Why Does Calling Setns from Go Return EINVAL for the Mnt Namespace?

Calling Setns from Go Returns EINVAL for Mnt Namespace

Background

The goal is to enter the mnt namespace of a container using either C or Go code. However, the Go code consistently returns EINVAL from the setns call when attempting to enter the mnt namespace.

Working C Code

The following C code successfully enters all specified namespaces:

<code class="c">#include <sched.h>

main() {
    // ...
    for (i=0; i<5; i++) {
        setns(fd, 0); // Join the provided namespace
    }
}</code>

Failing Go Code

On the other hand, the equivalent Go code returns an EINVAL error for the mnt namespace:

<code class="go">import (
    "syscall"
)

func main() {
    // ...
    err := syscall.RawSyscall(308, fd, 0, 0) // Calling setns
    if err != 0 {
        fmt.Println("setns on", namespaces[i], "namespace failed")
    }
}</code>

Answer

The issue lies in the multi-threaded nature of Go. When Go calls setns from a multi-threaded context, it fails for the mnt namespace because it requires a single-threaded caller. To resolve this, the setns call must be made before the Go runtime creates any additional threads.

Solution: Single-Threaded Constructor Trick

One way to achieve this is to use the CGO constructor trick, where a C function is executed before Go starts up:

<code class="c">__attribute__((constructor)) void enter_namespace(void) { setns(...); }</code>

Adding this constructor to the Go code, along with hardcoding the PID, allows successful entry into the mnt namespace:

<code class="go">/*
__attribute__((constructor)) void enter_namespace(void) { ... }
*/
import "C"</code>

However, this approach requires hardcoding the PID, which is not ideal.

Alternative: Linux Kernel 4.16 and Above

In Linux kernel 4.16 and above, a new mode has been introduced for setns that allows it to be safely called from multi-threaded contexts. By using a modified version of the setns call that takes an additional argument (CLONE_IOCLONE_COMMON), it is possible to enter the mnt namespace from Go, even if it is multi-threaded.

The above is the detailed content of Why Does Calling Setns from Go Return EINVAL for the Mnt Namespace?. For more information, please follow other related articles on the PHP Chinese website!