Merge pull request #2391 from cyphar/devices-cgroup

cgroup: devices: major cleanups and minimal transition rules
opencontainers · May 14, 2020 · 3f1e886 · 3f1e886
2 parents 85d4264 + ba6eb28
commit 3f1e886
Show file tree

Hide file tree

Showing 29 changed files with 2,460 additions and 572 deletions.
diff --git a/contrib/cmd/recvtty/recvtty.go b/contrib/cmd/recvtty/recvtty.go
@@ -65,7 +65,7 @@ func bail(err error) {
 	os.Exit(1)
 }
 
-func handleSingle(path string) error {
+func handleSingle(path string, noStdin bool) error {
 	// Open a socket.
 	ln, err := net.Listen("unix", path)
 	if err != nil {
@@ -113,10 +113,12 @@ func handleSingle(path string) error {
 		io.Copy(os.Stdout, c)
 		quitChan <- struct{}{}
 	}()
-	go func() {
-		io.Copy(c, os.Stdin)
-		quitChan <- struct{}{}
-	}()
+	if !noStdin {
+		go func() {
+			io.Copy(c, os.Stdin)
+			quitChan <- struct{}{}
+		}()
+	}
 
 	// Only close the master fd once we've stopped copying.
 	<-quitChan
@@ -201,6 +203,10 @@ func main() {
 			Value: "",
 			Usage: "Path to write daemon process ID to",
 		},
+		cli.BoolFlag{
+			Name:  "no-stdin",
+			Usage: "Disable stdin handling (no-op for null mode)",
+		},
 	}
 
 	app.Action = func(ctx *cli.Context) error {
@@ -218,9 +224,10 @@ func main() {
 			}
 		}
 
+		noStdin := ctx.Bool("no-stdin")
 		switch ctx.String("mode") {
 		case "single":
-			if err := handleSingle(path); err != nil {
+			if err := handleSingle(path, noStdin); err != nil {
 				return err
 			}
 		case "null":

diff --git a/libcontainer/README.md b/libcontainer/README.md
@@ -155,8 +155,7 @@ config := &configs.Config{
 		Parent: "system",
 		Resources: &configs.Resources{
 			MemorySwappiness: nil,
-			AllowAllDevices:  nil,
-			AllowedDevices:   configs.DefaultAllowedDevices,
+			Devices:          specconv.AllowedDevices,
 		},
 	},
 	MaskPaths: []string{
@@ -166,7 +165,7 @@ config := &configs.Config{
 	ReadonlyPaths: []string{
 		"/proc/sys", "/proc/sysrq-trigger", "/proc/irq", "/proc/bus",
 	},
-	Devices:  configs.DefaultAutoCreatedDevices,
+	Devices:  specconv.AllowedDevices,
 	Hostname: "testing",
 	Mounts: []*configs.Mount{
 		{

diff --git a/libcontainer/cgroups/cgroups.go b/libcontainer/cgroups/cgroups.go
@@ -44,6 +44,9 @@ type Manager interface {
 
 	// GetCgroups returns the cgroup data as configured.
 	GetCgroups() (*configs.Cgroup, error)
+
+	// GetFreezerState retrieves the current FreezerState of the cgroup.
+	GetFreezerState() (configs.FreezerState, error)
 }
 
 type NotFoundError struct {