libct/cg/dev: privatize some functions

These are only used from inside the package, and we don't want them to
be public.

The only two methods left are Enable and Disable.

While at it, fix or suppress found lint-extra warnings.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

libcontainer/cgroups/devices/devicefilter.go

@@ -22,14 +22,14 @@ const (
 	license = "Apache"
 )
 
-// DeviceFilter returns eBPF device filter program and its license string
-func DeviceFilter(rules []*devices.Rule) (asm.Instructions, string, error) {
+// deviceFilter returns eBPF device filter program and its license string.
+func deviceFilter(rules []*devices.Rule) (asm.Instructions, string, error) {
 	// Generate the minimum ruleset for the device rules we are given. While we
 	// don't care about minimum transitions in cgroupv2, using the emulator
 	// gives us a guarantee that the behaviour of devices filtering is the same
 	// as cgroupv1, including security hardenings to avoid misconfiguration
 	// (such as punching holes in wildcard rules).
-	emu := new(Emulator)
+	emu := new(emulator)
 	for _, rule := range rules {
 		if err := emu.Apply(*rule); err != nil {
 			return nil, "", err

libcontainer/cgroups/devices/devicefilter_test.go

@@ -21,7 +21,7 @@ func hash(s, comm string) string {
 }
 
 func testDeviceFilter(t testing.TB, devices []*devices.Rule, expectedStr string) {
-	insts, _, err := DeviceFilter(devices)
+	insts, _, err := deviceFilter(devices)
 	if err != nil {
 		t.Fatalf("%s: %v (devices: %+v)", t.Name(), err, devices)
 	}

libcontainer/cgroups/devices/devices_emulator.go

@@ -63,16 +63,16 @@ func (r deviceRules) orderedEntries() []deviceRule {
 	return rules
 }
 
-type Emulator struct {
+type emulator struct {
 	defaultAllow bool
 	rules        deviceRules
 }
 
-func (e *Emulator) IsBlacklist() bool {
+func (e *emulator) IsBlacklist() bool {
 	return e.defaultAllow
 }
 
-func (e *Emulator) IsAllowAll() bool {
+func (e *emulator) IsAllowAll() bool {
 	return e.IsBlacklist() && len(e.rules) == 0
 }
 
@@ -139,7 +139,7 @@ func parseLine(line string) (*deviceRule, error) {
 	return &rule, nil
 }
 
-func (e *Emulator) addRule(rule deviceRule) error { //nolint:unparam
+func (e *emulator) addRule(rule deviceRule) error { //nolint:unparam
 	if e.rules == nil {
 		e.rules = make(map[deviceMeta]devices.Permissions)
 	}
@@ -151,7 +151,7 @@ func (e *Emulator) addRule(rule deviceRule) error { //nolint:unparam
 	return nil
 }
 
-func (e *Emulator) rmRule(rule deviceRule) error {
+func (e *emulator) rmRule(rule deviceRule) error {
 	// Give an error if any of the permissions requested to be removed are
 	// present in a partially-matching wildcard rule, because such rules will
 	// be ignored by cgroupv1.
@@ -196,11 +196,11 @@ func (e *Emulator) rmRule(rule deviceRule) error {
 	return nil
 }
 
-func (e *Emulator) allow(rule *deviceRule) error {
+func (e *emulator) allow(rule *deviceRule) error {
 	// This cgroup is configured as a black-list. Reset the entire emulator,
 	// and put is into black-list mode.
 	if rule == nil || rule.meta.node == devices.WildcardDevice {
-		*e = Emulator{
+		*e = emulator{
 			defaultAllow: true,
 			rules:        nil,
 		}
@@ -216,11 +216,11 @@ func (e *Emulator) allow(rule *deviceRule) error {
 	return err
 }
 
-func (e *Emulator) deny(rule *deviceRule) error {
+func (e *emulator) deny(rule *deviceRule) error {
 	// This cgroup is configured as a white-list. Reset the entire emulator,
 	// and put is into white-list mode.
 	if rule == nil || rule.meta.node == devices.WildcardDevice {
-		*e = Emulator{
+		*e = emulator{
 			defaultAllow: false,
 			rules:        nil,
 		}
@@ -236,7 +236,7 @@ func (e *Emulator) deny(rule *deviceRule) error {
 	return err
 }
 
