From 57ba666ef311c1c2fdf49cbaa29206deb87f2b22 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Wed, 27 Jan 2016 19:00:52 +1100 Subject: [PATCH] cgroup: systemd: further systemd slice validation Add some further (not critical, since Docker does this already) validation to systemd slice names, to make sure users don't get cryptic errors. Signed-off-by: Aleksa Sarai --- libcontainer/cgroups/systemd/apply_systemd.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/libcontainer/cgroups/systemd/apply_systemd.go b/libcontainer/cgroups/systemd/apply_systemd.go index db020a971..3161639f2 100644 --- a/libcontainer/cgroups/systemd/apply_systemd.go +++ b/libcontainer/cgroups/systemd/apply_systemd.go @@ -392,9 +392,18 @@ func joinPids(c *configs.Cgroup, pid int) error { // test.slice/test-a.slice/test-a-b.slice. func expandSlice(slice string) (string, error) { suffix := ".slice" - sliceName := strings.TrimSuffix(slice, suffix) + // Name has to end with ".slice", but can't be just ".slice". + if len(slice) < len(suffix) || !strings.HasSuffix(slice, suffix) { + return "", fmt.Errorf("invalid slice name: %s", slice) + } + + // Path-separators are not allowed. + if strings.Contains(slice, "/") { + return "", fmt.Errorf("invalid slice name: %s", slice) + } var path, prefix string + sliceName := strings.TrimSuffix(slice, suffix) for _, component := range strings.Split(sliceName, "-") { // test--a.slice isn't permitted, nor is -test.slice. if component == "" {