From 47e09976a3159a8e2bf6160e7e0aedcfeadb5cfe Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Fri, 8 Apr 2022 17:14:41 -0700 Subject: [PATCH] libct/cg/dev: privatize some functions These are only used from inside the package, and we don't want them to be public. The only two methods left are Enable and Disable. While at it, fix or suppress found lint-extra warnings. Signed-off-by: Kir Kolyshkin --- libcontainer/cgroups/devices/devicefilter.go | 6 +- .../cgroups/devices/devicefilter_test.go | 2 +- .../cgroups/devices/devices_emulator.go | 32 +++--- .../cgroups/devices/devices_emulator_test.go | 108 +++++++++--------- libcontainer/cgroups/devices/ebpf_linux.go | 4 +- libcontainer/cgroups/devices/systemd.go | 2 +- libcontainer/cgroups/devices/v1.go | 8 +- libcontainer/cgroups/devices/v2.go | 4 +- 8 files changed, 83 insertions(+), 83 deletions(-) diff --git a/libcontainer/cgroups/devices/devicefilter.go b/libcontainer/cgroups/devices/devicefilter.go index 3849810b3..c8cfb5ab5 100644 --- a/libcontainer/cgroups/devices/devicefilter.go +++ b/libcontainer/cgroups/devices/devicefilter.go @@ -22,14 +22,14 @@ const ( license = "Apache" ) -// DeviceFilter returns eBPF device filter program and its license string -func DeviceFilter(rules []*devices.Rule) (asm.Instructions, string, error) { +// deviceFilter returns eBPF device filter program and its license string. +func deviceFilter(rules []*devices.Rule) (asm.Instructions, string, error) { // Generate the minimum ruleset for the device rules we are given. While we // don't care about minimum transitions in cgroupv2, using the emulator // gives us a guarantee that the behaviour of devices filtering is the same // as cgroupv1, including security hardenings to avoid misconfiguration // (such as punching holes in wildcard rules). - emu := new(Emulator) + emu := new(emulator) for _, rule := range rules { if err := emu.Apply(*rule); err != nil { return nil, "", err diff --git a/libcontainer/cgroups/devices/devicefilter_test.go b/libcontainer/cgroups/devices/devicefilter_test.go index 7cabf0673..7b6424d33 100644 --- a/libcontainer/cgroups/devices/devicefilter_test.go +++ b/libcontainer/cgroups/devices/devicefilter_test.go @@ -21,7 +21,7 @@ func hash(s, comm string) string { } func testDeviceFilter(t testing.TB, devices []*devices.Rule, expectedStr string) { - insts, _, err := DeviceFilter(devices) + insts, _, err := deviceFilter(devices) if err != nil { t.Fatalf("%s: %v (devices: %+v)", t.Name(), err, devices) } diff --git a/libcontainer/cgroups/devices/devices_emulator.go b/libcontainer/cgroups/devices/devices_emulator.go index 6c61ee4c0..3e1f49f0f 100644 --- a/libcontainer/cgroups/devices/devices_emulator.go +++ b/libcontainer/cgroups/devices/devices_emulator.go @@ -63,16 +63,16 @@ func (r deviceRules) orderedEntries() []deviceRule { return rules } -type Emulator struct { +type emulator struct { defaultAllow bool rules deviceRules } -func (e *Emulator) IsBlacklist() bool { +func (e *emulator) IsBlacklist() bool { return e.defaultAllow } -func (e *Emulator) IsAllowAll() bool { +func (e *emulator) IsAllowAll() bool { return e.IsBlacklist() && len(e.rules) == 0 } @@ -139,7 +139,7 @@ func parseLine(line string) (*deviceRule, error) { return &rule, nil } -func (e *Emulator) addRule(rule deviceRule) error { //nolint:unparam +func (e *emulator) addRule(rule deviceRule) error { //nolint:unparam if e.rules == nil { e.rules = make(map[deviceMeta]devices.Permissions) } @@ -151,7 +151,7 @@ func (e *Emulator) addRule(rule deviceRule) error { //nolint:unparam return nil } -func (e *Emulator) rmRule(rule deviceRule) error { +func (e *emulator) rmRule(rule deviceRule) error { // Give an error if any of the permissions requested to be removed are // present in a partially-matching wildcard rule, because such rules will // be ignored by cgroupv1. @@ -196,11 +196,11 @@ func (e *Emulator) rmRule(rule deviceRule) error { return nil } -func (e *Emulator) allow(rule *deviceRule) error { +func (e *emulator) allow(rule *deviceRule) error { // This cgroup is configured as a black-list. Reset the entire emulator, // and put is into black-list mode. if rule == nil || rule.meta.node == devices.WildcardDevice { - *e = Emulator{ + *e = emulator{ defaultAllow: true, rules: nil, } @@ -216,11 +216,11 @@ func (e *Emulator) allow(rule *deviceRule) error { return err } -func (e *Emulator) deny(rule *deviceRule) error { +func (e *emulator) deny(rule *deviceRule) error { // This cgroup is configured as a white-list. Reset the entire emulator, // and put is into white-list mode. if rule == nil || rule.meta.node == devices.WildcardDevice { - *e = Emulator{ + *e = emulator{ defaultAllow: false, rules: nil, } @@ -236,7 +236,7 @@ func (e *Emulator) deny(rule *deviceRule) error { return err } -func (e *Emulator) Apply(rule devices.Rule) error { +func (e *emulator) Apply(rule devices.Rule) error { if !rule.Type.CanCgroup() { return fmt.Errorf("cannot add rule [%#v] with non-cgroup type %q", rule, rule.Type) } @@ -260,17 +260,17 @@ func (e *Emulator) Apply(rule devices.Rule) error { return e.deny(innerRule) } -// EmulatorFromList takes a reader to a "devices.list"-like source, and returns +// emulatorFromList takes a reader to a "devices.list"-like source, and returns // a new Emulator that represents the state of the devices cgroup. Note that // black-list devices cgroups cannot be fully reconstructed, due to limitations // in the devices cgroup API. Instead, such cgroups are always treated as // "allow all" cgroups. -func EmulatorFromList(list io.Reader) (*Emulator, error) { +func emulatorFromList(list io.Reader) (*emulator, error) { // Normally cgroups are in black-list mode by default, but the way we // figure out the current mode is whether or not devices.list has an // allow-all rule. So we default to a white-list, and the existence of an // "a *:* rwm" entry will tell us otherwise. - e := &Emulator{ + e := &emulator{ defaultAllow: false, } @@ -304,7 +304,7 @@ func EmulatorFromList(list io.Reader) (*Emulator, error) { // This function is the sole reason for all of Emulator -- to allow us // to figure out how to update a containers' cgroups without causing spurious // device errors (if possible). -func (source *Emulator) Transition(target *Emulator) ([]*devices.Rule, error) { +func (source *emulator) Transition(target *emulator) ([]*devices.Rule, error) { //nolint:revive // Ignore receiver-naming warning. var transitionRules []*devices.Rule oldRules := source.rules @@ -373,8 +373,8 @@ func (source *Emulator) Transition(target *Emulator) ([]*devices.Rule, error) { // cgroup to the emulated filter state (note that this is not the same as a // default cgroupv1 cgroup -- which is allow-all). This is effectively just a // wrapper around Transition() with the source emulator being an empty cgroup. -func (e *Emulator) Rules() ([]*devices.Rule, error) { - defaultCgroup := &Emulator{defaultAllow: false} +func (e *emulator) Rules() ([]*devices.Rule, error) { + defaultCgroup := &emulator{defaultAllow: false} return defaultCgroup.Transition(e) } diff --git a/libcontainer/cgroups/devices/devices_emulator_test.go b/libcontainer/cgroups/devices/devices_emulator_test.go index 4dac242cf..51c1f521e 100644 --- a/libcontainer/cgroups/devices/devices_emulator_test.go +++ b/libcontainer/cgroups/devices/devices_emulator_test.go @@ -31,19 +31,19 @@ import ( func TestDeviceEmulatorLoad(t *testing.T) { tests := []struct { name, list string - expected *Emulator + expected *emulator }{ { name: "BlacklistMode", list: `a *:* rwm`, - expected: &Emulator{ + expected: &emulator{ defaultAllow: true, }, }, { name: "WhitelistBasic", list: `c 4:2 rw`, - expected: &Emulator{ + expected: &emulator{ defaultAllow: false, rules: deviceRules{ { @@ -57,7 +57,7 @@ func TestDeviceEmulatorLoad(t *testing.T) { { name: "WhitelistWildcard", list: `b 0:* m`, - expected: &Emulator{ + expected: &emulator{ defaultAllow: false, rules: deviceRules{ { @@ -72,7 +72,7 @@ func TestDeviceEmulatorLoad(t *testing.T) { name: "WhitelistDuplicate", list: `c *:* rwm c 1:1 r`, - expected: &Emulator{ + expected: &emulator{ defaultAllow: false, rules: deviceRules{ { @@ -102,7 +102,7 @@ c 5:0 rwm c 5:2 rwm c 136:* rwm c 10:200 rwm`, - expected: &Emulator{ + expected: &emulator{ defaultAllow: false, rules: deviceRules{ { @@ -205,7 +205,7 @@ c 10:200 rwm`, test := test // capture range variable t.Run(test.name, func(t *testing.T) { list := bytes.NewBufferString(test.list) - emu, err := EmulatorFromList(list) + emu, err := emulatorFromList(list) if err != nil && test.expected != nil { t.Fatalf("unexpected failure when creating emulator: %v", err) } else if err == nil && test.expected == nil { @@ -223,7 +223,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { tests := []struct { name string rule devices.Rule - base, expected *Emulator + base, expected *emulator }{ // Switch between default modes. { @@ -235,7 +235,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rwm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -250,7 +250,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: !baseDefaultAllow, rules: nil, }, @@ -264,11 +264,11 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rwm"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: nil, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: nil, }, @@ -282,7 +282,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rwm"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -297,7 +297,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: nil, }, @@ -312,7 +312,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -327,7 +327,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -357,7 +357,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -367,7 +367,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("rwm"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -393,7 +393,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -403,7 +403,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("rm"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -423,7 +423,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -438,7 +438,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -463,7 +463,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -478,7 +478,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -503,7 +503,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("r"), Allow: !baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -518,7 +518,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -544,7 +544,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rm"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -559,7 +559,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -579,7 +579,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rw"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -589,7 +589,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -609,7 +609,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("rw"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -624,7 +624,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -644,7 +644,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("r"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -659,7 +659,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -686,7 +686,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("r"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -712,7 +712,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { Permissions: devices.Permissions("r"), Allow: baseDefaultAllow, }, - base: &Emulator{ + base: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -727,7 +727,7 @@ func testDeviceEmulatorApply(t *testing.T, baseDefaultAllow bool) { }: devices.Permissions("r"), }, }, - expected: &Emulator{ + expected: &emulator{ defaultAllow: baseDefaultAllow, rules: deviceRules{ { @@ -768,13 +768,13 @@ func TestDeviceEmulatorBlacklistApply(t *testing.T) { func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { tests := []struct { name string - source, target *Emulator + source, target *emulator expected []*devices.Rule }{ // No-op changes. { name: "Noop", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -784,7 +784,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("wm"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -800,7 +800,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { // Switching modes. { name: "SwitchToOtherMode", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -810,7 +810,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rwm"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: !sourceDefaultAllow, rules: deviceRules{ { @@ -842,7 +842,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { // Rule changes. { name: "RuleAddition", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -852,7 +852,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rwm"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -879,7 +879,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }, { name: "RuleRemoval", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -894,7 +894,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rwm"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -916,7 +916,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }, { name: "RuleMultipleAdditionRemoval", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -931,7 +931,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -954,7 +954,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { // Modifying the access permissions. { name: "RulePartialAddition", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -964,7 +964,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("r"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -986,7 +986,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }, { name: "RulePartialRemoval", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -996,7 +996,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -1018,7 +1018,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }, { name: "RulePartialBoth", - source: &Emulator{ + source: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { @@ -1028,7 +1028,7 @@ func testDeviceEmulatorTransition(t *testing.T, sourceDefaultAllow bool) { }: devices.Permissions("rw"), }, }, - target: &Emulator{ + target: &emulator{ defaultAllow: sourceDefaultAllow, rules: deviceRules{ { diff --git a/libcontainer/cgroups/devices/ebpf_linux.go b/libcontainer/cgroups/devices/ebpf_linux.go index 77277f93b..499b4677e 100644 --- a/libcontainer/cgroups/devices/ebpf_linux.go +++ b/libcontainer/cgroups/devices/ebpf_linux.go @@ -143,12 +143,12 @@ func haveBpfProgReplace() bool { return haveBpfProgReplaceBool } -// LoadAttachCgroupDeviceFilter installs eBPF device filter program to /sys/fs/cgroup/ directory. +// loadAttachCgroupDeviceFilter installs eBPF device filter program to /sys/fs/cgroup/ directory. // // Requires the system to be running in cgroup2 unified-mode with kernel >= 4.15 . // // https://github.com/torvalds/linux/commit/ebc614f687369f9df99828572b1d85a7c2de3d92 -func LoadAttachCgroupDeviceFilter(insts asm.Instructions, license string, dirFd int) (func() error, error) { +func loadAttachCgroupDeviceFilter(insts asm.Instructions, license string, dirFd int) (func() error, error) { // Increase `ulimit -l` limit to avoid BPF_PROG_LOAD error (#2167). // This limit is not inherited into the container. memlockLimit := &unix.Rlimit{ diff --git a/libcontainer/cgroups/devices/systemd.go b/libcontainer/cgroups/devices/systemd.go index 029625400..7e3c6fda8 100644 --- a/libcontainer/cgroups/devices/systemd.go +++ b/libcontainer/cgroups/devices/systemd.go @@ -30,7 +30,7 @@ func systemdProperties(r *configs.Resources) ([]systemdDbus.Property, error) { } // Figure out the set of rules. - configEmu := Emulator{} + configEmu := emulator{} for _, rule := range r.Devices { if err := configEmu.Apply(*rule); err != nil { return nil, fmt.Errorf("unable to apply rule for systemd: %w", err) diff --git a/libcontainer/cgroups/devices/v1.go b/libcontainer/cgroups/devices/v1.go index 64eadd12f..397c00c8d 100644 --- a/libcontainer/cgroups/devices/v1.go +++ b/libcontainer/cgroups/devices/v1.go @@ -64,17 +64,17 @@ func setV1(path string, r *configs.Resources) error { return nil } -func loadEmulator(path string) (*Emulator, error) { +func loadEmulator(path string) (*emulator, error) { list, err := cgroups.ReadFile(path, "devices.list") if err != nil { return nil, err } - return EmulatorFromList(bytes.NewBufferString(list)) + return emulatorFromList(bytes.NewBufferString(list)) } -func buildEmulator(rules []*devices.Rule) (*Emulator, error) { +func buildEmulator(rules []*devices.Rule) (*emulator, error) { // This defaults to a white-list -- which is what we want! - emu := &Emulator{} + emu := &emulator{} for _, rule := range rules { if err := emu.Apply(*rule); err != nil { return nil, err diff --git a/libcontainer/cgroups/devices/v2.go b/libcontainer/cgroups/devices/v2.go index a1b3f3a5a..4bcf860b5 100644 --- a/libcontainer/cgroups/devices/v2.go +++ b/libcontainer/cgroups/devices/v2.go @@ -55,7 +55,7 @@ func setV2(dirPath string, r *configs.Resources) error { if r.SkipDevices { return nil } - insts, license, err := DeviceFilter(r.Devices) + insts, license, err := deviceFilter(r.Devices) if err != nil { return err } @@ -64,7 +64,7 @@ func setV2(dirPath string, r *configs.Resources) error { return fmt.Errorf("cannot get dir FD for %s", dirPath) } defer unix.Close(dirFD) - if _, err := LoadAttachCgroupDeviceFilter(insts, license, dirFD); err != nil { + if _, err := loadAttachCgroupDeviceFilter(insts, license, dirFD); err != nil { if !canSkipEBPFError(r) { return err }