-func (e *Emulator) Apply(rule devices.Rule) error {
+func (e *emulator) Apply(rule devices.Rule) error {
 	if !rule.Type.CanCgroup() {
 		return fmt.Errorf("cannot add rule [%#v] with non-cgroup type %q", rule, rule.Type)
 	}
@@ -260,17 +260,17 @@ func (e *Emulator) Apply(rule devices.Rule) error {
 	return e.deny(innerRule)
 }
 
-// EmulatorFromList takes a reader to a "devices.list"-like source, and returns
+// emulatorFromList takes a reader to a "devices.list"-like source, and returns
 // a new Emulator that represents the state of the devices cgroup. Note that
 // black-list devices cgroups cannot be fully reconstructed, due to limitations
 // in the devices cgroup API. Instead, such cgroups are always treated as
 // "allow all" cgroups.
-func EmulatorFromList(list io.Reader) (*Emulator, error) {
+func emulatorFromList(list io.Reader) (*emulator, error) {
 	// Normally cgroups are in black-list mode by default, but the way we
 	// figure out the current mode is whether or not devices.list has an
 	// allow-all rule. So we default to a white-list, and the existence of an
 	// "a *:* rwm" entry will tell us otherwise.
-	e := &Emulator{
+	e := &emulator{
 		defaultAllow: false,
 	}
 
@@ -304,7 +304,7 @@ func EmulatorFromList(list io.Reader) (*Emulator, error) {
 // This function is the sole reason for all of Emulator -- to allow us
 // to figure out how to update a containers' cgroups without causing spurious
 // device errors (if possible).
-func (source *Emulator) Transition(target *Emulator) ([]*devices.Rule, error) {
+func (source *emulator) Transition(target *emulator) ([]*devices.Rule, error) { //nolint:revive // Ignore receiver-naming warning.
 	var transitionRules []*devices.Rule
 	oldRules := source.rules
 
@@ -373,8 +373,8 @@ func (source *Emulator) Transition(target *Emulator) ([]*devices.Rule, error) {
 // cgroup to the emulated filter state (note that this is not the same as a
 // default cgroupv1 cgroup -- which is allow-all). This is effectively just a
 // wrapper around Transition() with the source emulator being an empty cgroup.
-func (e *Emulator) Rules() ([]*devices.Rule, error) {
-	defaultCgroup := &Emulator{defaultAllow: false}
+func (e *emulator) Rules() ([]*devices.Rule, error) {
+	defaultCgroup := &emulator{defaultAllow: false}
 	return defaultCgroup.Transition(e)
 }
 

