|
34 | 34 | "/dev/shm": "tmpfs", |
35 | 35 | } |
36 | 36 |
|
| 37 | + defaultSymlinks = map[string]string{ |
| 38 | + "/dev/fd": "/proc/self/fd", |
| 39 | + "/dev/stdin": "/proc/self/fd/0", |
| 40 | + "/dev/stdout": "/proc/self/fd/1", |
| 41 | + "/dev/stderr": "/proc/self/fd/2", |
| 42 | + } |
| 43 | + |
37 | 44 | defaultDevices = []string{ |
38 | 45 | "/dev/null", |
39 | 46 | "/dev/zero", |
@@ -340,6 +347,29 @@ func validateLinuxDevices(spec *rspec.Spec) error { |
340 | 347 | return nil |
341 | 348 | } |
342 | 349 |
|
| 350 | +func validateDefaultSymlinks(spec *rspec.Spec) error { |
| 351 | + logrus.Debugf("validating linux default symbolic links") |
| 352 | + |
| 353 | + for symlink, dest := range defaultSymlinks { |
| 354 | + fi, err := os.Lstat(symlink) |
| 355 | + if err != nil { |
| 356 | + return err |
| 357 | + } |
| 358 | + if fi.Mode()&os.ModeSymlink != os.ModeSymlink { |
| 359 | + return fmt.Errorf("%v is not a symbolic link as expected", symlink) |
| 360 | + } |
| 361 | + realDest, err := os.Readlink(symlink) |
| 362 | + if err != nil { |
| 363 | + return err |
| 364 | + } |
| 365 | + if realDest != dest { |
| 366 | + return fmt.Errorf("link destation of %v expected is %v, actual is %v", symlink, dest, realDest) |
| 367 | + } |
| 368 | + } |
| 369 | + |
| 370 | + return nil |
| 371 | +} |
| 372 | + |
343 | 373 | func validateDefaultDevices(spec *rspec.Spec) error { |
344 | 374 | logrus.Debugf("validating linux default devices") |
345 | 375 |
|
@@ -564,6 +594,7 @@ func validate(context *cli.Context) error { |
564 | 594 |
|
565 | 595 | linuxValidations := []validation{ |
566 | 596 | validateCapabilities, |
| 597 | + validateDefaultSymlinks, |
567 | 598 | validateDefaultFS, |
568 | 599 | validateDefaultDevices, |
569 | 600 | validateLinuxDevices, |
|
0 commit comments