Isolation: Rename NXT_HAVE_CLONE -> NXT_HAVE_LINUX_NS.

Due to the need to replace our use of clone/__NR_clone on Linux with
fork(2)/unshare(2) for enabling Linux namespaces(7) to keep the
pthreads(7) API working.  Let's rename NXT_HAVE_CLONE to
NXT_HAVE_LINUX_NS, i.e name it after the feature, not how it's
implemented, then in future if we change how we do namespaces again we
don't have to rename this.

Reviewed-by: Alejandro Colomar <[email protected]>
Signed-off-by: Andrew Clayton <[email protected]>

Author: ac000

auto/isolation

@@ -4,29 +4,29 @@
 # Linux clone syscall.
 
 NXT_ISOLATION=NO
-NXT_HAVE_CLONE=NO
+NXT_HAVE_LINUX_NS=NO
 NXT_HAVE_CLONE_NEWUSER=NO
 NXT_HAVE_MOUNT=NO
 NXT_HAVE_UNMOUNT=NO
 NXT_HAVE_ROOTFS=NO
 
 nsflags="USER NS PID NET UTS CGROUP"
 
-nxt_feature="clone(2)"
-nxt_feature_name=NXT_HAVE_CLONE
+nxt_feature="Linux unshare()"
+nxt_feature_name=NXT_HAVE_LINUX_NS
 nxt_feature_run=no
 nxt_feature_incs=
 nxt_feature_libs=
-nxt_feature_test="#include <sys/wait.h>
-                  #include <sys/syscall.h>
+nxt_feature_test="#define _GNU_SOURCE
+                  #include <sched.h>
 
                   int main(void) {
-                      return SYS_clone | SIGCHLD;
+                      return unshare(0);
                   }"
 . auto/feature
 
 if [ $nxt_found = yes ]; then
-    NXT_HAVE_CLONE=YES
+    NXT_HAVE_LINUX_NS=YES
 
     # Test all isolation flags
     for flag in $nsflags; do

auto/sources

@@ -299,7 +299,7 @@ if [ "$NXT_HAVE_HPUX_SENDFILE" = "YES" \
 fi
 
 
-if [ "$NXT_HAVE_CLONE" = "YES" ]; then
+if [ "$NXT_HAVE_LINUX_NS" = "YES" ]; then
     NXT_LIB_SRCS="$NXT_LIB_SRCS $NXT_LIB_CLONE_SRCS"
 fi
 

src/nxt_clone.c

@@ -8,7 +8,7 @@
 #include <nxt_conf.h>
 #include <nxt_clone.h>
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
 
 pid_t
 nxt_clone(nxt_int_t flags)

src/nxt_credential.c

@@ -286,7 +286,7 @@ nxt_credential_setuid(nxt_task_t *task, nxt_credential_t *uc)
 
     if (setuid(uc->uid) != 0) {
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
         if (nxt_errno == EINVAL) {
             nxt_log(task, NXT_LOG_ERR, "The uid %d (user \"%s\") isn't "
                     "valid in the application namespace.", uc->uid, uc->user);
@@ -314,7 +314,7 @@ nxt_credential_setgids(nxt_task_t *task, nxt_credential_t *uc)
 
     if (setgid(uc->base_gid) != 0) {
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
         if (nxt_errno == EINVAL) {
             nxt_log(task, NXT_LOG_ERR, "The gid %d isn't valid in the "
                     "application namespace.", uc->base_gid);
@@ -333,7 +333,7 @@ nxt_credential_setgids(nxt_task_t *task, nxt_credential_t *uc)
     if (nxt_slow_path(uc->ngroups > 0
                       && setgroups(uc->ngroups, uc->gids) != 0)) {
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
         if (nxt_errno == EINVAL) {
             nxt_log(task, NXT_LOG_ERR, "The user \"%s\" (uid: %d) has "
                     "supplementary group ids not valid in the application "

src/nxt_isolation.c

@@ -21,7 +21,7 @@ static nxt_int_t nxt_isolation_set_cgroup(nxt_task_t *task,
     nxt_conf_value_t *isolation, nxt_process_t *process);
 #endif
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
 static nxt_int_t nxt_isolation_set_namespaces(nxt_task_t *task,
     nxt_conf_value_t *isolation, nxt_process_t *process);
 static nxt_int_t nxt_isolation_clone_flags(nxt_task_t *task,
@@ -169,7 +169,7 @@ nxt_isolation_set(nxt_task_t *task, nxt_conf_value_t *isolation,
     }
 #endif
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
     if (nxt_slow_path(nxt_isolation_set_namespaces(task, isolation, process)
                       != NXT_OK))
     {
@@ -247,7 +247,7 @@ nxt_isolation_set_cgroup(nxt_task_t *task, nxt_conf_value_t *isolation,
 #endif
 
