Skip to content

Commit 3e3094d

Browse files
author
Zhou Hao
committed
Add cgroupsPath validation
Implement the following specerror: CgroupsAbsPathRelToMount: In the case of an absolute path (starting with `/`), the runtime MUST take the path to be relative to the cgroups mount point. CgroupsPathAttach: If the value is specified, the runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`. Signed-off-by: Zhou Hao <[email protected]>
1 parent a02e0cb commit 3e3094d

File tree

1 file changed

+80
-0
lines changed

1 file changed

+80
-0
lines changed

Diff for: ‎cgroups/cgroups_v1.go

+80
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,14 @@ package cgroups
33
import (
44
"fmt"
55
"io/ioutil"
6+
"os"
67
"path/filepath"
78
"regexp"
89
"strconv"
910
"strings"
1011

1112
rspec "github.com/opencontainers/runtime-spec/specs-go"
13+
"github.com/opencontainers/runtime-tools/specerror"
1214
)
1315

1416
// CgroupV1 used for cgroupv1 validation
@@ -31,6 +33,15 @@ func getDeviceID(id string) (int64, int64, error) {
3133

3234
// GetBlockIOData gets cgroup blockio data
3335
func (cg *CgroupV1) GetBlockIOData(pid int, cgPath string) (*rspec.LinuxBlockIO, error) {
36+
if filepath.IsAbs(cgPath) {
37+
path := filepath.Join(cg.MountPath, "blkio", cgPath)
38+
if _, err := os.Stat(path); err != nil {
39+
if os.IsNotExist(err) {
40+
return nil, specerror.NewError(specerror.CgroupsAbsPathRelToMount, fmt.Errorf("In the case of an absolute path, the runtime MUST take the path to be relative to the cgroups mount point"), rspec.Version)
41+
}
42+
return nil, err
43+
}
44+
}
3445
lb := &rspec.LinuxBlockIO{}
3546
names := []string{"weight", "leaf_weight", "weight_device", "leaf_weight_device", "throttle.read_bps_device", "throttle.write_bps_device", "throttle.read_iops_device", "throttle.write_iops_device"}
3647
for i, name := range names {
@@ -48,6 +59,10 @@ func (cg *CgroupV1) GetBlockIOData(pid int, cgPath string) (*rspec.LinuxBlockIO,
4859
}
4960
contents, err := ioutil.ReadFile(filePath)
5061
if err != nil {
62+
if os.IsNotExist(err) {
63+
return nil, specerror.NewError(specerror.CgroupsPathAttach, fmt.Errorf("The runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`"), rspec.Version)
64+
}
65+
5166
return nil, err
5267
}
5368
switch i {
@@ -193,6 +208,15 @@ func (cg *CgroupV1) GetBlockIOData(pid int, cgPath string) (*rspec.LinuxBlockIO,
193208

194209
// GetCPUData gets cgroup cpus data
195210
func (cg *CgroupV1) GetCPUData(pid int, cgPath string) (*rspec.LinuxCPU, error) {
211+
if filepath.IsAbs(cgPath) {
212+
path := filepath.Join(cg.MountPath, "cpu", cgPath)
213+
if _, err := os.Stat(path); err != nil {
214+
if os.IsNotExist(err) {
215+
return nil, specerror.NewError(specerror.CgroupsAbsPathRelToMount, fmt.Errorf("In the case of an absolute path, the runtime MUST take the path to be relative to the cgroups mount point"), rspec.Version)
216+
}
217+
return nil, err
218+
}
219+
}
196220
lc := &rspec.LinuxCPU{}
197221
names := []string{"shares", "cfs_quota_us", "cfs_period_us"}
198222
for i, name := range names {
@@ -210,6 +234,10 @@ func (cg *CgroupV1) GetCPUData(pid int, cgPath string) (*rspec.LinuxCPU, error)
210234
}
211235
contents, err := ioutil.ReadFile(filePath)
212236
if err != nil {
237+
if os.IsNotExist(err) {
238+
return nil, specerror.NewError(specerror.CgroupsPathAttach, fmt.Errorf("The runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`"), rspec.Version)
239+
}
240+
213241
return nil, err
214242
}
215243
switch i {
@@ -349,6 +377,15 @@ func getHugePageSize() ([]string, error) {
349377

350378
// GetHugepageLimitData gets cgroup hugetlb data
351379
func (cg *CgroupV1) GetHugepageLimitData(pid int, cgPath string) ([]rspec.LinuxHugepageLimit, error) {
380+
if filepath.IsAbs(cgPath) {
381+
path := filepath.Join(cg.MountPath, "hugetlb", cgPath)
382+
if _, err := os.Stat(path); err != nil {
383+
if os.IsNotExist(err) {
384+
return nil, specerror.NewError(specerror.CgroupsAbsPathRelToMount, fmt.Errorf("In the case of an absolute path, the runtime MUST take the path to be relative to the cgroups mount point"), rspec.Version)
385+
}
386+
return nil, err
387+
}
388+
}
352389
lh := []rspec.LinuxHugepageLimit{}
353390
pageSizes, err := getHugePageSize()
354391
if err != nil {
@@ -369,6 +406,10 @@ func (cg *CgroupV1) GetHugepageLimitData(pid int, cgPath string) ([]rspec.LinuxH
369406
}
370407
contents, err := ioutil.ReadFile(filePath)
371408
if err != nil {
409+
if os.IsNotExist(err) {
410+
return nil, specerror.NewError(specerror.CgroupsPathAttach, fmt.Errorf("The runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`"), rspec.Version)
411+
}
412+
372413
return lh, err
373414
}
374415
res, err := strconv.ParseUint(strings.TrimSpace(string(contents)), 10, 64)
@@ -386,6 +427,15 @@ func (cg *CgroupV1) GetHugepageLimitData(pid int, cgPath string) ([]rspec.LinuxH
386427

