From c54c3f852d11cef0f7a14f59c8bb355ba00d01e7 Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Thu, 18 Feb 2021 20:45:46 -0800
Subject: [PATCH] libcontainer/notify_linux_v2: use fscommon.ReadFile

This is to benefit from openat2() implementation, on kernels
that support it. Theoretically this also improves security.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 libcontainer/notify_linux_v2.go | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/libcontainer/notify_linux_v2.go b/libcontainer/notify_linux_v2.go
index cdab10ed6..1d81f38c2 100644
--- a/libcontainer/notify_linux_v2.go
+++ b/libcontainer/notify_linux_v2.go
@@ -3,19 +3,19 @@
 package libcontainer
 
 import (
-	"io/ioutil"
 	"path/filepath"
 	"strconv"
 	"strings"
 	"unsafe"
 
+	"github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/sys/unix"
 )
 
-func getValueFromCgroup(path, key string) (int, error) {
-	content, err := ioutil.ReadFile(path)
+func getValueFromCgroup(path, file, key string) (int, error) {
+	content, err := fscommon.ReadFile(path, file)
 	if err != nil {
 		return 0, err
 	}
@@ -31,20 +31,18 @@ func getValueFromCgroup(path, key string) (int, error) {
 }
 
 func registerMemoryEventV2(cgDir, evName, cgEvName string) (<-chan struct{}, error) {
-	eventControlPath := filepath.Join(cgDir, evName)
-	cgEvPath := filepath.Join(cgDir, cgEvName)
 	fd, err := unix.InotifyInit()
 	if err != nil {
 		return nil, errors.Wrap(err, "unable to init inotify")
 	}
 	// watching oom kill
-	evFd, err := unix.InotifyAddWatch(fd, eventControlPath, unix.IN_MODIFY)
+	evFd, err := unix.InotifyAddWatch(fd, filepath.Join(cgDir, evName), unix.IN_MODIFY)
 	if err != nil {
 		unix.Close(fd)
 		return nil, errors.Wrap(err, "unable to add inotify watch")
 	}
 	// Because no `unix.IN_DELETE|unix.IN_DELETE_SELF` event for cgroup file system, so watching all process exited
-	cgFd, err := unix.InotifyAddWatch(fd, cgEvPath, unix.IN_MODIFY)
+	cgFd, err := unix.InotifyAddWatch(fd, filepath.Join(cgDir, cgEvName), unix.IN_MODIFY)
 	if err != nil {
 		unix.Close(fd)
 		return nil, errors.Wrap(err, "unable to add inotify watch")
@@ -79,12 +77,12 @@ func registerMemoryEventV2(cgDir, evName, cgEvName string) (<-chan struct{}, err
 				}
 				switch int(rawEvent.Wd) {
 				case evFd:
-					oom, err := getValueFromCgroup(eventControlPath, "oom_kill")
+					oom, err := getValueFromCgroup(cgDir, evName, "oom_kill")
 					if err != nil || oom > 0 {
 						ch <- struct{}{}
 					}
 				case cgFd:
-					pids, err := getValueFromCgroup(cgEvPath, "populated")
+					pids, err := getValueFromCgroup(cgDir, cgEvName, "populated")
 					if err != nil || pids == 0 {
 						return
 					}