diff --git a/cmd/runtimetest/main.go b/cmd/runtimetest/main.go index ed5889b54..ecf01ffd7 100644 --- a/cmd/runtimetest/main.go +++ b/cmd/runtimetest/main.go @@ -22,6 +22,15 @@ import ( // the kernel const PR_GET_NO_NEW_PRIVS = 39 +var ( + defaultFS = map[string]string{ + "/proc": "proc", + "/sys": "sysfs", + "/dev/pts": "devpts", + "/dev/shm": "tmpfs", + } +) + type validation func(*rspec.Spec) error func loadSpecConfig() (spec *rspec.Spec, err error) { @@ -229,6 +238,28 @@ func validateRootFS(spec *rspec.Spec) error { return nil } +func validateDefaultFS(spec *rspec.Spec) error { + logrus.Debugf("validating linux default filesystem") + + mountInfos, err := mount.GetMounts() + if err != nil { + return err + } + + mountsMap := make(map[string]string) + for _, mountInfo := range mountInfos { + mountsMap[mountInfo.Mountpoint] = mountInfo.Fstype + } + + for fs, fstype := range defaultFS { + if !(mountsMap[fs] == fstype) { + return fmt.Errorf("%v must exist and expected type is %v", fs, fstype) + } + } + + return nil +} + func validateMaskedPaths(spec *rspec.Spec) error { logrus.Debugf("validating maskedPaths") for _, maskedPath := range spec.Linux.MaskedPaths { @@ -276,6 +307,7 @@ func mountMatch(specMount rspec.Mount, sysMount rspec.Mount) error { func validateMountsExist(spec *rspec.Spec) error { logrus.Debugf("validating mounts exist") + mountInfos, err := mount.GetMounts() if err != nil { return err @@ -320,24 +352,36 @@ func validate(context *cli.Context) error { return err } - validations := []validation{ + defaultValidations := []validation{ validateRootFS, validateProcess, validateCapabilities, validateHostname, validateRlimits, + validateMountsExist, + } + + linuxValidations := []validation{ + validateDefaultFS, validateSysctls, validateMaskedPaths, validateROPaths, - validateMountsExist, } - for _, v := range validations { + for _, v := range defaultValidations { if err := v(spec); err != nil { return err } } + if spec.Platform.OS == "linux" { + for _, v := range linuxValidations { + if err := v(spec); err != nil { + return err + } + } + } + return nil }