From f19aa2d04d10eda759c8d5424716405dbf32183d Mon Sep 17 00:00:00 2001 From: Samuel Ortiz Date: Sat, 10 Dec 2016 02:34:15 +0100 Subject: [PATCH] validate: Check that the given namespace path is a symlink When checking if the provided networking namespace is the host one or not, we should first check if it's a symbolic link or not as in some cases we can use persistent networking namespace under e.g. /var/run/netns/. Signed-off-by: Samuel Ortiz --- libcontainer/configs/validate/validator.go | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/libcontainer/configs/validate/validator.go b/libcontainer/configs/validate/validator.go index 3d736cff2..f076f506a 100644 --- a/libcontainer/configs/validate/validator.go +++ b/libcontainer/configs/validate/validator.go @@ -148,6 +148,15 @@ func (v *ConfigValidator) sysctl(config *configs.Config) error { return nil } +func isSymbolicLink(path string) (bool, error) { + fi, err := os.Lstat(path) + if err != nil { + return false, err + } + + return fi.Mode()&os.ModeSymlink == os.ModeSymlink, nil +} + // checkHostNs checks whether network sysctl is used in host namespace. func checkHostNs(sysctlConfig string, path string) error { var currentProcessNetns = "/proc/self/ns/net" @@ -156,6 +165,19 @@ func checkHostNs(sysctlConfig string, path string) error { if err != nil { return fmt.Errorf("read soft link %q error", currentProcessNetns) } + + // First check if the provided path is a symbolic link + symLink, err := isSymbolicLink(path) + if err != nil { + return fmt.Errorf("could not check that %q is a symlink: %v", path, err) + } + + if symLink == false { + // The provided namespace is not a symbolic link, + // it is not the host namespace. + return nil + } + // readlink on the path provided in the struct destOfContainer, err := os.Readlink(path) if err != nil {