From 4aa9101477fb539abfb30d3385e9fc79e8f879e0 Mon Sep 17 00:00:00 2001 From: Pradyumna Agrawal Date: Mon, 11 May 2020 13:38:14 -0700 Subject: [PATCH] Honor spec.Process.NoNewPrivileges in specconv.CreateLibcontainerConfig The change ensures that the passed in value of NoNewPrivileges under spec.Process is reflected in the container config generated by specconv.CreateLibcontainerConfig Closes #2397 Signed-off-by: Pradyumna Agrawal --- libcontainer/specconv/spec_linux.go | 1 + libcontainer/specconv/spec_linux_test.go | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go index 727fdbd1d..f6212b833 100644 --- a/libcontainer/specconv/spec_linux.go +++ b/libcontainer/specconv/spec_linux.go @@ -260,6 +260,7 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) { } if spec.Process != nil { config.OomScoreAdj = spec.Process.OOMScoreAdj + config.NoNewPrivileges = spec.Process.NoNewPrivileges if spec.Process.SelinuxLabel != "" { config.ProcessLabel = spec.Process.SelinuxLabel } diff --git a/libcontainer/specconv/spec_linux_test.go b/libcontainer/specconv/spec_linux_test.go index 9c2688650..18bb7c7fd 100644 --- a/libcontainer/specconv/spec_linux_test.go +++ b/libcontainer/specconv/spec_linux_test.go @@ -391,6 +391,11 @@ func TestSpecconvExampleValidate(t *testing.T) { t.Errorf("Couldn't create libcontainer config: %v", err) } + if config.NoNewPrivileges != spec.Process.NoNewPrivileges { + t.Errorf("specconv NoNewPrivileges mismatch. Expected %v got %v", + spec.Process.NoNewPrivileges, config.NoNewPrivileges) + } + validator := validate.New() if err := validator.Validate(config); err != nil { t.Errorf("Expected specconv to produce valid container config: %v", err)