summaryrefslogtreecommitdiff
path: root/vendor/github.com/opencontainers
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2021-06-25 10:02:34 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2021-06-29 15:58:32 -0400
commit05f39af5bd716ce8d02a41e5c0aa1a2d632dab07 (patch)
treee9d2d0c43f3aa65dae28d71950b2824bd091b2be /vendor/github.com/opencontainers
parent793063e086d2a7fe15833be5456af95bc9b6ba24 (diff)
downloadpodman-05f39af5bd716ce8d02a41e5c0aa1a2d632dab07.tar.gz
podman-05f39af5bd716ce8d02a41e5c0aa1a2d632dab07.tar.bz2
podman-05f39af5bd716ce8d02a41e5c0aa1a2d632dab07.zip
Bump github.com/containers/storage from 1.32.3 to 1.32.5
Bumps [github.com/containers/storage](https://github.com/containers/storage) from 1.32.3 to 1.32.5. - [Release notes](https://github.com/containers/storage/releases) - [Changelog](https://github.com/containers/storage/blob/main/docs/containers-storage-changes.md) - [Commits](https://github.com/containers/storage/compare/v1.32.3...v1.32.5) --- updated-dependencies: - dependency-name: github.com/containers/storage dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'vendor/github.com/opencontainers')
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go16
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_linux.go11
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_unsupported.go10
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/cgroups/file.go (renamed from vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/open.go)60
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/fscommon.go51
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/utils.go122
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils.go6
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_linux.go10
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_unsupported.go4
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/configs/config.go10
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/configs/devices.go17
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/configs/mount.go2
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/configs/namespaces_unsupported.go3
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/configs/network.go13
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/devices/device_unix.go11
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/system/linux.go101
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/system/proc.go103
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/system/syscall_linux_32.go26
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/system/syscall_linux_64.go26
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/system/userns_deprecated.go5
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/system/xattrs_linux.go35
-rw-r--r--vendor/github.com/opencontainers/runc/libcontainer/user/user.go24
22 files changed, 118 insertions, 548 deletions
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go b/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go
new file mode 100644
index 000000000..4b03d4c71
--- /dev/null
+++ b/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go
@@ -0,0 +1,16 @@
+package apparmor
+
+import "errors"
+
+var (
+ // IsEnabled returns true if apparmor is enabled for the host.
+ IsEnabled = isEnabled
+
+ // ApplyProfile will apply the profile with the specified name to the process after
+ // the next exec. It is only supported on Linux and produces an ErrApparmorNotEnabled
+ // on other platforms.
+ ApplyProfile = applyProfile
+
+ // ErrApparmorNotEnabled indicates that AppArmor is not enabled or not supported.
+ ErrApparmorNotEnabled = errors.New("apparmor: config provided but apparmor not supported")
+)
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_linux.go
index 5da14fb3b..744d4e570 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_linux.go
@@ -15,8 +15,8 @@ var (
checkAppArmor sync.Once
)
-// IsEnabled returns true if apparmor is enabled for the host.
-func IsEnabled() bool {
+// isEnabled returns true if apparmor is enabled for the host.
+func isEnabled() bool {
checkAppArmor.Do(func() {
if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil {
buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
@@ -57,9 +57,10 @@ func changeOnExec(name string) error {
return nil
}
-// ApplyProfile will apply the profile with the specified name to the process after
-// the next exec.
-func ApplyProfile(name string) error {
+// applyProfile will apply the profile with the specified name to the process after
+// the next exec. It is only supported on Linux and produces an error on other
+// platforms.
