From f78bf211f023d28392c6aa0d1934bb1001b3a180 Mon Sep 17 00:00:00 2001 From: Andrey Vagin Date: Wed, 4 Mar 2015 12:10:53 +0300 Subject: [PATCH 1/3] integration: don't use default values to test smth Signed-off-by: Andrey Vagin --- integration/exec_test.go | 4 ++-- integration/execin_test.go | 4 ++-- integration/template_test.go | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/integration/exec_test.go b/integration/exec_test.go index 88132f2db..d507789db 100644 --- a/integration/exec_test.go +++ b/integration/exec_test.go @@ -188,8 +188,8 @@ func TestRlimit(t *testing.T) { if err != nil { t.Fatal(err) } - if limit := strings.TrimSpace(out.Stdout.String()); limit != "1024" { - t.Fatalf("expected rlimit to be 1024, got %s", limit) + if limit := strings.TrimSpace(out.Stdout.String()); limit != "1025" { + t.Fatalf("expected rlimit to be 1025, got %s", limit) } } diff --git a/integration/execin_test.go b/integration/execin_test.go index 92a1ae0f4..a5b26cd2c 100644 --- a/integration/execin_test.go +++ b/integration/execin_test.go @@ -118,8 +118,8 @@ func TestExecInRlimit(t *testing.T) { t.Log(err) } out := buffers.Stdout.String() - if limit := strings.TrimSpace(out); limit != "1024" { - t.Fatalf("expected rlimit to be 1024, got %s", limit) + if limit := strings.TrimSpace(out); limit != "1025" { + t.Fatalf("expected rlimit to be 1025, got %s", limit) } } diff --git a/integration/template_test.go b/integration/template_test.go index 083c64887..45acaf77c 100644 --- a/integration/template_test.go +++ b/integration/template_test.go @@ -90,8 +90,8 @@ func newTemplateConfig(rootfs string) *configs.Config { Rlimits: []configs.Rlimit{ { Type: syscall.RLIMIT_NOFILE, - Hard: uint64(1024), - Soft: uint64(1024), + Hard: uint64(1025), + Soft: uint64(1025), }, }, } From a72f710d89eaabf23dad7c084082bccb26e6336f Mon Sep 17 00:00:00 2001 From: Andrey Vagin Date: Wed, 4 Mar 2015 12:13:45 +0300 Subject: [PATCH 2/3] configs: check that config doesn't contain extra fields Signed-off-by: Andrey Vagin --- configs/config_test.go | 29 ++++++++++++++++++++++++++++ sample_configs/apparmor.json | 1 - sample_configs/attach_to_bridge.json | 1 - sample_configs/host-pid.json | 1 - sample_configs/minimal.json | 3 +-- sample_configs/selinux.json | 1 - sample_configs/userns.json | 1 - 7 files changed, 30 insertions(+), 7 deletions(-) diff --git a/configs/config_test.go b/configs/config_test.go index 2fc0513f1..765d5e50d 100644 --- a/configs/config_test.go +++ b/configs/config_test.go @@ -2,6 +2,7 @@ package configs import ( "encoding/json" + "fmt" "os" "path/filepath" "testing" @@ -43,6 +44,34 @@ func loadConfig(name string) (*Config, error) { return nil, err } + // Check that a config doesn't contain extra fields + var configMap, abstractMap map[string]interface{} + + if _, err := f.Seek(0, 0); err != nil { + return nil, err + } + + if err := json.NewDecoder(f).Decode(&abstractMap); err != nil { + return nil, err + } + + configData, err := json.Marshal(&container) + if err != nil { + return nil, err + } + + if err := json.Unmarshal(configData, &configMap); err != nil { + return nil, err + } + + for k := range configMap { + delete(abstractMap, k) + } + + if len(abstractMap) != 0 { + return nil, fmt.Errorf("unknown fields: %s", abstractMap) + } + return container, nil } diff --git a/sample_configs/apparmor.json b/sample_configs/apparmor.json index b8860bbbb..843c2c61e 100644 --- a/sample_configs/apparmor.json +++ b/sample_configs/apparmor.json @@ -104,7 +104,6 @@ ], "mount_label": "", "hostname": "nsinit", - "console": "", "namespaces": [ { "type": "NEWNS", diff --git a/sample_configs/attach_to_bridge.json b/sample_configs/attach_to_bridge.json index a2b8738b2..11335b25f 100644 --- a/sample_configs/attach_to_bridge.json +++ b/sample_configs/attach_to_bridge.json @@ -104,7 +104,6 @@ ], "mount_label": "", "hostname": "koye", - "console": "", "namespaces": [ { "type": "NEWNS", diff --git a/sample_configs/host-pid.json b/sample_configs/host-pid.json index b5eb89bc7..bf4615044 100644 --- a/sample_configs/host-pid.json +++ b/sample_configs/host-pid.json @@ -104,7 +104,6 @@ ], "mount_label": "", "hostname": "nsinit", - "console": "", "namespaces": [ { "type": "NEWNS", diff --git a/sample_configs/minimal.json b/sample_configs/minimal.json index b936ebdf1..c2f741095 100644 --- a/sample_configs/minimal.json +++ b/sample_configs/minimal.json @@ -104,7 +104,6 @@ ], "mount_label": "", "hostname": "nsinit", - "console": "", "namespaces": [ { "type": "NEWNS", @@ -338,4 +337,4 @@ "/proc/irq", "/proc/bus" ] -} \ No newline at end of file +} diff --git a/sample_configs/selinux.json b/sample_configs/selinux.json index 033d3be12..dddfdf144 100644 --- a/sample_configs/selinux.json +++ b/sample_configs/selinux.json @@ -104,7 +104,6 @@ ], "mount_label": "system_u:system_r:svirt_lxc_net_t:s0:c164,c475", "hostname": "nsinit", - "console": "", "namespaces": [ { "type": "NEWNS", diff --git a/sample_configs/userns.json b/sample_configs/userns.json index 0b0644fb8..2b1fb90b4 100644 --- a/sample_configs/userns.json +++ b/sample_configs/userns.json @@ -104,7 +104,6 @@ ], "mount_label": "", "hostname": "nsinit", - "console": "", "namespaces": [ { "type": "NEWNS", From 872663148e00c4d272fc67e8d369a5012ccbac5a Mon Sep 17 00:00:00 2001 From: Andrey Vagin Date: Wed, 4 Mar 2015 23:22:01 +0300 Subject: [PATCH 3/3] paranoia: Don't return -1 as PID in error cases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit I have seen a few times, when kill() was called for this value on error paths and nobody survived except the init process. man 2 kill If pid equals -1, then sig is sent to every process for which the call‐ ing process has permission to send signals, except for process 1 (init), but see below. Signed-off-by: Andrey Vagin --- process.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/process.go b/process.go index 1f769abb4..12f90daf7 100644 --- a/process.go +++ b/process.go @@ -3,6 +3,7 @@ package libcontainer import ( "fmt" "io" + "math" "os" ) @@ -54,8 +55,10 @@ func (p Process) Wait() (*os.ProcessState, error) { // Pid returns the process ID func (p Process) Pid() (int, error) { + // math.MinInt32 is returned here, because it's invalid value + // for the kill() system call. if p.ops == nil { - return -1, newGenericError(fmt.Errorf("invalid process"), ProcessNotExecuted) + return math.MinInt32, newGenericError(fmt.Errorf("invalid process"), ProcessNotExecuted) } return p.ops.pid(), nil }