diff --git a/libcontainer/cgroups/devices/devicefilter.go b/libcontainer/cgroups/devices/devicefilter.go index 3849810b3..c8cfb5ab5 100644 --- a/libcontainer/cgroups/devices/devicefilter.go +++ b/libcontainer/cgroups/devices/devicefilter.go @@ -22,14 +22,14 @@ const ( license = "Apache" ) -// DeviceFilter returns eBPF device filter program and its license string -func DeviceFilter(rules []*devices.Rule) (asm.Instructions, string, error) { +// deviceFilter returns eBPF device filter program and its license string. +func deviceFilter(rules []*devices.Rule) (asm.Instructions, string, error) { // Generate the minimum ruleset for the device rules we are given. While we // don't care about minimum transitions in cgroupv2, using the emulator // gives us a guarantee that the behaviour of devices filtering is the same // as cgroupv1, including security hardenings to avoid misconfiguration // (such as punching holes in wildcard rules). - emu := new(Emulator) + emu := new(emulator) for _, rule := range rules { if err := emu.Apply(*rule); err != nil { return nil, "", err diff --git a/libcontainer/cgroups/devices/devicefilter_test.go b/libcontainer/cgroups/devices/devicefilter_test.go index 7cabf0673..7b6424d33 100644 --- a/libcontainer/cgroups/devices/devicefilter_test.go +++ b/libcontainer/cgroups/devices/devicefilter_test.go @@ -21,7 +21,7 @@ func hash(s, comm string) string { } func testDeviceFilter(t testing.TB, devices []*devices.Rule, expectedStr string) { - insts, _, err := DeviceFilter(devices) + insts, _, err := deviceFilter(devices) if err != nil { t.Fatalf("%s: %v (devices: %+v)", t.Name(), err, devices) } diff --git a/libcontainer/cgroups/devices/devices_emulator.go b/libcontainer/cgroups/devices/devices_emulator.go index 6c61ee4c0..3e1f49f0f 100644 --- a/libcontainer/cgroups/devices/devices_emulator.go +++ b/libcontainer/cgroups/devices/devices_emulator.go @@ -63,16 +63,16 @@ func (r deviceRules) orderedEntries() []deviceRule { return rules } -type Emulator struct { +type emulator struct { defaultAllow bool rules deviceRules } -func (e *Emulator) IsBlacklist() bool { +func (e *emulator) IsBlacklist() bool { return e.defaultAllow } -func (e *Emulator) IsAllowAll() bool { +func (e *emulator) IsAllowAll() bool { return e.IsBlacklist() && len(e.rules) == 0 } @@ -139,7 +139,7 @@ func parseLine(line string) (*deviceRule, error) { return &rule, nil } -func (e *Emulator) addRule(rule deviceRule) error { //nolint:unparam +func (e *emulator) addRule(rule deviceRule) error { //nolint:unparam if e.rules == nil { e.rules = make(map[deviceMeta]devices.Permissions) } @@ -151,7 +151,7 @@ func (e *Emulator) addRule(rule deviceRule) error { //nolint:unparam return nil } -func (e *Emulator) rmRule(rule deviceRule) error { +func (e *emulator) rmRule(rule deviceRule) error { // Give an error if any of the permissions requested to be removed are // present in a partially-matching wildcard rule, because such rules will // be ignored by cgroupv1. @@ -196,11 +196,11 @@ func (e *Emulator) rmRule(rule deviceRule) error { return nil } -func (e *Emulator) allow(rule *deviceRule) error { +func (e *emulator) allow(rule *deviceRule) error { // This cgroup is configured as a black-list. Reset the entire emulator, // and put is into black-list mode. if rule == nil || rule.meta.node == devices.WildcardDevice { - *e = Emulator{ + *e = emulator{ defaultAllow: true, rules: nil, } @@ -216,11 +216,11 @@ func (e *Emulator) allow(rule *deviceRule) error { return err } -func (e *Emulator) deny(rule *deviceRule) error { +func (e *emulator) deny(rule *deviceRule) error { // This cgroup is configured as a white-list. Reset the entire emulator, // and put is into white-list mode. if rule == nil || rule.meta.node == devices.WildcardDevice { - *e = Emulator{ + *e = emulator{ defaultAllow: false, rules: nil, } @@ -236,7 +236,7 @@ func (e *Emulator) deny(rule *deviceRule) error { return err } -func (e *Emulator) Apply(rule devices.Rule) error { +func (e *emulator) Apply(rule devices.Rule) error { if !rule.Type.CanCgroup() { return fmt.Errorf("cannot add rule [%#v] with non-cgroup type %q", rule, rule.Type) } @@ -260,17 +260,17 @@ func (e *Emulator) Apply(rule devices.Rule) error { return e.deny(innerRule) } -// EmulatorFromList takes a reader to a "devices.list"-like source, and returns +// emulatorFromList takes a reader to a "devices.list"-like source, and returns // a new Emulator that represents the state of the devices cgroup. Note that // black-list devices cgroups cannot be fully reconstructed, due to limitations // in the devices cgroup API. Instead, such cgroups are always treated as // "allow all" cgroups. -func EmulatorFromList(list io.Reader) (*Emulator, error) { +func emulatorFromList(list io.Reader) (*emulator, error) { // Normally cgroups are in black-list mode by default, but the way we // figure out the current mode is whether or not devices.list has an // allow-all rule. So we default to a white-list, and the existence of an // "a *:* rwm" entry will tell us otherwise. - e := &Emulator{ + e := &emulator{ defaultAllow: false, } @@ -304,7 +304,7 @@ func EmulatorFromList(list io.Reader) (*Emulator, error) { // This function is the sole reason for all of Emulator -- to allow us // to figure out how to update a containers' cgroups without causing spurious // device errors (if possible). -func (source *Emulator) Transition(target *Emulator) ([]*devices.Rule, error) { +func (source *emulator) Transition(target *emulator) ([]*devices.Rule, error) { //nolint:revive // Ignore receiver-naming warning. var transitionRules []*devices.Rule oldRules := source.rules @@ -373,8 +373,8 @@ func (source *Emulator) Transition(target *Emulator) ([]*devices.Rule, error) { // cgroup to the emulated filter state (note that this is not the same as a // default cgroupv1 cgroup -- which is allow-all). This is effectively just a // wrapper around Transition() with the source emulator being an empty cgroup. -func (e *Emulator) Rules() ([]*devices.Rule, error) { - defaultCgroup := &Emulator{defaultAllow: false} +func (e *emulator) Rules() ([]*devices.Rule, error) { + defaultCgroup := &emulator{defaultAllow: false} return defaultCgroup.Transition(e) } diff --git a/libcontainer/cgroups/devices/devices_emulator_test.go b/libcontainer/cgroups/devices/devices_emulator_test.go index 4dac242cf..51c1f521e 100644 --- a/libcontainer/cgroups/devices/devices_emulator_test.go +++ b/libcontainer/cgroups/devices/devices_emulator_test.go @@ -31,19 +31,19 @@ import ( func TestDeviceEmulatorLoad(t *testing.T) { tests := []struct { name, list string - expected *Emulator + expected *emulator }{ { name: "BlacklistMode", list: `a *:* rwm`, - expected: &Emulator{ + expected: &emulator{ defaultAllow: true, }, }, { name: "WhitelistBasic", list: `c 4:2 rw`, - expected: &Emulator{ + expected: &emulator{ defaultAllow: false, rules: deviceRules{ { @@ -57,7 +57,7 @@ func TestDeviceEmulatorLoad(t *testing.T) { { name: "WhitelistWildcard", list: `b 0:* m`, - expected: &Emulator{ + expected: &emulator{ defaultAllow: false, rules: deviceRules{ { @@ -72,7 +72,7 @@ func TestDeviceEmulatorLoad(t *testing.T) { name: "WhitelistDuplicate", list: `c *:* rwm c 1:1 r`, - expected: &Emulator{ + expected: &emulator{ defaultAllow: false, rules: deviceRules{ { @@ -102,7 +102,7 @@ c 5:0 rwm c 5:2 rwm c 136:* rwm c 10:200 rwm`, - expected: &Emulator{ + expected: &emulator{ defaultAllow: false, rules: deviceRules{ { @@ -205,7 +205,7 @@ c 10:200 rwm`, test := test // capture range variable t.Run(test.name, func(t *testing.T) { list := bytes.NewBufferString(test.list) - emu, err := EmulatorFromList(list) + emu, err := emulatorFromList(list) if err != nil && test.expected != nil { t.Fatalf("unexpected failure when creating emulator: %v", err) } else if err == nil && test.expected == nil { @@ -223,7 +223,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { tests := []struct { name string rule devices.Rule - base, expected *Emulator + base, expected *emulator }{ // Switch between default modes. { @@ -235,7 +235,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rwm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -250,7 +250,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: !baseDefaultAllow, rules: nil, }, @@ -264,11 +264,11 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rwm"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: nil, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: nil, }, @@ -282,7 +282,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rwm"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -297,7 +297,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: nil, }, @@ -312,7 +312,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -327,7 +327,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -357,7 +357,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -367,7 +367,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("rwm"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -393,7 +393,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -403,7 +403,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("rm"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -423,7 +423,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -438,7 +438,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -463,7 +463,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -478,7 +478,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -503,7 +503,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("r"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -518,7 +518,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -544,7 +544,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -559,7 +559,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -579,7 +579,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rw"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -589,7 +589,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -609,7 +609,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rw"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -624,7 +624,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -644,7 +644,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("r"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -659,7 +659,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -686,7 +686,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("r"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -712,7 +712,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("r"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -727,7 +727,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -768,13 +768,13 @@ func TestDeviceEmulatorBlacklistApply(t *testing.T) { func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { tests := []struct { name string - source, target *Emulator + source, target *emulator expected []*devices.Rule }{ // No-op changes. { name: "Noop", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -784,7 +784,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("wm"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -800,7 +800,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { // Switching modes. { name: "SwitchToOtherMode", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -810,7 +810,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rwm"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: !sourceDefaultAllow, rules: deviceRules{ { @@ -842,7 +842,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { // Rule changes. { name: "RuleAddition", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -852,7 +852,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rwm"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -879,7 +879,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }, { name: "RuleRemoval", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -894,7 +894,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rwm"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -916,7 +916,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }, { name: "RuleMultipleAdditionRemoval", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -931,7 +931,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -954,7 +954,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { // Modifying the access permissions. { name: "RulePartialAddition", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -964,7 +964,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("r"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -986,7 +986,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }, { name: "RulePartialRemoval", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -996,7 +996,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -1018,7 +1018,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }, { name: "RulePartialBoth", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -1028,7 +1028,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { diff --git a/libcontainer/cgroups/devices/ebpf_linux.go b/libcontainer/cgroups/devices/ebpf_linux.go index 77277f93b..499b4677e 100644 --- a/libcontainer/cgroups/devices/ebpf_linux.go +++ b/libcontainer/cgroups/devices/ebpf_linux.go @@ -143,12 +143,12 @@ func haveBpfProgReplace() bool { return haveBpfProgReplaceBool } -// LoadAttachCgroupDeviceFilter installs eBPF device filter program to /sys/fs/cgroup/ directory. +// loadAttachCgroupDeviceFilter installs eBPF device filter program to /sys/fs/cgroup/ directory. // // Requires the system to be running in cgroup2 unified-mode with kernel >= 4.15 . // // https://github.com/torvalds/linux/commit/ebc614f687369f9df99828572b1d85a7c2de3d92 -func LoadAttachCgroupDeviceFilter(insts asm.Instructions, license string, dirFd int) (func() error, error) { +func loadAttachCgroupDeviceFilter(insts asm.Instructions, license string, dirFd int) (func() error, error) { // Increase `ulimit -l` limit to avoid BPF_PROG_LOAD error (#2167). // This limit is not inherited into the container. memlockLimit := &unix.Rlimit{ diff --git a/libcontainer/cgroups/devices/systemd.go b/libcontainer/cgroups/devices/systemd.go index 029625400..7e3c6fda8 100644 --- a/libcontainer/cgroups/devices/systemd.go +++ b/libcontainer/cgroups/devices/systemd.go @@ -30,7 +30,7 @@ func systemdProperties(r *configs.Resources) ([]systemdDbus.Property, error) { } // Figure out the set of rules. - configEmu := Emulator{} + configEmu := emulator{} for _, rule := range r.Devices { if err := configEmu.Apply(*rule); err != nil { return nil, fmt.Errorf("unable to apply rule for systemd: %w", err) diff --git a/libcontainer/cgroups/devices/v1.go b/libcontainer/cgroups/devices/v1.go index 64eadd12f..397c00c8d 100644 --- a/libcontainer/cgroups/devices/v1.go +++ b/libcontainer/cgroups/devices/v1.go @@ -64,17 +64,17 @@ func setV1(path string, r *configs.Resources) error { return nil } -func loadEmulator(path string) (*Emulator, error) { +func loadEmulator(path string) (*emulator, error) { list, err := cgroups.ReadFile(path, "devices.list") if err != nil { return nil, err } - return EmulatorFromList(bytes.NewBufferString(list)) + return emulatorFromList(bytes.NewBufferString(list)) } -func buildEmulator(rules []*devices.Rule) (*Emulator, error) { +func buildEmulator(rules []*devices.Rule) (*emulator, error) { // This defaults to a white-list -- which is what we want! - emu := &Emulator{} + emu := &emulator{} for _, rule := range rules { if err := emu.Apply(*rule); err != nil { return nil, err diff --git a/libcontainer/cgroups/devices/v2.go b/libcontainer/cgroups/devices/v2.go index a1b3f3a5a..4bcf860b5 100644 --- a/libcontainer/cgroups/devices/v2.go +++ b/libcontainer/cgroups/devices/v2.go @@ -55,7 +55,7 @@ func setV2(dirPath string, r *configs.Resources) error { if r.SkipDevices { return nil } - insts, license, err := DeviceFilter(r.Devices) + insts, license, err := deviceFilter(r.Devices) if err != nil { return err } @@ -64,7 +64,7 @@ func setV2(dirPath string, r *configs.Resources) error { return fmt.Errorf("cannot get dir FD for %s", dirPath) } defer unix.Close(dirFD) - if _, err := LoadAttachCgroupDeviceFilter(insts, license, dirFD); err != nil { + if _, err := loadAttachCgroupDeviceFilter(insts, license, dirFD); err != nil { if !canSkipEBPFError(r) { return err }