From a1f8e0f18459068457606601a442ec2fae889cee Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Wed, 8 Jun 2016 15:56:20 +0200 Subject: [PATCH] fail if path to devices subsystem is missing The presence of the "devices" subsystem is a necessary condition for a (privileged) container. Signed-off-by: Christian Brauner --- libcontainer/cgroups/fs/apply_raw.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libcontainer/cgroups/fs/apply_raw.go b/libcontainer/cgroups/fs/apply_raw.go index c3cfb036c..633ab0427 100644 --- a/libcontainer/cgroups/fs/apply_raw.go +++ b/libcontainer/cgroups/fs/apply_raw.go @@ -142,7 +142,9 @@ func (m *Manager) Apply(pid int) (err error) { // created then join consists of writing the process pids to cgroup.procs p, err := d.path(sys.Name()) if err != nil { - if cgroups.IsNotFound(err) { + // The non-presence of the devices subsystem is + // considered fatal for security reasons. + if cgroups.IsNotFound(err) && sys.Name() != "devices" { continue } return err