youki-dev
diff --git a/‎.typos.toml‎
Lines changed: 4 additions & 0 deletions b/‎.typos.toml‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎crates/libcontainer/src/container/builder_impl.rs‎
Lines changed: 26 additions & 2 deletions b/‎crates/libcontainer/src/container/builder_impl.rs‎
Lines changed: 26 additions & 2 deletions
diff --git a/‎crates/libcontainer/src/container/init_builder.rs‎
Lines changed: 2 additions & 0 deletions b/‎crates/libcontainer/src/container/init_builder.rs‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎crates/libcontainer/src/container/tenant_builder.rs‎
Lines changed: 47 additions & 7 deletions b/‎crates/libcontainer/src/container/tenant_builder.rs‎
Lines changed: 47 additions & 7 deletions
diff --git a/‎crates/liboci-cli/src/exec.rs‎
Lines changed: 0 additions & 2 deletions b/‎crates/liboci-cli/src/exec.rs‎
Lines changed: 0 additions & 2 deletions
diff --git a/‎crates/youki/src/commands/exec.rs‎
Lines changed: 5 additions & 2 deletions b/‎crates/youki/src/commands/exec.rs‎
Lines changed: 5 additions & 2 deletions
@@ -13,6 +13,10 @@ extend-exclude = [
 # instance than write a regex.
 569d5ce3afe1074769f67 = "569d5ce3afe1074769f67"
 
+[default.extend-words]
+# This is the capabilities used in the exec integration test
+Inh = "Inh"
+
 [type.rust.extend-words]
 ser = "ser"
 flate = "flate"
 
@@ -17,6 +17,7 @@ use crate::process::{self};
 use crate::syscall::syscall::SyscallType;
 use crate::user_ns::UserNamespaceConfig;
 use crate::utils;
+use crate::utils::PathBufExt;
 use crate::workload::Executor;
 
 pub(super) struct ContainerBuilderImpl {
@@ -59,6 +60,12 @@ pub(super) struct ContainerBuilderImpl {
     pub stderr: Option<OwnedFd>,
     // Indicate if the init process should be a sibling of the main process.
     pub as_sibling: bool,
+    // Run the process in an (existing) sub-cgroup(s)
+    pub sub_cgroup_path: Option<String>,
+    // Asm process label for the process commonly used with selinux.
+    // TODO: youki does not support selinux yet
+    #[allow(dead_code)]
+    pub process_label: Option<String>,
 }
 
 impl ContainerBuilderImpl {
@@ -85,9 +92,26 @@ impl ContainerBuilderImpl {
 
     fn run_container(&mut self) -> Result<Pid, LibcontainerError> {
         let linux = self.spec.linux().as_ref().ok_or(MissingSpecError::Linux)?;
-        let cgroups_path = utils::get_cgroup_path(linux.cgroups_path(), &self.container_id);
+        let base_cgroups_path = utils::get_cgroup_path(linux.cgroups_path(), &self.container_id);
+        let mut final_cgroups_path = base_cgroups_path;
+
+        if let Some(sub_cgroup_path) = &self.sub_cgroup_path {
+            if sub_cgroup_path != "/" {
+                let potential_path = final_cgroups_path.join(sub_cgroup_path);
+                let normalized = potential_path.normalize();
+
+                if !normalized.starts_with(&final_cgroups_path) {
+                    return Err(LibcontainerError::OtherCgroup(format!(
+                        "{} is not a sub cgroup path",
+                        sub_cgroup_path
+                    )));
+                }
+                final_cgroups_path = normalized;
+            }
+        }
+
         let cgroup_config = libcgroups::common::CgroupConfig {
-            cgroup_path: cgroups_path,
+            cgroup_path: final_cgroups_path,
             systemd_cgroup: self.use_systemd || self.user_ns_config.is_some(),
             container_name: self.container_id.to_owned(),
         };
 
@@ -117,6 +117,8 @@ impl InitContainerBuilder {
             stdout: self.base.stdout,
             stderr: self.base.stderr,
             as_sibling: self.as_sibling,
+            sub_cgroup_path: None,
+            process_label: None,
         };
 
         builder_impl.create()?;
 
@@ -21,6 +21,7 @@ use procfs::process::Namespace;
 use super::Container;
 use super::builder::ContainerBuilder;
 use crate::capabilities::CapabilityExt;
+use crate::container::ContainerStatus;
 use crate::container::builder_impl::ContainerBuilderImpl;
 use crate::error::{ErrInvalidSpec, LibcontainerError, MissingSpecError};
 use crate::notify_socket::NotifySocket;
@@ -48,6 +49,10 @@ pub struct TenantContainerBuilder {
     additional_gids: Vec<u32>,
     user: Option<u32>,
     group: Option<u32>,
+    ignore_paused: bool,
+    sub_cgroup: Option<String>,
+    process_label: Option<String>,
+    apparmor: Option<String>,
 }
 
