summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2021-10-28 11:18:48 +0200
committerGiuseppe Scrivano <gscrivan@redhat.com>2021-10-28 11:18:48 +0200
commit960831f9c8ff83f427c296adcef0ed114c434fca (patch)
tree621198a15e4e65bc33ef40646395a33f418b171d
parenta05a445f48877006bccf9cd5399279cdfec7a790 (diff)
downloadpodman-960831f9c8ff83f427c296adcef0ed114c434fca.tar.gz
podman-960831f9c8ff83f427c296adcef0ed114c434fca.tar.bz2
podman-960831f9c8ff83f427c296adcef0ed114c434fca.zip
runtime: change PID existence check
commit 6b3b0a17c625bdf71b0ec8b783b288886d8e48d7 introduced a check for the PID file before attempting to move the PID to a new scope. This is still vulnerable to TOCTOU race condition though, since the PID file or the PID can be removed/killed after the check was successful but before it was used. Closes: https://github.com/containers/podman/issues/12065 [NO NEW TESTS NEEDED] it fixes a CI flake Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
-rw-r--r--libpod/runtime.go4
-rw-r--r--utils/utils.go16
2 files changed, 16 insertions, 4 deletions
diff --git a/libpod/runtime.go b/libpod/runtime.go
index 950ac65eb..b01f8dd13 100644
--- a/libpod/runtime.go
+++ b/libpod/runtime.go
@@ -545,9 +545,7 @@ func makeRuntime(ctx context.Context, runtime *Runtime) (retErr error) {
if became {
// Check if the pause process was created. If it was created, then
// move it to its own systemd scope.
- if _, err = os.Stat(pausePid); err == nil {
- utils.MovePauseProcessToScope(pausePid)
- }
+ utils.MovePauseProcessToScope(pausePid)
os.Exit(ret)
}
}
diff --git a/utils/utils.go b/utils/utils.go
index 55af41bb3..109ae088b 100644
--- a/utils/utils.go
+++ b/utils/utils.go
@@ -14,6 +14,7 @@ import (
"github.com/containers/podman/v3/libpod/define"
"github.com/containers/podman/v3/pkg/cgroups"
"github.com/containers/storage/pkg/archive"
+ "github.com/godbus/dbus/v5"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
)
@@ -177,13 +178,26 @@ func RunsOnSystemd() bool {
func moveProcessToScope(pidPath, slice, scope string) error {
data, err := ioutil.ReadFile(pidPath)
if err != nil {
+ // do not raise an error if the file doesn't exist
+ if os.IsNotExist(err) {
+ return nil
+ }
return errors.Wrapf(err, "cannot read pid file %s", pidPath)
}
pid, err := strconv.ParseUint(string(data), 10, 0)
if err != nil {
return errors.Wrapf(err, "cannot parse pid file %s", pidPath)
}
- return RunUnderSystemdScope(int(pid), slice, scope)
+ err = RunUnderSystemdScope(int(pid), slice, scope)
+
+ // If the PID is not valid anymore, do not return an error.
+ if dbusErr, ok := err.(dbus.Error); ok {
+ if dbusErr.Name == "org.freedesktop.DBus.Error.UnixProcessIdUnknown" {
+ return nil
+ }
+ }
+
+ return err
}
// MovePauseProcessToScope moves the pause process used for rootless mode to keep the namespaces alive to