From 863f7bc4438c3e8f67b5dc02f67fa9127e6d56cb Mon Sep 17 00:00:00 2001
From: Aleksa Sarai <cyphar@cyphar.com>
Date: Fri, 20 Jun 2025 16:23:38 +1000
Subject: [PATCH] utils: remove unneeded EnsureProcHandle

All of the callers of EnsureProcHandle now use filepath-securejoin's
ProcThreadSelf to get a file handle, which has much stricter
verification to avoid procfs attacks than EnsureProcHandle's very
simplistic filesystem type check.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
---
 libcontainer/apparmor/apparmor_linux.go |  6 ------
 libcontainer/utils/utils_unix.go        | 18 ------------------
 2 files changed, 24 deletions(-)

diff --git a/libcontainer/apparmor/apparmor_linux.go b/libcontainer/apparmor/apparmor_linux.go
index 507aaf9a2..a3a8e9325 100644
--- a/libcontainer/apparmor/apparmor_linux.go
+++ b/libcontainer/apparmor/apparmor_linux.go
@@ -46,12 +46,6 @@ func setProcAttr(attr, value string) error {
 	defer closer()
 	defer f.Close()
 
-	// NOTE: This is not really necessary since securejoin.ProcThreadSelf
-	// verifies this in a far stricter sense than EnsureProcHandle.
-	if err := utils.EnsureProcHandle(f); err != nil {
-		return err
-	}
-
 	_, err = f.WriteString(value)
 	return err
 }
diff --git a/libcontainer/utils/utils_unix.go b/libcontainer/utils/utils_unix.go
index ebfdda36b..d26dbef43 100644
--- a/libcontainer/utils/utils_unix.go
+++ b/libcontainer/utils/utils_unix.go
@@ -18,18 +18,6 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-// EnsureProcHandle returns whether or not the given file handle is on procfs.
-func EnsureProcHandle(fh *os.File) error {
-	var buf unix.Statfs_t
-	if err := unix.Fstatfs(int(fh.Fd()), &buf); err != nil {
-		return fmt.Errorf("ensure %s is on procfs: %w", fh.Name(), err)
-	}
-	if buf.Type != unix.PROC_SUPER_MAGIC {
-		return fmt.Errorf("%s is not on procfs", fh.Name())
-	}
-	return nil
-}
-
 var (
 	haveCloseRangeCloexecBool bool
 	haveCloseRangeCloexecOnce sync.Once
@@ -66,12 +54,6 @@ func fdRangeFrom(minFd int, fn fdFunc) error {
 	defer closer()
 	defer fdDir.Close()
 
-	// NOTE: This is not really necessary since securejoin.ProcThreadSelf
-	// verifies this in a far stricter sense than EnsureProcHandle.
-	if err := EnsureProcHandle(fdDir); err != nil {
-		return err
-	}
-
 	fdList, err := fdDir.Readdirnames(-1)
 	if err != nil {
 		return err