mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

ensure the path is a sub-cgroup path

Browse Source 
Signed-off-by: lifubang <lifubang@acmcoder.com>
(cherry picked from commit 01f00e1fd5)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
lifubang
2022-02-18 08:18:27 +08:00
committed by Kir Kolyshkin
parent b9460f26b4
commit 35784a3e6a
2 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/container_linux.go
+10 -2
View File
@@ -636,7 +636,11 @@ func (c *linuxContainer) newSetnsProcess(p *Process, cmd *exec.Cmd, messageSockP
// cgroup v1: using the same path for all controllers.
// cgroup v2: the only possible way.
for k := range proc.cgroupPaths {
proc.cgroupPaths[k] = path.Join(proc.cgroupPaths[k], add)
subPath := path.Join(proc.cgroupPaths[k], add)
if !strings.HasPrefix(subPath, proc.cgroupPaths[k]) {
return nil, fmt.Errorf("%s is not a sub cgroup path", add)
}
proc.cgroupPaths[k] = subPath
}
// cgroup v2: do not try to join init process's cgroup
// as a fallback (see (*setnsProcess).start).
@@ -645,7 +649,11 @@ func (c *linuxContainer) newSetnsProcess(p *Process, cmd *exec.Cmd, messageSockP
// Per-controller paths.
for ctrl, add := range p.SubCgroupPaths {
if val, ok := proc.cgroupPaths[ctrl]; ok {
proc.cgroupPaths[ctrl] = path.Join(val, add)
subPath := path.Join(val, add)
if !strings.HasPrefix(subPath, val) {
return nil, fmt.Errorf("%s is not a sub cgroup path", add)
}
proc.cgroupPaths[ctrl] = subPath
} else {
return nil, fmt.Errorf("unknown controller %s in SubCgroupPaths", ctrl)
}
tests/integration/exec.bats
+10
View File
@@ -197,6 +197,11 @@ function check_exec_debug() {
__runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
testcontainer test_busybox running
# Check we can't join parent cgroup.
runc exec --cgroup ".." test_busybox cat /proc/self/cgroup
[ "$status" -ne 0 ]
[[ "$output" == *" .. is not a sub cgroup path"* ]]
# Check we can't join non-existing subcgroup.
runc exec --cgroup nonexistent test_busybox cat /proc/self/cgroup
[ "$status" -ne 0 ]
@@ -243,6 +248,11 @@ function check_exec_debug() {
__runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
testcontainer test_busybox running
# Check we can't join parent cgroup.
runc exec --cgroup ".." test_busybox cat /proc/self/cgroup
[ "$status" -ne 0 ]
[[ "$output" == *" .. is not a sub cgroup path"* ]]
# Check we can't join non-existing subcgroup.
runc exec --cgroup nonexistent test_busybox cat /proc/self/cgroup
[ "$status" -ne 0 ]