From 6a057b84de06f149049a3942b187aa205501a057 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 29 Jan 2026 13:39:45 -0800 Subject: [PATCH] libct: check cmd.Err after exec.Command call Theoretically, exec.Command can set cmd.Err. Practically, this should never happen (Linux, Go <= 1.26, exePath is absolute), but in the unlikely case it does, let's fail early. This is related to the cloneCmd (to be introduced by the following commit) which chooses to not copy the Err field. Theoretically, exec.Command can set Err and so the first call to cmd.Start will fail (since Err != nil), and the second call to cmd.Start may succeed because Err == nil. Yet, this scenario is highly unlikely, but better be safe than sorry. Signed-off-by: Kir Kolyshkin (cherry picked from commit 82b7597a26726b6d52967f4142678e30be5ff870) Signed-off-by: lifubang --- libcontainer/container_linux.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go index ad9046417..2ec08ab9a 100644 --- a/libcontainer/container_linux.go +++ b/libcontainer/container_linux.go @@ -528,6 +528,12 @@ func (c *Container) newParentProcess(p *Process) (parentProcess, error) { } cmd := exec.Command(exePath, "init") + // Theoretically, exec.Command can set cmd.Err. Practically, this + // should never happen (Linux, Go <= 1.26, exePath is absolute), + // but in the unlikely case it just did, let's fail early. + if cmd.Err != nil { + return nil, fmt.Errorf("exec.Command: %w", cmd.Err) + } cmd.Args[0] = os.Args[0] cmd.Stdin = p.Stdin cmd.Stdout = p.Stdout