11package main
22
33import (
4+ "bufio"
45 "bytes"
56 "encoding/json"
67 "fmt"
@@ -370,6 +371,62 @@ func validateMountsExist(spec *rspec.Spec) error {
370371 return nil
371372}
372373
374+ func getActualCgroupPath () (string , error ) {
375+ f , err := os .Open ("/proc/self/cgroup" )
376+ if err != nil {
377+ return "" , err
378+ }
379+ defer f .Close ()
380+
381+ cgroupPath := ""
382+ s := bufio .NewScanner (f )
383+ for s .Scan () {
384+ if err := s .Err (); err != nil {
385+ return "" , err
386+ }
387+
388+ text := s .Text ()
389+ parts := strings .Split (text , ":" )
390+ if cgroupPath == parts [2 ] && cgroupPath != "" {
391+ continue
392+ } else if cgroupPath == "" && parts [2 ] != "" {
393+ cgroupPath = parts [2 ]
394+ } else {
395+ return "" , fmt .Errorf ("error path with cgroup controllers" )
396+ }
397+ }
398+
399+ if cgroupPath == "" {
400+ return "" , fmt .Errorf ("can not get cgroup path" )
401+ }
402+ return cgroupPath , nil
403+ }
404+
405+ func validateCgroupsPath (spec * rspec.Spec ) error {
406+ logrus .Debugf ("validating cgroupsPath" )
407+ expectedPath := spec .Linux .CgroupsPath
408+ if expectedPath == nil {
409+ return nil
410+ }
411+ * expectedPath = strings .Replace (* expectedPath , ":" , "/" , - 1 )
412+
413+ actualPath , err := getActualCgroupPath ()
414+ if err != nil {
415+ return err
416+ }
417+
418+ if filepath .IsAbs (* expectedPath ) {
419+ if * expectedPath != actualPath {
420+ return fmt .Errorf ("Cgroup path expected: %v, actual: %v" , * expectedPath , actualPath )
421+ }
422+ } else {
423+ if _ , err := filepath .Rel (* expectedPath , actualPath ); err != nil {
424+ logrus .Warnf ("Cgroup path expected: %v, actual: %v" , * expectedPath , actualPath )
425+ }
426+ }
427+ return nil
428+ }
429+
373430func validate (context * cli.Context ) error {
374431 logLevelString := context .String ("log-level" )
375432 logLevel , err := logrus .ParseLevel (logLevelString )
@@ -387,6 +444,7 @@ func validate(context *cli.Context) error {
387444 validateRootFS ,
388445 validateProcess ,
389446 validateCapabilities ,
447+ validateCgroupsPath ,
390448 validateHostname ,
391449 validateRlimits ,
392450 validateMountsExist ,
0 commit comments