1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
// Package modprobe attempts to load kernel modules. It may have more success
// than simply running "modprobe", particularly for docker-in-docker.
package modprobe
import (
"context"
"errors"
"fmt"
"os/exec"
"strings"
"github.com/containerd/log"
"golang.org/x/sys/unix"
)
// LoadModules attempts to load kernel modules, if necessary.
//
// isLoaded must be a function that checks whether the modules are loaded. It may
// be called multiple times. isLoaded must return an error to indicate that the
// modules still need to be loaded, otherwise nil.
//
// For each method of loading modules, LoadModules will attempt the load for each
// of modNames, then it will call isLoaded to check the result - moving on to try
// the next method if needed, and there is one.
//
// The returned error is the result of the final call to isLoaded.
func LoadModules(ctx context.Context, isLoaded func() error, modNames ...string) error {
if isLoaded() == nil {
log.G(ctx).WithFields(log.Fields{
"modules": modNames,
}).Debug("Modules already loaded")
return nil
}
if err := tryLoad(ctx, isLoaded, modNames, ioctlLoader{}); err != nil {
return tryLoad(ctx, isLoaded, modNames, modprobeLoader{})
}
return nil
}
type loader interface {
name() string
load(modName string) error
}
func tryLoad(ctx context.Context, isLoaded func() error, modNames []string, loader loader) error {
var loadErrs []error
for _, modName := range modNames {
if err := loader.load(modName); err != nil {
loadErrs = append(loadErrs, err)
}
}
if checkResult := isLoaded(); checkResult != nil {
log.G(ctx).WithFields(log.Fields{
"loader": loader.name(),
"modules": modNames,
"loadErrors": errors.Join(loadErrs...),
"checkResult": checkResult,
}).Debug("Modules not loaded")
return checkResult
}
log.G(ctx).WithFields(log.Fields{
"loader": loader.name(),
"modules": modNames,
"loadErrors": errors.Join(loadErrs...),
}).Debug("Modules loaded")
return nil
}
// ioctlLoader attempts to load the module using an ioctl() to get the interface index
// of a module - it won't have one, but the kernel may load the module. This tends to
// work in docker-in-docker, where the inner-docker may not have "modprobe" or access
// to modules in the host's filesystem.
type ioctlLoader struct{}
func (il ioctlLoader) name() string { return "ioctl" }
func (il ioctlLoader) load(modName string) error {
sd, err := unix.Socket(unix.AF_INET, unix.SOCK_DGRAM, 0)
if err != nil {
return fmt.Errorf("creating socket for ioctl load of %s: %w", modName, err)
}
defer unix.Close(sd)
// This tends to work, if running with CAP_SYS_MODULE, because...
// https://github.com/torvalds/linux/blob/6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c/net/core/dev_ioctl.c#L457
// https://github.com/torvalds/linux/blob/6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c/net/core/dev_ioctl.c#L371-L372
ifreq, err := unix.NewIfreq(modName)
if err != nil {
return fmt.Errorf("creating ifreq for %s: %w", modName, err)
}
// An error is returned even if the module load is successful. So, ignore it.
_ = unix.IoctlIfreq(sd, unix.SIOCGIFINDEX, ifreq)
return nil
}
// modprobeLoader attempts to load a kernel module using modprobe.
type modprobeLoader struct{}
func (ml modprobeLoader) name() string { return "modprobe" }
func (ml modprobeLoader) load(modName string) error {
out, err := exec.Command("modprobe", "-va", modName).CombinedOutput()
if err != nil {
return fmt.Errorf("modprobe %s failed with message: %q, error: %w", modName, strings.TrimSpace(string(out)), err)
}
return nil
}
|
