From dbb7cce39ab106a8544a0393364c348657bc9505 Mon Sep 17 00:00:00 2001
From: Nayana Bidari <nybidari@google.com>
Date: Tue, 5 Nov 2024 09:48:42 -0800
Subject: [PATCH] Validate capabilities during restore.

PiperOrigin-RevId: 693383280
---
 runsc/boot/restore.go             | 28 +++++++++++++++++++++++++++-
 runsc/container/container_test.go |  7 +++++++
 2 files changed, 34 insertions(+), 1 deletion(-)

diff --git a/runsc/boot/restore.go b/runsc/boot/restore.go
index a67d55981..5397cfd0b 100644
--- a/runsc/boot/restore.go
+++ b/runsc/boot/restore.go
@@ -314,6 +314,29 @@ func validateArray[T any](field, cName string, oldArr, newArr []T) error {
 	return nil
 }
 
+func sortCapabilities(o *specs.LinuxCapabilities) {
+	sort.Strings(o.Bounding)
+	sort.Strings(o.Effective)
+	sort.Strings(o.Inheritable)
+	sort.Strings(o.Permitted)
+	sort.Strings(o.Ambient)
+}
+
+func validateCapabilities(field, cName string, oldCaps, newCaps *specs.LinuxCapabilities) error {
+	if oldCaps == nil && newCaps == nil {
+		return nil
+	}
+	if oldCaps == nil || newCaps == nil {
+		return validateError(field, cName, oldCaps, newCaps)
+	}
+	sortCapabilities(oldCaps)
+	sortCapabilities(newCaps)
+	if !reflect.DeepEqual(oldCaps, newCaps) {
+		return validateError(field, cName, oldCaps, newCaps)
+	}
+	return nil
+}
+
 func validateStruct(field, cName string, oldS, newS any) error {
 	if !reflect.DeepEqual(oldS, newS) {
 		return validateError(field, cName, oldS, newS)
@@ -355,6 +378,9 @@ func validateSpecForContainer(oldSpec, newSpec *specs.Spec, cName string) error
 	if ok := slices.Equal(oldProcess.Args, newProcess.Args); !ok {
 		return validateError("Args", cName, oldProcess.Args, newProcess.Args)
 	}
+	if err := validateCapabilities("Capabilities", cName, oldProcess.Capabilities, newProcess.Capabilities); err != nil {
+		return err
+	}
 
 	// Validate specs.Linux.
 	validateStructMap["Sysctl"] = [2]any{oldLinux.Sysctl, newLinux.Sysctl}
@@ -382,7 +408,7 @@ func validateSpecForContainer(oldSpec, newSpec *specs.Spec, cName string) error
 		return err
 	}
 
-	// TODO(b/359591006): Validate Linux.Resources and Process.Capabilities.
+	// TODO(b/359591006): Validate Linux.Resources.
 	// TODO(b/359591006): Check other remaining fields for equality.
 	return nil
 }
diff --git a/runsc/container/container_test.go b/runsc/container/container_test.go
index 966a96ba0..26383bcd3 100644
--- a/runsc/container/container_test.go
+++ b/runsc/container/container_test.go
@@ -3792,6 +3792,13 @@ func TestSpecValidation(t *testing.T) {
 			},
 			wantErr: "",
 		},
+		{
+			name: "Capabilities",
+			mutate: func(spec, restoreSpec *specs.Spec, _, _ string) {
+				restoreSpec.Process.Capabilities.Bounding = append(restoreSpec.Process.Capabilities.Bounding, "CAP_NET_RAW")
+			},
+			wantErr: "Capabilities does not match across checkpoint restore",
+		},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {