From b5c1949f2ab542e4e10060d8873a9d9de90ac836 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 7 Apr 2020 12:43:36 -0700 Subject: [PATCH] cgroups/fs2/CreateCgroupPath: reinstate check This check was removed in commit 5406833a65e7. Now, when this function is called from a few places, it is no longer obvious that the path always starts with /sys/fs/cgroup/, so reinstate the check just to be on the safe side. This check also ensures that elements[3:] can be used safely. Signed-off-by: Kir Kolyshkin --- libcontainer/cgroups/fs2/create.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libcontainer/cgroups/fs2/create.go b/libcontainer/cgroups/fs2/create.go index fb5e50507..324df0323 100644 --- a/libcontainer/cgroups/fs2/create.go +++ b/libcontainer/cgroups/fs2/create.go @@ -2,6 +2,7 @@ package fs2 import ( "bytes" + "fmt" "io/ioutil" "os" "path/filepath" @@ -11,6 +12,10 @@ import ( // CreateCgroupPath creates cgroupv2 path, enabling all the // available controllers in the process. func CreateCgroupPath(path string) (Err error) { + if !strings.HasPrefix(path, UnifiedMountpoint) { + return fmt.Errorf("invalid cgroup path %s", path) + } + const file = UnifiedMountpoint + "/cgroup.controllers" content, err := ioutil.ReadFile(file) if err != nil {