jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fix docker/docker#27484 

Signed-off-by: Ce Gao <ce.gao@outlook.com>
This commit is contained in:
Ce Gao 2016-10-22 11:22:52 +08:00
parent c4198ad9af
commit bc84f83344
1 changed files with 25 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
libcontainer/configs/validate/validator.go
View File

@ -125,14 +125,36 @@ func (v *ConfigValidator) sysctl(config *configs.Config) error {
}
}
if strings.HasPrefix(s, "net.") {
if config.Namespaces.Contains(configs.NEWNET) {
continue
} else {
if !config.Namespaces.Contains(configs.NEWNET) {
return fmt.Errorf("sysctl %q is not allowed in the hosts network namespace", s)
}
if path := config.Namespaces.PathOf(configs.NEWNET); path != "" {
if err := checkHostNs(s, path); err != nil {
return err
}
}
}
return fmt.Errorf("sysctl %q is not in a separate kernel namespace", s)
}
return nil
}
// checkHostNs checks whether network sysctl is used in host namespace.
func checkHostNs(sysctlConfig string, path string) error {
var currentProcessNetns = "/proc/self/ns/net"
// readlink on the current processes network namespace
destOfCurrentProcess, err := os.Readlink(currentProcessNetns)
if err != nil {
return fmt.Errorf("read soft link %q error", currentProcessNetns)
}
// readlink on the path provided in the struct
destOfContainer, err := os.Readlink(path)
if err != nil {
return fmt.Errorf("read soft link %q error", path)
}
if destOfContainer == destOfCurrentProcess {
return fmt.Errorf("sysctl %q is not allowed in the hosts network namespace", sysctlConfig)
}
return nil
}