@@ -22,6 +22,15 @@ import (
2222// the kernel
2323const PR_GET_NO_NEW_PRIVS = 39
2424
25+ var (
26+ defaultFS = map [string ]string {
27+ "/proc" : "proc" ,
28+ "/sys" : "sysfs" ,
29+ "dev/pts" : "devpts" ,
30+ "dev/shm" : "tmpfs" ,
31+ }
32+ )
33+
2534type validation func (* rspec.Spec ) error
2635
2736func loadSpecConfig () (spec * rspec.Spec , err error ) {
@@ -229,6 +238,28 @@ func validateRootFS(spec *rspec.Spec) error {
229238 return nil
230239}
231240
241+ func validateDefaultFS (spec * rspec.Spec ) error {
242+ logrus .Debugf ("validating linux default filesystem" )
243+
244+ mountInfos , err := mount .GetMounts ()
245+ if err != nil {
246+ return err
247+ }
248+
249+ mountsMap := make (map [string ]string )
250+ for _ , mountInfo := range mountInfos {
251+ mountsMap [mountInfo .Mountpoint ] = mountInfo .Fstype
252+ }
253+
254+ for fs , fstype := range defaultFS {
255+ if ! (mountsMap [fs ] == fstype ) {
256+ return fmt .Errorf ("%v must exists and expected type is %v" , fs , fstype )
257+ }
258+ }
259+
260+ return nil
261+ }
262+
232263func validateMaskedPaths (spec * rspec.Spec ) error {
233264 logrus .Debugf ("validating maskedPaths" )
234265 for _ , maskedPath := range spec .Linux .MaskedPaths {
@@ -276,6 +307,7 @@ func mountMatch(specMount rspec.Mount, sysMount rspec.Mount) error {
276307
277308func validateMountsExist (spec * rspec.Spec ) error {
278309 logrus .Debugf ("validating mounts exist" )
310+
279311 mountInfos , err := mount .GetMounts ()
280312 if err != nil {
281313 return err
@@ -321,6 +353,7 @@ func validate(context *cli.Context) error {
321353 }
322354
323355 validations := []validation {
356+ validateDefaultFS ,
324357 validateRootFS ,
325358 validateProcess ,
326359 validateCapabilities ,
0 commit comments