+func applyProfile(name string) error {
if name == "" {
return nil
}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_unsupported.go b/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_unsupported.go
index 0bc473f81..1adadafec 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_unsupported.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_unsupported.go
@@ -2,17 +2,11 @@
package apparmor
-import (
- "errors"
-)
-
-var ErrApparmorNotEnabled = errors.New("apparmor: config provided but apparmor not supported")
-
-func IsEnabled() bool {
+func isEnabled() bool {
return false
}
-func ApplyProfile(name string) error {
+func applyProfile(name string) error {
if name != "" {
return ErrApparmorNotEnabled
}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/open.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/file.go
index 49af83b3c..5f6ab9fd6 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/open.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/file.go
@@ -1,6 +1,7 @@
-package fscommon
+package cgroups
import (
+ "bytes"
"os"
"strings"
"sync"
@@ -10,6 +11,54 @@ import (
"golang.org/x/sys/unix"
)
+// OpenFile opens a cgroup file in a given dir with given flags.
+// It is supposed to be used for cgroup files only.
+func OpenFile(dir, file string, flags int) (*os.File, error) {
+ if dir == "" {
+ return nil, errors.Errorf("no directory specified for %s", file)
+ }
+ return openFile(dir, file, flags)
+}
+
+// ReadFile reads data from a cgroup file in dir.
+// It is supposed to be used for cgroup files only.
+func ReadFile(dir, file string) (string, error) {
+ fd, err := OpenFile(dir, file, unix.O_RDONLY)
+ if err != nil {
+ return "", err
+ }
+ defer fd.Close()
+ var buf bytes.Buffer
+
+ _, err = buf.ReadFrom(fd)
+ return buf.String(), err
+}
+
+// WriteFile writes data to a cgroup file in dir.
+// It is supposed to be used for cgroup files only.
+func WriteFile(dir, file, data string) error {
+ fd, err := OpenFile(dir, file, unix.O_WRONLY)
+ if err != nil {
+ return err
+ }
+ defer fd.Close()
+ if err := retryingWriteFile(fd, data); err != nil {
+ return errors.Wrapf(err, "failed to write %q", data)
+ }
+ return nil
+}
+
+func retryingWriteFile(fd *os.File, data string) error {
+ for {
+ _, err := fd.Write([]byte(data))
+ if errors.Is(err, unix.EINTR) {
+ logrus.Infof("interrupted while writing %s to %s", data, fd.Name())
+ continue
+ }
+ return err
+ }
+}
+
const (
cgroupfsDir = "/sys/fs/cgroup"
cgroupfsPrefix = cgroupfsDir + "/"
@@ -28,7 +77,8 @@ var (
func prepareOpenat2() error {
prepOnce.Do(func() {
fd, err := unix.Openat2(-1, cgroupfsDir, &unix.OpenHow{
- Flags: unix.O_DIRECTORY | unix.O_PATH})
+ Flags: unix.O_DIRECTORY | unix.O_PATH,
+ })
if err != nil {
prepErr = &os.PathError{Op: "openat2", Path: cgroupfsDir, Err: err}
if err != unix.ENOSYS {
@@ -52,7 +102,6 @@ func prepareOpenat2() error {
// cgroupv2 has a single mountpoint and no "cpu,cpuacct" symlinks
resolveFlags |= unix.RESOLVE_NO_XDEV | unix.RESOLVE_NO_SYMLINKS
}
-
})
return prepErr
@@ -60,10 +109,7 @@ func prepareOpenat2() error {
// OpenFile opens a cgroup file in a given dir with given flags.
// It is supposed to be used for cgroup files only.
-func OpenFile(dir, file string, flags int) (*os.File, error) {
- if dir == "" {
- return nil, errors.Errorf("no directory specified for %s", file)
- }
+func openFile(dir, file string, flags int) (*os.File, error) {
mode := os.FileMode(0)
if TestMode && flags&os.O_WRONLY != 0 {
// "emulate" cgroup fs for unit tests
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/fscommon.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/fscommon.go
deleted file mode 100644
index ae2613cdb..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/fscommon.go
+++ /dev/null
@@ -1,51 +0,0 @@
-// +build linux
-
-package fscommon
-
-import (
- "bytes"
- "os"
-
- "github.com/pkg/errors"
- "github.com/sirupsen/logrus"
- "golang.org/x/sys/unix"
-)
-
-// WriteFile writes data to a cgroup file in dir.
-// It is supposed to be used for cgroup files only.
