mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Kir Kolyshkin
e692886563
1. Dismantle and remove struct cgroupData. It contained three unrelated
entities (cgroup paths, pid, and resources), and made the code
harder to read. Most importantly, though, it is not needed.
Now, subsystems' Apply methods take path, resources, and pid.
To a reviewer -- the core of the changes is in fs.go and paths.go,
the rest of it is adapting to the new signatures and related test
changes.
2. Dismantle and remove struct cgroupTestUtil. This is a followup
to the previous item -- since cgroupData is gone, there is nothing
to hold in cgroupTestUtil. The change itself is very small (see
util_test.go), but this patch is big because of it -- mostly
because we had to replace helper.cgroup.Resources with
&config.Resources{}.
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
105 lines
2.6 KiB
Go
105 lines
2.6 KiB
Go
package fs
|
|
|
|
import (
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/opencontainers/runc/libcontainer/cgroups"
|
|
"github.com/opencontainers/runc/libcontainer/configs"
|
|
)
|
|
|
|
func TestInvalidCgroupPath(t *testing.T) {
|
|
if cgroups.IsCgroup2UnifiedMode() {
|
|
t.Skip("cgroup v2 is not supported")
|
|
}
|
|
|
|
root, err := rootPath()
|
|
if err != nil {
|
|
t.Fatalf("couldn't get cgroup root: %v", err)
|
|
}
|
|
|
|
testCases := []struct {
|
|
test string
|
|
path, name, parent string
|
|
}{
|
|
{
|
|
test: "invalid cgroup path",
|
|
path: "../../../../../../../../../../some/path",
|
|
},
|
|
{
|
|
test: "invalid absolute cgroup path",
|
|
path: "/../../../../../../../../../../some/path",
|
|
},
|
|
{
|
|
test: "invalid cgroup parent",
|
|
parent: "../../../../../../../../../../some/path",
|
|
name: "name",
|
|
},
|
|
{
|
|
test: "invalid absolute cgroup parent",
|
|
parent: "/../../../../../../../../../../some/path",
|
|
name: "name",
|
|
},
|
|
{
|
|
test: "invalid cgroup name",
|
|
parent: "parent",
|
|
name: "../../../../../../../../../../some/path",
|
|
},
|
|
{
|
|
test: "invalid absolute cgroup name",
|
|
parent: "parent",
|
|
name: "/../../../../../../../../../../some/path",
|
|
},
|
|
{
|
|
test: "invalid cgroup name and parent",
|
|
parent: "../../../../../../../../../../some/path",
|
|
name: "../../../../../../../../../../some/path",
|
|
},
|
|
{
|
|
test: "invalid absolute cgroup name and parent",
|
|
parent: "/../../../../../../../../../../some/path",
|
|
name: "/../../../../../../../../../../some/path",
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
t.Run(tc.test, func(t *testing.T) {
|
|
config := &configs.Cgroup{Path: tc.path, Name: tc.name, Parent: tc.parent}
|
|
|
|
inner, err := innerPath(config)
|
|
if err != nil {
|
|
t.Fatalf("couldn't get cgroup data: %v", err)
|
|
}
|
|
|
|
// Make sure the final inner path doesn't go outside the cgroup mountpoint.
|
|
if strings.HasPrefix(inner, "..") {
|
|
t.Errorf("SECURITY: cgroup innerPath is outside cgroup mountpoint!")
|
|
}
|
|
|
|
// Double-check, using an actual cgroup.
|
|
deviceRoot := filepath.Join(root, "devices")
|
|
devicePath, err := subsysPath(root, inner, "devices")
|
|
if err != nil {
|
|
t.Fatalf("couldn't get cgroup path: %v", err)
|
|
}
|
|
if !strings.HasPrefix(devicePath, deviceRoot) {
|
|
t.Errorf("SECURITY: cgroup path() is outside cgroup mountpoint!")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestTryDefaultCgroupRoot(t *testing.T) {
|
|
res := tryDefaultCgroupRoot()
|
|
exp := defaultCgroupRoot
|
|
if cgroups.IsCgroup2UnifiedMode() {
|
|
// checking that tryDefaultCgroupRoot does return ""
|
|
// in case /sys/fs/cgroup is not cgroup v1 root dir.
|
|
exp = ""
|
|
}
|
|
if res != exp {
|
|
t.Errorf("tryDefaultCgroupRoot: want %q, got %q", exp, res)
|
|
}
|
|
}
|