From 2a94c3651b1f75f4b5d351f6fa32db2819f6b47a Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Wed, 26 Oct 2016 22:58:51 +1100 Subject: [PATCH 1/2] validator: unbreak sysctl net.* validation When changing this validation, the code actually allowing the validation to pass was removed. This meant that any net.* sysctl would always fail to validate. Fixes: bc84f83344fd ("fix docker/docker#27484") Reported-by: Justin Cormack Signed-off-by: Aleksa Sarai --- libcontainer/configs/validate/validator.go | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/libcontainer/configs/validate/validator.go b/libcontainer/configs/validate/validator.go index 48d33ff59..3becd31d5 100644 --- a/libcontainer/configs/validate/validator.go +++ b/libcontainer/configs/validate/validator.go @@ -125,13 +125,15 @@ func (v *ConfigValidator) sysctl(config *configs.Config) error { } } if strings.HasPrefix(s, "net.") { - if !config.Namespaces.Contains(configs.NEWNET) { - return fmt.Errorf("sysctl %q is not allowed in the hosts network namespace", s) - } - if path := config.Namespaces.PathOf(configs.NEWNET); path != "" { - if err := checkHostNs(s, path); err != nil { - return err + if config.Namespaces.Contains(configs.NEWNET) { + if path := config.Namespaces.PathOf(configs.NEWNET); path != "" { + if err := checkHostNs(s, path); err != nil { + return err + } } + continue + } else { + return fmt.Errorf("sysctl %q is not allowed in the hosts network namespace", s) } } return fmt.Errorf("sysctl %q is not in a separate kernel namespace", s) From 1ab3c035d21c4afe47991e1b0d8a4174c6820b6a Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Wed, 26 Oct 2016 23:04:17 +1100 Subject: [PATCH 2/2] validator: actually test success Previously we only tested failures, which causes us to miss issues where setting sysctls would *always* fail. Signed-off-by: Aleksa Sarai --- .../configs/validate/validator_test.go | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/libcontainer/configs/validate/validator_test.go b/libcontainer/configs/validate/validator_test.go index 649e02844..f6826fb3e 100644 --- a/libcontainer/configs/validate/validator_test.go +++ b/libcontainer/configs/validate/validator_test.go @@ -202,6 +202,35 @@ func TestValidateSysctl(t *testing.T) { } } +func TestValidateValidSysctl(t *testing.T) { + sysctl := map[string]string{ + "fs.mqueue.ctl": "ctl", + "net.ctl": "ctl", + "kernel.msgmax": "ctl", + } + + for k, v := range sysctl { + config := &configs.Config{ + Rootfs: "/var", + Sysctl: map[string]string{k: v}, + Namespaces: []configs.Namespace{ + { + Type: configs.NEWNET, + }, + { + Type: configs.NEWIPC, + }, + }, + } + + validator := validate.New() + err := validator.Validate(config) + if err != nil { + t.Errorf("Expected error to not occur with {%s=%s} but got: %q", k, v, err) + } + } +} + func TestValidateSysctlWithSameNs(t *testing.T) { config := &configs.Config{ Rootfs: "/var",