 /// This is a helper function to get capabilities for tenant container, based on
@@ -143,6 +148,10 @@ impl TenantContainerBuilder {
             additional_gids: vec![],
             user: None,
             group: None,
+            ignore_paused: false,
+            sub_cgroup: None,
+            process_label: None,
+            apparmor: None,
         }
     }
 
@@ -206,6 +215,26 @@ impl TenantContainerBuilder {
         self
     }
 
+    pub fn with_ignore_paused(mut self, ignore_paused: bool) -> Self {
+        self.ignore_paused = ignore_paused;
+        self
+    }
+
+    pub fn with_sub_cgroup(mut self, sub_cgroup: Option<String>) -> Self {
+        self.sub_cgroup = sub_cgroup;
+        self
+    }
+
+    pub fn with_process_label(mut self, process_label: Option<String>) -> Self {
+        self.process_label = process_label;
+        self
+    }
+
+    pub fn with_apparmor(mut self, apparmor: Option<String>) -> Self {
+        self.apparmor = apparmor;
+        self
+    }
+
     /// Joins an existing container
     pub fn build(self) -> Result<Pid, LibcontainerError> {
         let container_dir = self.lookup_container_dir()?;
@@ -252,6 +281,8 @@ impl TenantContainerBuilder {
             stdout: self.base.stdout,
             stderr: self.base.stderr,
             as_sibling: self.as_sibling,
+            sub_cgroup_path: self.sub_cgroup,
+            process_label: self.process_label,
         };
 
         let pid = builder_impl.create()?;
@@ -419,12 +450,15 @@ impl TenantContainerBuilder {
 
     fn load_container_state(&self, container_dir: PathBuf) -> Result<Container, LibcontainerError> {
         let container = Container::load(container_dir)?;
-        if !container.can_exec() {
-            tracing::error!(status = ?container.status(), "cannot exec as container");
-            return Err(LibcontainerError::IncorrectStatus(container.status()));
-        }
 
-        Ok(container)
+        match container.status() {
+            ContainerStatus::Running => Ok(container),
+            ContainerStatus::Paused if self.ignore_paused => Ok(container),
+            _ => {
+                tracing::error!(status = ?container.status(), "cannot exec: invalid container state");
+                Err(LibcontainerError::IncorrectStatus(container.status()))
+            }
+        }
     }
 
     fn adapt_spec_for_tenant(
@@ -454,10 +488,14 @@ impl TenantContainerBuilder {
                 }
             }
 
-            if let Some(no_new_priv) = self.get_no_new_privileges() {
+            if let Some(no_new_priv) = self.get_no_new_privileges(spec) {
                 process_builder = process_builder.no_new_privileges(no_new_priv);
             }
 
+            if let Some(ref apparmor) = self.apparmor {
+                process_builder = process_builder.apparmor_profile(apparmor)
+            }
+
             let capabilities = get_capabilities(&self.capabilities, spec)?;
             process_builder = process_builder.capabilities(capabilities);
 
@@ -564,8 +602,10 @@ impl TenantContainerBuilder {
         env
     }
 
-    fn get_no_new_privileges(&self) -> Option<bool> {
+    fn get_no_new_privileges(&self, spec: &Spec) -> Option<bool> {
         self.no_new_privs
+            .filter(|&is_set| is_set)
+            .or_else(|| spec.process().as_ref().and_then(|p| p.no_new_privileges()))
     }
 
     fn get_namespaces(
 
@@ -55,11 +55,9 @@ pub struct Exec {
     /// Execute a process in a sub-cgroup
     #[clap(long)]
     pub cgroup: Option<String>,
-
     /// Container identifier
     #[clap(value_parser = clap::builder::NonEmptyStringValueParser::new(), required = true)]
     pub container_id: String,
-
     /// Command that should be executed in the container
     #[clap(required = false, trailing_var_arg = true)]
     pub command: Vec<String>,
 
@@ -9,8 +9,6 @@ use nix::sys::wait::{WaitStatus, waitpid};
 use crate::workload::executor::default_executor;
 
 pub fn exec(args: Exec, root_path: PathBuf) -> Result<i32> {
-    // TODO: not all values from exec are used here. We need to support
-    // the remaining ones.
     let user = args.user.map(|(u, _)| u);
     let group = args.user.and_then(|(_, g)| g);
 
@@ -19,6 +17,7 @@ pub fn exec(args: Exec, root_path: PathBuf) -> Result<i32> {
         .with_root_path(root_path)?
         .with_console_socket(args.console_socket.as_ref())
         .with_pid_file(args.pid_file.as_ref())?
+        .with_preserved_fds(args.preserve_fds)
         .validate_id()?
         .as_tenant()
         .with_detach(args.detach)
@@ -30,6 +29,10 @@ pub fn exec(args: Exec, root_path: PathBuf) -> Result<i32> {
         .with_additional_gids(args.additional_gids)
         .with_user(user)
         .with_group(group)
+        .with_capabilities(args.cap)
+        .with_ignore_paused(args.ignore_paused)
+        .with_sub_cgroup(args.cgroup)
+        .with_apparmor(args.apparmor)
         .build()?;
 
     // See https://github.com/youki-dev/youki/pull/1252 for a detailed explanation