Intel RDT: update according to spec changes.

There is one proposed clarification to the OCI spec: the subdirectory
needs to be deleted. Runc already does that, but the clarification adds
for directory removal only if the directory was created by us.

Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com>
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

docs/spec-conformance.md

@@ -8,7 +8,6 @@ The following features are not implemented yet:
 Spec version | Feature                                        | PR
 -------------|------------------------------------------------|----------------------------------------------------------
 v1.1.0       | `SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV`       | [#3862](https://github.com/opencontainers/runc/pull/3862)
-v1.3.0       | Clarified interpretation of `linux.intelRdt`   | [#3832](https://github.com/opencontainers/runc/pull/3832)
 v1.3.0       | Fail on a failure of a poststart hook.         | [#4348](https://github.com/opencontainers/runc/pull/4348)
 
 ## Architectures

libcontainer/intelrdt/intelrdt.go

@@ -147,10 +147,11 @@ import (
  */
 
 type Manager struct {
-	mu     sync.Mutex
+	mu               sync.Mutex
-	config *configs.Config
+	config           *configs.Config
-	id     string
+	id               string
-	path   string
+	path             string
+	directoryCreated bool
 }
 
 // NewManager returns a new instance of Manager, or nil if the Intel RDT
@@ -186,9 +187,10 @@ func NewManager(config *configs.Config, id, path string) *Manager {
 // is actually available. Used by unit tests that mock intelrdt paths.
 func newManager(config *configs.Config, id, path string) *Manager {
 	return &Manager{
-		config: config,
+		config:           config,
-		id:     id,
+		id:               id,
-		path:   path,
+		path:             path,
+		directoryCreated: false,
 	}
 }
 
@@ -460,6 +462,14 @@ func (m *Manager) Apply(pid int) (err error) {
 		}
 	}
 
+	// If the directory doesn't exist we need to create it -> it means we also need
+	// to clean it up afterwards. Make a note to the manager.
+	if _, err := os.Stat(path); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			m.directoryCreated = true
+		}
+	}
+
 	if err := os.Mkdir(path, 0o755); err != nil && !errors.Is(err, os.ErrExist) {
 		return newLastCmdError(err)
 	}
@@ -489,8 +499,9 @@ func (m *Manager) Destroy() error {
 	}
 	// Don't remove resctrl group if closid has been explicitly specified. The
 	// group is likely externally managed, i.e. by some other entity than us.
-	// There are probably other containers/tasks sharing the same group.
+	// There are probably other containers/tasks sharing the same group. Also
-	if m.config.IntelRdt.ClosID == "" {
+	// only remove the directory if it was created by us.
+	if m.config.IntelRdt.ClosID == "" && m.directoryCreated {
 		m.mu.Lock()
 		defer m.mu.Unlock()
 		if err := os.Remove(m.GetPath()); err != nil && !errors.Is(err, os.ErrNotExist) {