The apparmor tag was introduced in a01ed80 (2014) to make cgo dependency
on libapparmor optional.
However, the cgo dependency was removed in db093f6 (2017), so it is no
longer meaningful to keep apparmor build tag.
Close#2704
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
> libcontainer/intelrdt/monitoring.go:24:2: SA5001: should check returned error before deferring file.Close() (staticcheck)
> defer file.Close()
> ^
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
> libcontainer/container_linux.go:768:2: S1017: should replace this `if` statement with an unconditional `strings.TrimPrefix` (gosimple)
> if strings.HasPrefix(mountDest, c.config.Rootfs) {
> ^
> libcontainer/container_linux.go:1150:2: S1017: should replace this `if` statement with an unconditional `strings.TrimPrefix` (gosimple)
> if strings.HasPrefix(mountDest, c.config.Rootfs) {
> ^
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
> libcontainer/container_linux.go:683:2: S1021: should merge variable declaration with assignment on next line (gosimple)
> var t criurpc.CriuReqType
> ^
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
... use the one from unix instead.
Coincidentally, this fixes this warning from gosimple linter:
> libcontainer/integration/exec_test.go:448:2: S1021: should merge variable declaration with assignment on next line (gosimple)
> var netAdminBit uint
> ^
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This fixes the following warnings:
> libcontainer/integration/exec_test.go:369:18: S1030: should use stdout.String() instead of string(stdout.Bytes()) (gosimple)
> outputStatus := string(stdout.Bytes())
> ^
> libcontainer/integration/exec_test.go:422:18: S1030: should use stdout.String() instead of string(stdout.Bytes()) (gosimple)
> outputStatus := string(stdout.Bytes())
> ^
> libcontainer/integration/exec_test.go:486:18: S1030: should use stdout.String() instead of string(stdout.Bytes()) (gosimple)
> outputGroups := string(stdout.Bytes())
> ^
> libcontainer/integration/execin_test.go:191:18: S1030: should use stdout.String() instead of string(stdout.Bytes()) (gosimple)
> outputGroups := string(stdout.Bytes())
> ^
> libcontainer/integration/execin_test.go:474:9: S1030: should use stdout.String() instead of string(stdout.Bytes()) (gosimple)
> out := string(stdout.Bytes())
> ^
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Commit 4415446c32 introduces this function which is never used.
Remove it.
This fixes
> libcontainer/container_linux.go:1813:26: func `(*linuxContainer).deleteState` is unused (unused)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
> libcontainer/cgroups/utils.go:282:4: SA4006: this value of `paths` is never used (staticcheck)
> paths = make(map[string]string)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
In case we get ENOSYS from openat2(2), this is expected, so log that
we're falling back to using securejoin as debug.
Otherwise, log it as a warning (as the error is unexpected, but we're
still good to go).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
In case openat2 is available, it will be used to guarantee
that we're not accessing anything other than cgroupfs[2] files.
In cases when openat2 is not available, or when cgroup has a
non-standard prefix (not "/sys/fs/cgroup", which might theoretically
be the case on some very old installs and/or very custom systems),
fall back to using securejoin + os.Open like we did before.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This "reverts" commit 9ff7b82f9. We use the repo provided and maintained
by the CRIU team instead of compiling it from source.
While at it,
1. Don't install packages that were solely needed to compile CRIU.
2. Combine all apt-related stuff into a single step, so we don't
download and then remove apt metadata 3 times.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Some libc versions still in use by distributions (such as SLE) do not
define SYS_memfd_create even though the kernel supports the feature.
Since the syscall numbers are fixed, we can just hard-code them if
__NR_memfd_create is not defined.
We only do this for a handful of architectures, since containers aren't
widely supported on every possible Linux architecture.
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
The `all` argument was introduced by commit f557996401 specifically
for use by cAdvisor (see [1]), but there were no test cases added,
so it was later broken by 5ee0648bfb which started incrementing
numFound unconditionally.
Fix this (by not checking numFound in case all is true), and add a
simple test case to avoid future regressions.
[1] https://github.com/google/cadvisor/pull/1476
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Move the Device-related types to libcontainer/devices, so that
the package can be used in isolation. Aliases have been created
in libcontainer/configs for backward compatibility.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Fixes the following errcheck linter warnings
> contrib/cmd/recvtty/recvtty.go:115:10: Error return value of `io.Copy` is not checked (errcheck)
> io.Copy(os.Stdout, c)
> ^
> contrib/cmd/recvtty/recvtty.go:120:11: Error return value of `io.Copy` is not checked (errcheck)
> io.Copy(c, os.Stdin)
> ^
> contrib/cmd/recvtty/recvtty.go:175:11: Error return value of `io.Copy` is not checked (errcheck)
> io.Copy(devnull, master)
> ^
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
It looks like we need to wait for the both copy goroutines to finish,
not just the one that happen to finish first.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This is Ubuntu 20.04 so cgroup v1 testing only :(
The upside is, it's pretty fast (currently all the tests finish
within 5 minutes).
rootless tests take longer time so we run them in parallel
with non-rootless ones. Also, to balance the time, we run
unit tests when rootless is not set. IOW, 'rootless' in job
name means it's only rootless integration tests, and no rootless
means it's unit tests, integration tests with fs driver, and
integration tests with systemd driver.
Note, `script` is used to run integration tests to provide a tty
(which by default is not available on gh actions).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Note that
1. No golang caching is required, since we do not build any go code,
and it does not look like it make sense to cache a single binary
we donwload from github.
2. Use a problem matcher, so the PRs will be annotated with
shellcheck warnings.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This serves two purposes:
1. A developer can now run `make shellcheck` to show any issues with
shell or bats files formatting (this requires a recent version of
shfmt, which I think is out of scope for Makefile).
2. Exclude shellcheck from travis ci (will be re-added as a GH action
by the next commit).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This serves two purposes:
1. A developer can now run `make shfmt` to show and fix any issues
with shell or bats files formatting (this requires a recent version
of shfmt, which I think is out of scope for Makefile).
2. Exclude shfmt check from travis ci (will be re-added as a GH action
by the next commit).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
full diff: https://github.com/cilium/ebpf/compare/v0.1.0...v0.2.0
- btf: add go-fuzz targets
- btf: avoid Type copy in FuncProto.walk
- btf: check err in loadSpecFromVmlinux
- btf: handle type name flavours
- CI: test on 5.9 kernel
- cmd/bpf2go: output ELF .o next to the .go file
- link: add AttachSkLookup
- Remove two unused functions
- Support LSM attach
- use buffered I/O to cut down on read syscalls
- Various doc link fixes
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Akihiro Suda