@@ -63,8 +63,36 @@ func loadSpecConfig() (spec *rspec.Spec, err error) {
6363 return spec , nil
6464}
6565
66- func validateProcess (spec * rspec.Spec ) error {
66+ // should be included by other platform specified process validation
67+ func validateGeneralProcess (spec * rspec.Spec ) error {
68+ if spec .Process .Cwd != "" {
69+ cwd , err := os .Getwd ()
70+ if err != nil {
71+ return err
72+ }
73+ if cwd != spec .Process .Cwd {
74+ return fmt .Errorf ("Cwd expected: %v, actual: %v" , spec .Process .Cwd , cwd )
75+ }
76+ }
77+
78+ for _ , env := range spec .Process .Env {
79+ parts := strings .Split (env , "=" )
80+ key := parts [0 ]
81+ expectedValue := parts [1 ]
82+ actualValue := os .Getenv (key )
83+ if actualValue != expectedValue {
84+ return fmt .Errorf ("Env %v expected: %v, actual: %v" , key , expectedValue , actualValue )
85+ }
86+ }
87+
88+ return nil
89+ }
90+
91+ func validateLinuxProcess (spec * rspec.Spec ) error {
6792 logrus .Debugf ("validating container process" )
93+
94+ validateGeneralProcess (spec )
95+
6896 uid := os .Getuid ()
6997 if uint32 (uid ) != spec .Process .User .UID {
7098 return fmt .Errorf ("UID expected: %v, actual: %v" , spec .Process .User .UID , uid )
@@ -90,16 +118,6 @@ func validateProcess(spec *rspec.Spec) error {
90118 }
91119 }
92120
93- if spec .Process .Cwd != "" {
94- cwd , err := os .Getwd ()
95- if err != nil {
96- return err
97- }
98- if cwd != spec .Process .Cwd {
99- return fmt .Errorf ("Cwd expected: %v, actual: %v" , spec .Process .Cwd , cwd )
100- }
101- }
102-
103121 cmdlineBytes , err := ioutil .ReadFile ("/proc/1/cmdline" )
104122 if err != nil {
105123 return err
@@ -115,16 +133,6 @@ func validateProcess(spec *rspec.Spec) error {
115133 }
116134 }
117135
118- for _ , env := range spec .Process .Env {
119- parts := strings .Split (env , "=" )
120- key := parts [0 ]
121- expectedValue := parts [1 ]
122- actualValue := os .Getenv (key )
123- if actualValue != expectedValue {
124- return fmt .Errorf ("Env %v expected: %v, actual: %v" , key , expectedValue , actualValue )
125- }
126- }
127-
128136 ret , _ , errno := syscall .Syscall6 (syscall .SYS_PRCTL , PR_GET_NO_NEW_PRIVS , 0 , 0 , 0 , 0 , 0 )
129137 if errno != 0 {
130138 return errno
@@ -548,7 +556,6 @@ func validate(context *cli.Context) error {
548556
549557 defaultValidations := []validation {
550558 validateRootFS ,
551- validateProcess ,
552559 validateHostname ,
553560 validateMountsExist ,
554561 }
@@ -558,6 +565,7 @@ func validate(context *cli.Context) error {
558565 validateDefaultFS ,
559566 validateDefaultDevices ,
560567 validateLinuxDevices ,
568+ validateLinuxProcess ,
561569 validateMaskedPaths ,
562570 validateOOMScoreAdj ,
563571 validateROPaths ,
0 commit comments