jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Skip updates on parent Devices cgroup 

Signed-off-by: Buddha Prakash <buddhap@google.com>
This commit is contained in:
Buddha Prakash 2016-07-20 10:46:11 -07:00
parent bd1d3ac048
commit ef4ff6a8ad
5 changed files with 22 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libcontainer/README.md
View File

@ -77,7 +77,7 @@ config := &configs.Config{
Parent: "system", Parent: "system",
Resources: &configs.Resources{ Resources: &configs.Resources{
MemorySwappiness: nil, MemorySwappiness: nil,
AllowAllDevices: false, AllowAllDevices: nil,
AllowedDevices: configs.DefaultAllowedDevices, AllowedDevices: configs.DefaultAllowedDevices,
}, },
}, },

4
libcontainer/cgroups/fs/devices.go
View File

@ -43,7 +43,8 @@ func (s *DevicesGroup) Set(path string, cgroup *configs.Cgroup) error {
} }
return nil return nil
} }
if !cgroup.Resources.AllowAllDevices { if cgroup.Resources.AllowAllDevices != nil {
if *cgroup.Resources.AllowAllDevices == false {
if err := writeFile(path, "devices.deny", "a"); err != nil { if err := writeFile(path, "devices.deny", "a"); err != nil {
return err return err
} }
@ -59,6 +60,7 @@ func (s *DevicesGroup) Set(path string, cgroup *configs.Cgroup) error {
if err := writeFile(path, "devices.allow", "a"); err != nil { if err := writeFile(path, "devices.allow", "a"); err != nil {
return err return err
} }
}
for _, dev := range cgroup.Resources.DeniedDevices { for _, dev := range cgroup.Resources.DeniedDevices {
if err := writeFile(path, "devices.deny", dev.CgroupString()); err != nil { if err := writeFile(path, "devices.deny", dev.CgroupString()); err != nil {

7
libcontainer/cgroups/fs/devices_test.go
View File

@ -40,8 +40,8 @@ func TestDevicesSetAllow(t *testing.T) {
helper.writeFileContents(map[string]string{ helper.writeFileContents(map[string]string{
"devices.deny": "a", "devices.deny": "a",
}) })
allowAllDevices := false
helper.CgroupData.config.Resources.AllowAllDevices = false helper.CgroupData.config.Resources.AllowAllDevices = &allowAllDevices
helper.CgroupData.config.Resources.AllowedDevices = allowedDevices helper.CgroupData.config.Resources.AllowedDevices = allowedDevices
devices := &DevicesGroup{} devices := &DevicesGroup{}
if err := devices.Set(helper.CgroupPath, helper.CgroupData.config); err != nil { if err := devices.Set(helper.CgroupPath, helper.CgroupData.config); err != nil {
@ -66,7 +66,8 @@ func TestDevicesSetDeny(t *testing.T) {
"devices.allow": "a", "devices.allow": "a",
}) })
helper.CgroupData.config.Resources.AllowAllDevices = true allowAllDevices := true
helper.CgroupData.config.Resources.AllowAllDevices = &allowAllDevices
helper.CgroupData.config.Resources.DeniedDevices = deniedDevices helper.CgroupData.config.Resources.DeniedDevices = deniedDevices
devices := &DevicesGroup{} devices := &DevicesGroup{}
if err := devices.Set(helper.CgroupPath, helper.CgroupData.config); err != nil { if err := devices.Set(helper.CgroupPath, helper.CgroupData.config); err != nil {

2
libcontainer/configs/cgroup_unix.go
View File

@ -36,7 +36,7 @@ type Cgroup struct {
type Resources struct { type Resources struct {
// If this is true allow access to any kind of device within the container. If false, allow access only to devices explicitly listed in the allowed_devices list. // If this is true allow access to any kind of device within the container. If false, allow access only to devices explicitly listed in the allowed_devices list.
// Deprecated // Deprecated
AllowAllDevices bool `json:"allow_all_devices,omitempty"` AllowAllDevices *bool `json:"allow_all_devices,omitempty"`
// Deprecated // Deprecated
AllowedDevices []*Device `json:"allowed_devices,omitempty"` AllowedDevices []*Device `json:"allowed_devices,omitempty"`
// Deprecated // Deprecated

3
libcontainer/integration/template_test.go
View File

@ -20,6 +20,7 @@ const defaultMountFlags = syscall.MS_NOEXEC | syscall.MS_NOSUID | syscall.MS_NOD
// it uses a network strategy of just setting a loopback interface // it uses a network strategy of just setting a loopback interface
// and the default setup for devices // and the default setup for devices
func newTemplateConfig(rootfs string) *configs.Config { func newTemplateConfig(rootfs string) *configs.Config {
allowAllDevices := false
return &configs.Config{ return &configs.Config{
Rootfs: rootfs, Rootfs: rootfs,
Capabilities: []string{ Capabilities: []string{
@ -49,7 +50,7 @@ func newTemplateConfig(rootfs string) *configs.Config {
Path: "integration/test", Path: "integration/test",
Resources: &configs.Resources{ Resources: &configs.Resources{
MemorySwappiness: nil, MemorySwappiness: nil,
AllowAllDevices: false, AllowAllDevices: &allowAllDevices,
AllowedDevices: configs.DefaultAllowedDevices, AllowedDevices: configs.DefaultAllowedDevices,
}, },
}, },