libcontainer/cgroups/devices/devices_emulator_test.go

@@ -31,19 +31,19 @@ import (
 func TestDeviceEmulatorLoad(t *testing.T) {
 	tests := []struct {
 		name, list string
-		expected   *Emulator
+		expected   *emulator
 	}{
 		{
 			name: "BlacklistMode",
 			list: `a *:* rwm`,
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: true,
 			},
 		},
 		{
 			name: "WhitelistBasic",
 			list: `c 4:2 rw`,
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: false,
 				rules: deviceRules{
 					{
@@ -57,7 +57,7 @@ func TestDeviceEmulatorLoad(t *testing.T) {
 		{
 			name: "WhitelistWildcard",
 			list: `b 0:* m`,
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: false,
 				rules: deviceRules{
 					{
@@ -72,7 +72,7 @@ func TestDeviceEmulatorLoad(t *testing.T) {
 			name: "WhitelistDuplicate",
 			list: `c *:* rwm
 c 1:1 r`,
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: false,
 				rules: deviceRules{
 					{
@@ -102,7 +102,7 @@ c 5:0 rwm
 c 5:2 rwm
 c 136:* rwm
 c 10:200 rwm`,
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: false,
 				rules: deviceRules{
 					{
@@ -205,7 +205,7 @@ c 10:200 rwm`,
 		test := test // capture range variable
 		t.Run(test.name, func(t *testing.T) {
 			list := bytes.NewBufferString(test.list)
-			emu, err := EmulatorFromList(list)
+			emu, err := emulatorFromList(list)
 			if err != nil && test.expected != nil {
 				t.Fatalf("unexpected failure when creating emulator: %v", err)
 			} else if err == nil && test.expected == nil {
@@ -223,7 +223,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 	tests := []struct {
 		name           string
 		rule           devices.Rule
-		base, expected *Emulator
+		base, expected *emulator
 	}{
 		// Switch between default modes.
 		{
@@ -235,7 +235,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rwm"),
 				Allow:       !baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -250,7 +250,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("r"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: !baseDefaultAllow,
 				rules:        nil,
 			},
@@ -264,11 +264,11 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rwm"),
 				Allow:       baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules:        nil,
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules:        nil,
 			},
@@ -282,7 +282,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rwm"),
 				Allow:       baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -297,7 +297,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("r"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules:        nil,
 			},
@@ -312,7 +312,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rm"),
 				Allow:       !baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -327,7 +327,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("r"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -357,7 +357,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rm"),
 				Allow:       !baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -367,7 +367,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("rwm"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -393,7 +393,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rm"),
 				Allow:       !baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -403,7 +403,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("rm"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -423,7 +423,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rm"),
 				Allow:       !baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -438,7 +438,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("rw"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -463,7 +463,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rm"),
 				Allow:       !baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -478,7 +478,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("rw"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -503,7 +503,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("r"),
 				Allow:       !baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -518,7 +518,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("rw"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -544,7 +544,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rm"),
 				Allow:       baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -559,7 +559,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("r"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -579,7 +579,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rw"),
 				Allow:       baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -589,7 +589,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("r"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -609,7 +609,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("rw"),
 				Allow:       baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -624,7 +624,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("r"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -644,7 +644,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("r"),
 				Allow:       baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -659,7 +659,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("r"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -686,7 +686,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("r"),
 				Allow:       baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -712,7 +712,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 				Permissions: devices.Permissions("r"),
 				Allow:       baseDefaultAllow,
 			},
-			base: &Emulator{
+			base: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -727,7 +727,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) {
 					}: devices.Permissions("r"),
 				},
 			},
-			expected: &Emulator{
+			expected: &emulator{
 				defaultAllow: baseDefaultAllow,
 				rules: deviceRules{
 					{
@@ -768,13 +768,13 @@ func TestDeviceEmulatorBlacklistApply(t *testing.T) {
 func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 	tests := []struct {
 		name           string
-		source, target *Emulator
+		source, target *emulator
 		expected       []*devices.Rule
 	}{
 		// No-op changes.
 		{
 			name: "Noop",
-			source: &Emulator{
+			source: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -784,7 +784,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 					}: devices.Permissions("wm"),
 				},
 			},
-			target: &Emulator{
+			target: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -800,7 +800,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 		// Switching modes.
 		{
 			name: "SwitchToOtherMode",
-			source: &Emulator{
+			source: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -810,7 +810,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 					}: devices.Permissions("rwm"),
 				},
 			},
-			target: &Emulator{
+			target: &emulator{
 				defaultAllow: !sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -842,7 +842,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 		// Rule changes.
 		{
 			name: "RuleAddition",
-			source: &Emulator{
+			source: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -852,7 +852,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 					}: devices.Permissions("rwm"),
 				},
 			},
-			target: &Emulator{
+			target: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -879,7 +879,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 		},
 		{
 			name: "RuleRemoval",
-			source: &Emulator{
+			source: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -894,7 +894,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 					}: devices.Permissions("rwm"),
 				},
 			},
-			target: &Emulator{
+			target: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -916,7 +916,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 		},
 		{
 			name: "RuleMultipleAdditionRemoval",
-			source: &Emulator{
+			source: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -931,7 +931,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 					}: devices.Permissions("rw"),
 				},
 			},
-			target: &Emulator{
+			target: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -954,7 +954,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 		// Modifying the access permissions.
 		{
 			name: "RulePartialAddition",
-			source: &Emulator{
+			source: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -964,7 +964,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 					}: devices.Permissions("r"),
 				},
 			},
-			target: &Emulator{
+			target: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -986,7 +986,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 		},
 		{
 			name: "RulePartialRemoval",
-			source: &Emulator{
+			source: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -996,7 +996,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 					}: devices.Permissions("rw"),
 				},
 			},
-			target: &Emulator{
+			target: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -1018,7 +1018,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 		},
 		{
 			name: "RulePartialBoth",
-			source: &Emulator{
+			source: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{
@@ -1028,7 +1028,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) {
 					}: devices.Permissions("rw"),
 				},
 			},
-			target: &Emulator{
+			target: &emulator{
 				defaultAllow: sourceDefaultAllow,
 				rules: deviceRules{
 					{

