- Check if Selinux is enabled before relabeling. This is a bug.
- Make exclusion detection constant time. Kinda buggy too, imo.
- Do not depend on a magic string to create a new Selinux context.
Signed-off-by: David Calavera <david.calavera@gmail.com>
TL;DR: check for IsExist(err) after a failed MkdirAll() is both
redundant and wrong -- so two reasons to remove it.
Quoting MkdirAll documentation:
> MkdirAll creates a directory named path, along with any necessary
> parents, and returns nil, or else returns an error. If path
> is already a directory, MkdirAll does nothing and returns nil.
This means two things:
1. If a directory to be created already exists, no error is
returned.
2. If the error returned is IsExist (EEXIST), it means there exists
a non-directory with the same name as MkdirAll need to use for
directory. Example: we want to MkdirAll("a/b"), but file "a"
(or "a/b") already exists, so MkdirAll fails.
The above is a theory, based on quoted documentation and my UNIX
knowledge.
3. In practice, though, current MkdirAll implementation [1] returns
ENOTDIR in most of cases described in #2, with the exception when
there is a race between MkdirAll and someone else creating the
last component of MkdirAll argument as a file. In this very case
MkdirAll() will indeed return EEXIST.
Because of #1, IsExist check after MkdirAll is not needed.
Because of #2 and #3, ignoring IsExist error is just plain wrong,
as directory we require is not created. It's cleaner to report
the error now.
Note this error is all over the tree, I guess due to copy-paste,
or trying to follow the same usage pattern as for Mkdir(),
or some not quite correct examples on the Internet.
[1] https://github.com/golang/go/blob/f9ed2f75/src/os/path.go
Signed-off-by: Kir Kolyshkin <kir@openvz.org>
This commit allows to send `go test` arguments to current makefile
`test` and `localtest` targets.
A usage example would be `make test TESTFLAGS="-run=SomeTestFunction"`
to easily run a single test function.
Signed-off-by: Marcos Lilljedahl <marcosnils@gmail.com>
Now that the generated spec (and the example above in the README) use
uid/gid and don't have the hardcoded `daemon` entry, the statement about
changing `daemon` to `root` no longer applies. Also added a comment
about using the `runc spec` command to generate `config.json`.
Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)
Only add the localhost interface information to the config if the NEWNET
flag is passed on the namespaces.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
When the copyBusybox() fails, the error message should be
propagated to the caller of newRootfs().
Signed-off-by: Lai Jiangshan <jiangshanlai@gmail.com>
This makes some changes to the maintainer's guide and roles within the
project. It removed the concept of a BDFL and carries over the chief
maintainer role into the project. BDFL sucks and we can do better and
these changed help to make many more things specific around adding new
maintainers and removing them as well.
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Actually cgroup mounts are bind-mounts, so they should be
handled by the same way.
Reported-by: Ross Boucher <rboucher@gmail.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Sometimes subsystem can be mounted to path like "subsystem1,subsystem2",
so we need to handle this.
Signed-off-by: Alexander Morozov <lk4d4@docker.com>
rajasec
Alexander Morozov
Antonio Murdaca
David Calavera
Mrunal Patel
Alexander Morozov
Andrey Vagin
Kir Kolyshkin
Marcos Lilljedahl
Phil Estes
Michael Crosby
Mrunal Patel
Lai Jiangshan
Jin-Hwan Jeong
Fabio Kung
Shishir Mahajan
Rohit Jnagal