From 87a188996e229bf382c27865584765d1a50c0211 Mon Sep 17 00:00:00 2001 From: Lifubang Date: Sun, 18 Nov 2018 20:19:17 +0800 Subject: [PATCH] may kill other process when container has been stopped Signed-off-by: Lifubang --- libcontainer/container_linux.go | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go index 7d2c68448..ded1353a8 100644 --- a/libcontainer/container_linux.go +++ b/libcontainer/container_linux.go @@ -374,10 +374,18 @@ func (c *linuxContainer) Signal(s os.Signal, all bool) error { if all { return signalAllProcesses(c.cgroupManager, s) } - if err := c.initProcess.signal(s); err != nil { - return newSystemErrorWithCause(err, "signaling init process") + status, err := c.currentStatus() + if err != nil { + return err } - return nil + // to avoid a PID reuse attack + if status == Running || status == Created { + if err := c.initProcess.signal(s); err != nil { + return newSystemErrorWithCause(err, "signaling init process") + } + return nil + } + return newGenericError(fmt.Errorf("container not running"), ContainerNotRunning) } func (c *linuxContainer) createExecFifo() error {