mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Kir Kolyshkin
b6967fa84c
This commit separates the functionality of setting cgroup device rules out of libct/cgroups to libct/cgroups/devices package. This package, if imported, sets the function variables in libct/cgroups and libct/cgroups/systemd, so that a cgroup manager can use those to manage devices. If those function variables are nil (when libct/cgroups/devices are not imported), a cgroup manager returns the ErrDevicesUnsupported in case any device rules are set in Resources. It also consolidates the code from libct/cgroups/ebpf and libct/cgroups/ebpf/devicefilter into libct/cgroups/devices. Moved some tests in libct/cg/sd that require device management to libct/sd/devices. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
65 lines
1.4 KiB
Go
65 lines
1.4 KiB
Go
package devices
|
|
|
|
import (
|
|
"os"
|
|
"path"
|
|
"testing"
|
|
|
|
"github.com/opencontainers/runc/libcontainer/cgroups"
|
|
"github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
|
|
"github.com/opencontainers/runc/libcontainer/configs"
|
|
"github.com/opencontainers/runc/libcontainer/devices"
|
|
)
|
|
|
|
func init() {
|
|
testingSkipFinalCheck = true
|
|
cgroups.TestMode = true
|
|
}
|
|
|
|
func TestSetV1Allow(t *testing.T) {
|
|
dir := t.TempDir()
|
|
|
|
for file, contents := range map[string]string{
|
|
"devices.allow": "",
|
|
"devices.deny": "",
|
|
"devices.list": "a *:* rwm",
|
|
} {
|
|
err := os.WriteFile(path.Join(dir, file), []byte(contents), 0o600)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
r := &configs.Resources{
|
|
Devices: []*devices.Rule{
|
|
{
|
|
Type: devices.CharDevice,
|
|
Major: 1,
|
|
Minor: 5,
|
|
Permissions: devices.Permissions("rwm"),
|
|
Allow: true,
|
|
},
|
|
},
|
|
}
|
|
|
|
if err := setV1(dir, r); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
// The default deny rule must be written.
|
|
value, err := fscommon.GetCgroupParamString(dir, "devices.deny")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if value[0] != 'a' {
|
|
t.Errorf("Got the wrong value (%q), set devices.deny failed.", value)
|
|
}
|
|
|
|
// Permitted rule must be written.
|
|
if value, err := fscommon.GetCgroupParamString(dir, "devices.allow"); err != nil {
|
|
t.Fatal(err)
|
|
} else if value != "c 1:5 rwm" {
|
|
t.Errorf("Got the wrong value (%q), set devices.allow failed.", value)
|
|
}
|
|
}
|