-func WriteFile(dir, file, data string) error {
- fd, err := OpenFile(dir, file, unix.O_WRONLY)
- if err != nil {
- return err
- }
- defer fd.Close()
- if err := retryingWriteFile(fd, data); err != nil {
- return errors.Wrapf(err, "failed to write %q", data)
- }
- return nil
-}
-
-// ReadFile reads data from a cgroup file in dir.
-// It is supposed to be used for cgroup files only.
-func ReadFile(dir, file string) (string, error) {
- fd, err := OpenFile(dir, file, unix.O_RDONLY)
- if err != nil {
- return "", err
- }
- defer fd.Close()
- var buf bytes.Buffer
-
- _, err = buf.ReadFrom(fd)
- return buf.String(), err
-}
-
-func retryingWriteFile(fd *os.File, data string) error {
- for {
- _, err := fd.Write([]byte(data))
- if errors.Is(err, unix.EINTR) {
- logrus.Infof("interrupted while writing %s to %s", data, fd.Name())
- continue
- }
- return err
- }
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/utils.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/utils.go
deleted file mode 100644
index db0caded1..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/utils.go
+++ /dev/null
@@ -1,122 +0,0 @@
-// +build linux
-
-package fscommon
-
-import (
- "errors"
- "fmt"
- "math"
- "strconv"
- "strings"
-)
-
-var (
- ErrNotValidFormat = errors.New("line is not a valid key value format")
-)
-
-// ParseUint converts a string to an uint64 integer.
-// Negative values are returned at zero as, due to kernel bugs,
-// some of the memory cgroup stats can be negative.
-func ParseUint(s string, base, bitSize int) (uint64, error) {
- value, err := strconv.ParseUint(s, base, bitSize)
- if err != nil {
- intValue, intErr := strconv.ParseInt(s, base, bitSize)
- // 1. Handle negative values greater than MinInt64 (and)
- // 2. Handle negative values lesser than MinInt64
- if intErr == nil && intValue < 0 {
- return 0, nil
- } else if intErr != nil && intErr.(*strconv.NumError).Err == strconv.ErrRange && intValue < 0 {
- return 0, nil
- }
-
- return value, err
- }
-
- return value, nil
-}
-
-// ParseKeyValue parses a space-separated "name value" kind of cgroup
-// parameter and returns its key as a string, and its value as uint64
-// (ParseUint is used to convert the value). For example,
-// "io_service_bytes 1234" will be returned as "io_service_bytes", 1234.
-func ParseKeyValue(t string) (string, uint64, error) {
- parts := strings.SplitN(t, " ", 3)
- if len(parts) != 2 {
- return "", 0, fmt.Errorf("line %q is not in key value format", t)
- }
-
- value, err := ParseUint(parts[1], 10, 64)
- if err != nil {
- return "", 0, fmt.Errorf("unable to convert to uint64: %v", err)
- }
-
- return parts[0], value, nil
-}
-
-// GetValueByKey reads a key-value pairs from the specified cgroup file,
-// and returns a value of the specified key. ParseUint is used for value
-// conversion.
-func GetValueByKey(path, file, key string) (uint64, error) {
- content, err := ReadFile(path, file)
- if err != nil {
- return 0, err
- }
-
- lines := strings.Split(string(content), "\n")
- for _, line := range lines {
- arr := strings.Split(line, " ")
- if len(arr) == 2 && arr[0] == key {
- return ParseUint(arr[1], 10, 64)
- }
- }
-
- return 0, nil
-}
-
-// GetCgroupParamUint reads a single uint64 value from the specified cgroup file.
-// If the value read is "max", the math.MaxUint64 is returned.
-func GetCgroupParamUint(path, file string) (uint64, error) {
- contents, err := GetCgroupParamString(path, file)
- if err != nil {
- return 0, err
- }
- contents = strings.TrimSpace(contents)
- if contents == "max" {
- return math.MaxUint64, nil
- }
-
- res, err := ParseUint(contents, 10, 64)
- if err != nil {
- return res, fmt.Errorf("unable to parse file %q", path+"/"+file)
- }
- return res, nil
-}
-
-// GetCgroupParamInt reads a single int64 value from specified cgroup file.
