libct/devices: deprecate in favour of moby/sys/devices

The libcontainer/devices package has been moved to moby/sys/devices, so
we can just point users to that and keep some compatibility shims around
until runc 1.6. We don't use it at all so there are no other changes
needed.

Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
(cherry picked from commit b345c78dca)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

libcontainer/devices/device_deprecated_unix.go

@@ -0,0 +1,47 @@
+//go:build !windows
+
+// Package devices provides some helper functions for constructing device
+// configurations for runc. These are exclusively used by higher-level runtimes
+// that need to configure runc's device list based on existing devices.
+//
+// Deprecated: Use github.com/moby/sys/devices instead. This package will be
+// removed in runc 1.6.
+package devices
+
+import (
+	"github.com/moby/sys/devices"
+	"github.com/opencontainers/cgroups/devices/config"
+)
+
+// ErrNotADevice denotes that a file is not a valid linux device.
+//
+// Deprecated: Use [devices.ErrNotADevice] instead. This package will be
+// removed in runc 1.6.
+var ErrNotADevice = devices.ErrNotADevice
+
+// DeviceFromPath takes the path to a device and its cgroup_permissions (which
+// cannot be easily queried) to look up the information about a linux device
+// and returns that information as a Device struct.
+//
+// Deprecated: Use [devices.DeviceFromPath] instead. This package will be
+// removed in runc 1.6.
+func DeviceFromPath(path, permissions string) (*config.Device, error) {
+	return devices.DeviceFromPath(path, permissions)
+}
+
+// HostDevices returns all devices that can be found under /dev directory.
+//
+// Deprecated: Use [devices.HostDevices] instead. This package will be
+// removed in runc 1.6.
+func HostDevices() ([]*config.Device, error) {
+	return devices.HostDevices()
+}
+
+// GetDevices recursively traverses a directory specified by path
+// and returns all devices found there.
+//
+// Deprecated: Use [devices.GetDevices] instead. This package will be
+// removed in runc 1.6.
+func GetDevices(path string) ([]*config.Device, error) {
+	return devices.GetDevices(path)
+}

libcontainer/devices/device_unix.go

@@ -1,113 +0,0 @@
-//go:build !windows
-
-package devices
-
-import (
-	"errors"
-	"os"
-	"path/filepath"
-
-	"github.com/opencontainers/cgroups/devices/config"
-	"golang.org/x/sys/unix"
-)
-
-// ErrNotADevice denotes that a file is not a valid linux device.
-var ErrNotADevice = errors.New("not a device node")
-
-// Testing dependencies
-var (
-	unixLstat = unix.Lstat
-	osReadDir = os.ReadDir
-)
-
-// DeviceFromPath takes the path to a device and its cgroup_permissions (which
-// cannot be easily queried) to look up the information about a linux device
-// and returns that information as a Device struct.
-func DeviceFromPath(path, permissions string) (*config.Device, error) {
-	var stat unix.Stat_t
-	err := unixLstat(path, &stat)
-	if err != nil {
-		return nil, err
-	}
-
-	var (
-		devType   config.Type
-		mode      = stat.Mode
-		devNumber = uint64(stat.Rdev) //nolint:unconvert // Rdev is uint32 on e.g. MIPS.
-		major     = unix.Major(devNumber)
-		minor     = unix.Minor(devNumber)
-	)
-	switch mode & unix.S_IFMT {
-	case unix.S_IFBLK:
-		devType = config.BlockDevice
-	case unix.S_IFCHR:
-		devType = config.CharDevice
-	case unix.S_IFIFO:
-		devType = config.FifoDevice
-	default:
-		return nil, ErrNotADevice
-	}
-	return &config.Device{
-		Rule: config.Rule{
-			Type:        devType,
-			Major:       int64(major),
-			Minor:       int64(minor),
-			Permissions: config.Permissions(permissions),
-		},
-		Path:     path,
-		FileMode: os.FileMode(mode &^ unix.S_IFMT),
-		Uid:      stat.Uid,
-		Gid:      stat.Gid,
-	}, nil
-}
-
-// HostDevices returns all devices that can be found under /dev directory.
-func HostDevices() ([]*config.Device, error) {
-	return GetDevices("/dev")
-}
-
-// GetDevices recursively traverses a directory specified by path
-// and returns all devices found there.
-func GetDevices(path string) ([]*config.Device, error) {
-	files, err := osReadDir(path)
-	if err != nil {
-		return nil, err
-	}
-	var out []*config.Device
-	for _, f := range files {
-		switch {
-		case f.IsDir():
-			switch f.Name() {
-			// ".lxc" & ".lxd-mounts" added to address https://github.com/lxc/lxd/issues/2825
-			// ".udev" added to address https://github.com/opencontainers/runc/issues/2093
-			case "pts", "shm", "fd", "mqueue", ".lxc", ".lxd-mounts", ".udev":
-				continue
-			default:
-				sub, err := GetDevices(filepath.Join(path, f.Name()))
-				if err != nil {
-					return nil, err
-				}
-
-				out = append(out, sub...)
-				continue
-			}
-		case f.Name() == "console":
-			continue
-		}
-		device, err := DeviceFromPath(filepath.Join(path, f.Name()), "rwm")
-		if err != nil {
-			if errors.Is(err, ErrNotADevice) {
-				continue
-			}
-			if errors.Is(err, os.ErrNotExist) {
-				continue
-			}
-			return nil, err
-		}
-		if device.Type == config.FifoDevice {
-			continue
-		}
-		out = append(out, device)
-	}
-	return out, nil
-}

