Linux syscall clone

clone与fork类似，都可以用来create一个新进程。与fork不同的是，clone 允许子进程与父进程共享一些运行时上下文资源，包括虚拟内存空间、fd table、signal handler table。

函数原型

glibc中定义的函数原型如下：

#define _GNU_SOURCE
#include <sched.h>

 int clone(int (*fn)(void *), void *child_stack,
                 int flags, void *arg, ...
                 /* pid_t *ptid, void *newtls, pid_t *ctid */ );

参数

  1. fn。子进程执行的函数指针。

  2 . child_stack。子线程栈指针。注意栈的增长是向下的，所以指定child_stack时习惯使用栈的高地址界限指针。

  3. flags。一些clone特性，具体可以查看man page。

  4. 其他不定参数。传递一些用户关心的参数。

返回值

成功返回子进程id

失败返回-1并设置errno

用例

#define _GNU_SOURCE
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sched.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <string.h>
#include <limits.h>
#include <sys/mount.h>

#define STACK_SIZE (1024 * 1024)
#define CLONE_FLAGS (CLONE_NEWUTS | CLONE_NEWCGROUP | CLONE_NEWIPC \
                      | CLONE_NEWNET | CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNS \
                      | SIGCHLD)

#define ERR_EXIT(msg) do { perror(msg);exit(EXIT_FAILURE);\
    }while(0)

struct container_t {
    char stack[STACK_SIZE];
    char *init_args[2];
    char *cname;
    int syncfd[2];
};
static int container_init(struct container_t *container) {
    sethostname(container->cname,strlen(container->cname));
    
    //mount("proc","/proc","proc",MS_PRIVATE,NULL);
    system("mount -t proc proc /proc");
    if(execv(container->init_args[0],container->init_args) == -1){
        ERR_EXIT("execv container error.");
    }

    return 0;
}
static int container_run(void *arg){
    struct container_t *container = (struct container_t*)arg;
    pid_t pid = getpid();
    printf("container: before execv  pid:%d\n",pid);
    
    close(container->syncfd[1]);
    char ch;
    if(read(container->syncfd[0],&ch,1) != 0){
        ERR_EXIT("contaienr:failed read syncfd");
    }
    close(container->syncfd[0]);
    return container_init(container);
}

void update_map(char *map,char *path) {
    size_t len;
    int fd;
    len = strlen(map);
    fd = open(path,O_RDWR);
    if(fd == -1){
        ERR_EXIT("open mapping file error.");
    }
    if(write(fd,map,len)!=len){
        ERR_EXIT("write mappiing file error.");
    }
}

void update_ugid_map(pid_t cpid){
    const int MAP_BUF_SIZE = 100;
    char map_buf[MAP_BUF_SIZE];
    char map_path[PATH_MAX];
    
    snprintf(map_buf,MAP_BUF_SIZE,"0 %ld 1",(long)getuid());
    snprintf(map_path,PATH_MAX,"/proc/%ld/uid_map",(long)cpid);
    update_map(map_buf,map_path);
    
    snprintf(map_buf,MAP_BUF_SIZE,"0 %ld 1",(long)getgid());
    snprintf(map_path,PATH_MAX,"/proc/%ld/gid_map",(long)cpid);
    update_map(map_buf,map_path);
}
int main(){
    struct container_t container = {
        .cname = "container_001",
        .init_args = {
            "/bin/bash",
            NULL,
        },
    };
    if(pipe(container.syncfd) == -1)
        ERR_EXIT("create syncfd error.");

    pid_t cpid = clone(container_run,container.stack + STACK_SIZE,CLONE_FLAGS,&container);
    if (cpid == -1){
        ERR_EXIT("clone child error.");
    }
    printf("main: cloned container pid:%d\n",cpid);
    update_ugid_map(cpid); 
    close(container.syncfd[1]); 
    waitpid(cpid,NULL,0);
    return 0;
}