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
 
 static nxt_int_t
 nxt_isolation_set_namespaces(nxt_task_t *task, nxt_conf_value_t *isolation,
@@ -409,7 +409,7 @@ nxt_isolation_vldt_creds(nxt_task_t *task, nxt_process_t *process)
 #endif
 
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
 
 static nxt_int_t
 nxt_isolation_clone_flags(nxt_task_t *task, nxt_conf_value_t *namespaces,

src/nxt_main_process.c

@@ -556,7 +556,7 @@ nxt_main_process_created_handler(nxt_task_t *task, nxt_port_recv_msg_t *msg)
     nxt_assert(process != NULL);
     nxt_assert(process->state == NXT_PROCESS_STATE_CREATING);
 
-#if (NXT_HAVE_CLONE && NXT_HAVE_CLONE_NEWUSER)
+#if (NXT_HAVE_LINUX_NS && NXT_HAVE_CLONE_NEWUSER)
     if (nxt_is_clone_flag_set(process->isolation.clone.flags, NEWUSER)) {
         if (nxt_slow_path(nxt_clone_credential_map(task, process->pid,
                                                    process->user_cred,

src/nxt_process.c

@@ -7,7 +7,7 @@
 #include <nxt_main.h>
 #include <nxt_cgroup.h>
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
 #include <nxt_clone.h>
 #endif
 
@@ -18,7 +18,7 @@
 #endif
 
 
-#if (NXT_HAVE_CLONE) && (NXT_HAVE_CLONE_NEWPID)
+#if (NXT_HAVE_LINUX_NS) && (NXT_HAVE_CLONE_NEWPID)
 #define nxt_is_pid_isolated(process)                                          \
     nxt_is_clone_flag_set(process->isolation.clone.flags, NEWPID)
 #else
@@ -318,7 +318,7 @@ nxt_process_create(nxt_task_t *task, nxt_process_t *process)
     nxt_pid_t      pid;
     nxt_runtime_t  *rt;
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
     pid = nxt_clone(SIGCHLD | process->isolation.clone.flags);
     if (nxt_slow_path(pid < 0)) {
         nxt_alert(task, "clone() failed for %s %E", process->name, nxt_errno);
@@ -355,7 +355,7 @@ nxt_process_create(nxt_task_t *task, nxt_process_t *process)
 
     /* Parent. */
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
     nxt_debug(task, "clone(%s): %PI", process->name, pid);
 #else
     nxt_debug(task, "fork(%s): %PI", process->name, pid);
@@ -781,7 +781,7 @@ nxt_process_apply_creds(nxt_task_t *task, nxt_process_t *process)
 
     cap_setid = rt->capabilities.setid;
 
-#if (NXT_HAVE_CLONE && NXT_HAVE_CLONE_NEWUSER)
+#if (NXT_HAVE_LINUX_NS && NXT_HAVE_CLONE_NEWUSER)
     if (!cap_setid
         && nxt_is_clone_flag_set(process->isolation.clone.flags, NEWUSER))
     {

src/nxt_process.h

@@ -7,13 +7,13 @@
 #ifndef _NXT_PROCESS_H_INCLUDED_
 #define _NXT_PROCESS_H_INCLUDED_
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
 #include <unistd.h>
 #include <nxt_clone.h>
 #endif
 
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
 /*
  * Old glibc wrapper for getpid(2) returns a cached pid invalidated only by
  * fork(2) calls.  As we use clone(2) for container, it returns the wrong pid.
@@ -100,7 +100,7 @@ typedef struct {
     nxt_cgroup_t             cgroup;
 #endif
 
-#if (NXT_HAVE_CLONE)
+#if (NXT_HAVE_LINUX_NS)
     nxt_clone_t              clone;
 #endif