libcontainer/devices/device_unix_test.go

@@ -1,97 +0,0 @@
-//go:build !windows
-
-package devices
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"testing"
-
-	"github.com/opencontainers/cgroups/devices/config"
-	"golang.org/x/sys/unix"
-)
-
-func cleanupTest() {
-	unixLstat = unix.Lstat
-	osReadDir = os.ReadDir
-}
-
-func TestDeviceFromPathLstatFailure(t *testing.T) {
-	testError := errors.New("test error")
-
-	// Override unix.Lstat to inject error.
-	unixLstat = func(path string, stat *unix.Stat_t) error {
-		return testError
-	}
-	defer cleanupTest()
-
-	_, err := DeviceFromPath("", "")
-	if !errors.Is(err, testError) {
-		t.Fatalf("Unexpected error %v, expected %v", err, testError)
-	}
-}
-
-func TestHostDevicesIoutilReadDirFailure(t *testing.T) {
-	testError := errors.New("test error")
-
-	// Override os.ReadDir to inject error.
-	osReadDir = func(dirname string) ([]fs.DirEntry, error) {
-		return nil, testError
-	}
-	defer cleanupTest()
-
-	_, err := HostDevices()
-	if !errors.Is(err, testError) {
-		t.Fatalf("Unexpected error %v, expected %v", err, testError)
-	}
-}
-
-func TestHostDevicesIoutilReadDirDeepFailure(t *testing.T) {
-	testError := errors.New("test error")
-	called := false
-
-	// Override os.ReadDir to inject error after the first call.
-	osReadDir = func(dirname string) ([]fs.DirEntry, error) {
-		if called {
-			return nil, testError
-		}
-		called = true
-
-		// Provoke a second call.
-		fi, err := os.Lstat("/tmp")
-		if err != nil {
-			t.Fatalf("Unexpected error %v", err)
-		}
-
-		return []fs.DirEntry{fs.FileInfoToDirEntry(fi)}, nil
-	}
-	defer cleanupTest()
-
-	_, err := HostDevices()
-	if !errors.Is(err, testError) {
-		t.Fatalf("Unexpected error %v, expected %v", err, testError)
-	}
-}
-
-func TestHostDevicesAllValid(t *testing.T) {
-	devices, err := HostDevices()
-	if err != nil {
-		t.Fatalf("failed to get host devices: %v", err)
-	}
-
-	for _, device := range devices {
-		// Devices can't have major number 0.
-		if device.Major == 0 {
-			t.Errorf("device entry %+v has zero major number", device)
-		}
-		switch device.Type {
-		case config.BlockDevice, config.CharDevice:
-		case config.FifoDevice:
-			t.Logf("fifo devices shouldn't show up from HostDevices")
-			fallthrough
-		default:
-			t.Errorf("device entry %+v has unexpected type %v", device, device.Type)
-		}
-	}
-}

libcontainer/devices/doc.go

@@ -1,4 +0,0 @@
-// Package devices provides some helper functions for constructing device
-// configurations for runc. These are exclusively used by higher-level runtimes
-// that need to configure runc's device list based on existing devices.
-package devices