From e846add595b1d71a2792ce2a6cdfc05b4a57d853 Mon Sep 17 00:00:00 2001 From: Markus Lehtonen Date: Fri, 1 Aug 2025 09:57:00 +0300 Subject: [PATCH] libcontainer/configs/validate: check that intelrdt is enabled If intelRdt is specified in the spec, check that the resctrl fs is actually mounted. Fixes e.g. the case where "intelRdt.closID" is specified but runc silently ignores this if resctrl is not mounted. Signed-off-by: Markus Lehtonen --- libcontainer/configs/validate/validator.go | 4 ++++ libcontainer/intelrdt/intelrdt.go | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/libcontainer/configs/validate/validator.go b/libcontainer/configs/validate/validator.go index a9d03a2e2..9be17ba05 100644 --- a/libcontainer/configs/validate/validator.go +++ b/libcontainer/configs/validate/validator.go @@ -283,6 +283,10 @@ func sysctl(config *configs.Config) error { func intelrdtCheck(config *configs.Config) error { if config.IntelRdt != nil { + if !intelrdt.IsEnabled() { + return fmt.Errorf("intelRdt is specified in config, but Intel RDT is not enabled") + } + if config.IntelRdt.ClosID == "." || config.IntelRdt.ClosID == ".." || strings.Contains(config.IntelRdt.ClosID, "/") { return fmt.Errorf("invalid intelRdt.ClosID %q", config.IntelRdt.ClosID) } diff --git a/libcontainer/intelrdt/intelrdt.go b/libcontainer/intelrdt/intelrdt.go index 7d4b4d38a..963ae28c3 100644 --- a/libcontainer/intelrdt/intelrdt.go +++ b/libcontainer/intelrdt/intelrdt.go @@ -416,6 +416,12 @@ func WriteIntelRdtTasks(dir string, pid int) error { return nil } +// IsEnabled checks if Intel RDT is enabled. +func IsEnabled() bool { + fsroot, err := Root() + return err == nil && fsroot != "" +} + // IsCATEnabled checks if Intel RDT/CAT is enabled. func IsCATEnabled() bool { featuresInit()