From 82b7597a26726b6d52967f4142678e30be5ff870 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 29 Jan 2026 13:39:45 -0800 Subject: [PATCH] libct: check cmd.Err after exec.Command call Theoretically, exec.Command can set cmd.Err. Practically, this should never happen (Linux, Go <= 1.26, exePath is absolute), but in the unlikely case it does, let's fail early. This is related to the cloneCmd (to be introduced by the following commit) which chooses to not copy the Err field. Theoretically, exec.Command can set Err and so the first call to cmd.Start will fail (since Err != nil), and the second call to cmd.Start may succeed because Err == nil. Yet, this scenario is highly unlikely, but better be safe than sorry. Signed-off-by: Kir Kolyshkin --- libcontainer/container_linux.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go index af9172a89..b4368547c 100644 --- a/libcontainer/container_linux.go +++ b/libcontainer/container_linux.go @@ -528,6 +528,12 @@ func (c *Container) newParentProcess(p *Process) (parentProcess, error) { } cmd := exec.Command(exePath, "init") + // Theoretically, exec.Command can set cmd.Err. Practically, this + // should never happen (Linux, Go <= 1.26, exePath is absolute), + // but in the unlikely case it just did, let's fail early. + if cmd.Err != nil { + return nil, fmt.Errorf("exec.Command: %w", cmd.Err) + } cmd.Args[0] = os.Args[0] cmd.Stdin = p.Stdin cmd.Stdout = p.Stdout