o.file.SetWriteDeadline(time.Now())
+		close(interrupted)
+	})
+	err := o.encoder.Encode(start)
+	if !stop() {
+		<-interrupted
+	}
+	return err
+}