387428
// GetMemoryData gets cgroup memory data
388429
func (cg *CgroupV1) GetMemoryData(pid int, cgPath string) (*rspec.LinuxMemory, error) {
430+
if filepath.IsAbs(cgPath) {
431+
path := filepath.Join(cg.MountPath, "memory", cgPath)
432+
if _, err := os.Stat(path); err != nil {
433+
if os.IsNotExist(err) {
434+
return nil, specerror.NewError(specerror.CgroupsAbsPathRelToMount, fmt.Errorf("In the case of an absolute path, the runtime MUST take the path to be relative to the cgroups mount point"), rspec.Version)
435+
}
436+
return nil, err
437+
}
438+
}
389439
lm := &rspec.LinuxMemory{}
390440
names := []string{"limit_in_bytes", "soft_limit_in_bytes", "memsw.limit_in_bytes", "kmem.limit_in_bytes", "kmem.tcp.limit_in_bytes", "swappiness", "oom_control"}
391441
for i, name := range names {
@@ -403,6 +453,10 @@ func (cg *CgroupV1) GetMemoryData(pid int, cgPath string) (*rspec.LinuxMemory, e
403453
}
404454
contents, err := ioutil.ReadFile(filePath)
405455
if err != nil {
456+
if os.IsNotExist(err) {
457+
return nil, specerror.NewError(specerror.CgroupsPathAttach, fmt.Errorf("The runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`"), rspec.Version)
458+
}
459+
406460
return nil, err
407461
}
408462
switch i {
@@ -468,6 +522,15 @@ func (cg *CgroupV1) GetMemoryData(pid int, cgPath string) (*rspec.LinuxMemory, e
468522

469523
// GetNetworkData gets cgroup network data
470524
func (cg *CgroupV1) GetNetworkData(pid int, cgPath string) (*rspec.LinuxNetwork, error) {
525+
if filepath.IsAbs(cgPath) {
526+
path := filepath.Join(cg.MountPath, "net_cls", cgPath)
527+
if _, err := os.Stat(path); err != nil {
528+
if os.IsNotExist(err) {
529+
return nil, specerror.NewError(specerror.CgroupsAbsPathRelToMount, fmt.Errorf("In the case of an absolute path, the runtime MUST take the path to be relative to the cgroups mount point"), rspec.Version)
530+
}
531+
return nil, err
532+
}
533+
}
471534
ln := &rspec.LinuxNetwork{}
472535
fileName := strings.Join([]string{"net_cls", "classid"}, ".")
473536
filePath := filepath.Join(cg.MountPath, "net_cls", cgPath, fileName)
@@ -483,6 +546,10 @@ func (cg *CgroupV1) GetNetworkData(pid int, cgPath string) (*rspec.LinuxNetwork,
483546
}
484547
contents, err := ioutil.ReadFile(filePath)
485548
if err != nil {
549+
if os.IsNotExist(err) {
550+
return nil, specerror.NewError(specerror.CgroupsPathAttach, fmt.Errorf("The runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`"), rspec.Version)
551+
}
552+
486553
return nil, err
487554
}
488555
res, err := strconv.ParseUint(strings.TrimSpace(string(contents)), 10, 64)
@@ -526,6 +593,15 @@ func (cg *CgroupV1) GetNetworkData(pid int, cgPath string) (*rspec.LinuxNetwork,
526593

527594
// GetPidsData gets cgroup pids data
528595
func (cg *CgroupV1) GetPidsData(pid int, cgPath string) (*rspec.LinuxPids, error) {
596+
if filepath.IsAbs(cgPath) {
597+
path := filepath.Join(cg.MountPath, "pids", cgPath)
598+
if _, err := os.Stat(path); err != nil {
599+
if os.IsNotExist(err) {
600+
return nil, specerror.NewError(specerror.CgroupsAbsPathRelToMount, fmt.Errorf("In the case of an absolute path, the runtime MUST take the path to be relative to the cgroups mount point"), rspec.Version)
601+
}
602+
return nil, err
603+
}
604+
}
529605
lp := &rspec.LinuxPids{}
530606
fileName := strings.Join([]string{"pids", "max"}, ".")
531607
filePath := filepath.Join(cg.MountPath, "pids", cgPath, fileName)
@@ -545,6 +621,10 @@ func (cg *CgroupV1) GetPidsData(pid int, cgPath string) (*rspec.LinuxPids, error
545621
}
546622
res, err := strconv.ParseInt(strings.TrimSpace(string(contents)), 10, 64)
547623
if err != nil {
624+
if os.IsNotExist(err) {
625+
return nil, specerror.NewError(specerror.CgroupsPathAttach, fmt.Errorf("The runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`"), rspec.Version)
626+
}
627+
548628
return nil, err
549629
}
550630
lp.Limit = res

0 commit comments

Comments
 (0)