netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Do not validate Spec.Root.Path during restore.

Browse Source 
Spec.Root.Path can change during restore, so we cannot compare the entire
Root struct.

PiperOrigin-RevId: 694215758
This commit is contained in:
Ayush Ranjan
2024-11-07 12:48:45 -08:00
committed by gVisor bot
parent 379108ca91
commit c80684f5d9
1 changed files with 20 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/boot/restore.go
+20 -11
View File
@@ -393,20 +393,26 @@ func ifNil[T any](v *T) *T {
}
func validateSpecForContainer(oldSpec, newSpec *specs.Spec, cName string) error {
oldLinux, newLinux := ifNil(oldSpec.Linux), ifNil(newSpec.Linux)
oldProcess, newProcess := ifNil(oldSpec.Process), ifNil(newSpec.Process)
oldRoot, newRoot := ifNil(oldSpec.Root), ifNil(newSpec.Root)
validateStructMap := make(map[string][2]any)
// Validate OCI version.
if oldSpec.Version != newSpec.Version {
return validateError("OCI Version", cName, oldSpec.Version, newSpec.Version)
}
validateStructMap := make(map[string][2]any)
validateStructMap["Root"] = [2]any{oldRoot, newRoot}
// Validate specs.Spec.Root. Note that Root.Path can change during restore.
oldRoot, newRoot := ifNil(oldSpec.Root), ifNil(newSpec.Root)
if oldRoot.Readonly != newRoot.Readonly {
return validateError("Root.Readonly", cName, oldRoot.Readonly, newRoot.Readonly)
}
// Validate specs.Spec.Mounts.
if err := validateMounts("Mounts", cName, oldSpec.Mounts, newSpec.Mounts); err != nil {
return err
}
// Validate specs.Process.
// Validate specs.Spec.Process.
oldProcess, newProcess := ifNil(oldSpec.Process), ifNil(newSpec.Process)
if oldProcess.Terminal != newProcess.Terminal {
return validateError("Terminal", cName, oldProcess.Terminal, newProcess.Terminal)
}
@@ -422,7 +428,8 @@ func validateSpecForContainer(oldSpec, newSpec *specs.Spec, cName string) error
return err
}
// Validate specs.Linux.
// Validate specs.Spec.Linux.
oldLinux, newLinux := ifNil(oldSpec.Linux), ifNil(newSpec.Linux)
validateStructMap["Sysctl"] = [2]any{oldLinux.Sysctl, newLinux.Sysctl}
validateStructMap["Seccomp"] = [2]any{oldLinux.Seccomp, newLinux.Seccomp}
if err := validateDevices("Devices", cName, oldLinux.Devices, newLinux.Devices); err != nil {
@@ -441,16 +448,18 @@ func validateSpecForContainer(oldSpec, newSpec *specs.Spec, cName string) error
return err
}
// Validate specs.Spec.Annotations.
if err := validateAnnotations(cName, oldSpec.Annotations, newSpec.Annotations); err != nil {
return err
}
// Validate all the structs collected in validateStructMap above.
for key, val := range validateStructMap {
if err := validateStruct(key, cName, val[0], val[1]); err != nil {
return err
}
}
if err := validateAnnotations(cName, oldSpec.Annotations, newSpec.Annotations); err != nil {
return err
}
// TODO(b/359591006): Check other remaining fields for equality.
return nil
}