libcontainer/cgroups/devices/ebpf_linux.go

@@ -143,12 +143,12 @@ func haveBpfProgReplace() bool {
 	return haveBpfProgReplaceBool
 }
 
-// LoadAttachCgroupDeviceFilter installs eBPF device filter program to /sys/fs/cgroup/<foo> directory.
+// loadAttachCgroupDeviceFilter installs eBPF device filter program to /sys/fs/cgroup/<foo> directory.
 //
 // Requires the system to be running in cgroup2 unified-mode with kernel >= 4.15 .
 //
 // https://github.com/torvalds/linux/commit/ebc614f687369f9df99828572b1d85a7c2de3d92
-func LoadAttachCgroupDeviceFilter(insts asm.Instructions, license string, dirFd int) (func() error, error) {
+func loadAttachCgroupDeviceFilter(insts asm.Instructions, license string, dirFd int) (func() error, error) {
 	// Increase `ulimit -l` limit to avoid BPF_PROG_LOAD error (#2167).
 	// This limit is not inherited into the container.
 	memlockLimit := &unix.Rlimit{

libcontainer/cgroups/devices/systemd.go

@@ -30,7 +30,7 @@ func systemdProperties(r *configs.Resources) ([]systemdDbus.Property, error) {
 	}
 
 	// Figure out the set of rules.
-	configEmu := Emulator{}
+	configEmu := emulator{}
 	for _, rule := range r.Devices {
 		if err := configEmu.Apply(*rule); err != nil {
 			return nil, fmt.Errorf("unable to apply rule for systemd: %w", err)

libcontainer/cgroups/devices/v1.go

@@ -64,17 +64,17 @@ func setV1(path string, r *configs.Resources) error {
 	return nil
 }
 
-func loadEmulator(path string) (*Emulator, error) {
+func loadEmulator(path string) (*emulator, error) {
 	list, err := cgroups.ReadFile(path, "devices.list")
 	if err != nil {
 		return nil, err
 	}
-	return EmulatorFromList(bytes.NewBufferString(list))
+	return emulatorFromList(bytes.NewBufferString(list))
 }
 
-func buildEmulator(rules []*devices.Rule) (*Emulator, error) {
+func buildEmulator(rules []*devices.Rule) (*emulator, error) {
 	// This defaults to a white-list -- which is what we want!
-	emu := &Emulator{}
+	emu := &emulator{}
 	for _, rule := range rules {
 		if err := emu.Apply(*rule); err != nil {
 			return nil, err

libcontainer/cgroups/devices/v2.go

@@ -55,7 +55,7 @@ func setV2(dirPath string, r *configs.Resources) error {
 	if r.SkipDevices {
 		return nil
 	}
-	insts, license, err := DeviceFilter(r.Devices)
+	insts, license, err := deviceFilter(r.Devices)
 	if err != nil {
 		return err
 	}
@@ -64,7 +64,7 @@ func setV2(dirPath string, r *configs.Resources) error {
 		return fmt.Errorf("cannot get dir FD for %s", dirPath)
 	}
 	defer unix.Close(dirFD)
-	if _, err := LoadAttachCgroupDeviceFilter(insts, license, dirFD); err != nil {
+	if _, err := loadAttachCgroupDeviceFilter(insts, license, dirFD); err != nil {
 		if !canSkipEBPFError(r) {
 			return err
 		}