-// If the value read is "max", the math.MaxInt64 is returned.
-func GetCgroupParamInt(path, file string) (int64, error) {
- contents, err := ReadFile(path, file)
- if err != nil {
- return 0, err
- }
- contents = strings.TrimSpace(contents)
- if contents == "max" {
- return math.MaxInt64, nil
- }
-
- res, err := strconv.ParseInt(contents, 10, 64)
- if err != nil {
- return res, fmt.Errorf("unable to parse %q as a int from Cgroup file %q", contents, path+"/"+file)
- }
- return res, nil
-}
-
-// GetCgroupParamString reads a string from the specified cgroup file.
-func GetCgroupParamString(path, file string) (string, error) {
- contents, err := ReadFile(path, file)
- if err != nil {
- return "", err
- }
-
- return strings.TrimSpace(contents), nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils.go b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils.go
index 35ce2c1c2..92606525b 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/cgroups/utils.go
@@ -15,7 +15,6 @@ import (
"sync"
"time"
- "github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
"github.com/opencontainers/runc/libcontainer/userns"
"github.com/sirupsen/logrus"
"golang.org/x/sys/unix"
@@ -88,7 +87,7 @@ func GetAllSubsystems() ([]string, error) {
// - freezer: implemented in kernel 5.2
// We assume these are always available, as it is hard to detect availability.
pseudo := []string{"devices", "freezer"}
- data, err := fscommon.ReadFile("/sys/fs/cgroup", "cgroup.controllers")
+ data, err := ReadFile("/sys/fs/cgroup", "cgroup.controllers")
if err != nil {
return nil, err
}
@@ -267,7 +266,6 @@ func RemovePaths(paths map[string]string) (err error) {
case retries - 1:
logrus.WithError(err).Error("Failed to remove cgroup")
}
-
}
_, err := os.Stat(p)
// We need this strange way of checking cgroups existence because
@@ -376,7 +374,7 @@ func WriteCgroupProc(dir string, pid int) error {
return nil
}
- file, err := fscommon.OpenFile(dir, CgroupProcesses, os.O_WRONLY)
+ file, err := OpenFile(dir, CgroupProcesses, os.O_WRONLY)
if err != nil {
return fmt.Errorf("failed to write %v to %v: %v", pid, CgroupProcesses, err)
}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_linux.go
index 87d0da842..a1e7f0afd 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_linux.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_linux.go
@@ -13,12 +13,12 @@ const (
Thawed FreezerState = "THAWED"
)
+// Cgroup holds properties of a cgroup on Linux.
type Cgroup struct {
- // Deprecated, use Path instead
+ // Name specifies the name of the cgroup
Name string `json:"name,omitempty"`
- // name of parent of cgroup or slice
- // Deprecated, use Path instead
+ // Parent specifies the name of parent of cgroup or slice
Parent string `json:"parent,omitempty"`
// Path specifies the path to cgroups that are created and/or joined by the container.
@@ -127,8 +127,8 @@ type Resources struct {
// SkipDevices allows to skip configuring device permissions.
// Used by e.g. kubelet while creating a parent cgroup (kubepods)
- // common for many containers.
+ // common for many containers, and by runc update.
//
// NOTE it is impossible to start a container which has this flag set.
- SkipDevices bool `json:"skip_devices"`
+ SkipDevices bool `json:"-"`
}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_unsupported.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_unsupported.go
index c0c23d700..2a519f582 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_unsupported.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/cgroup_unsupported.go
@@ -2,7 +2,7 @@
package configs
+// Cgroup holds properties of a cgroup on Linux
// TODO Windows: This can ultimately be entirely factored out on Windows as
// cgroups are a Unix-specific construct.
-type Cgroup struct {
-}
+type Cgroup struct{}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/config.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/config.go
index 14a096038..4281593f0 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/config.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/config.go
@@ -208,9 +208,11 @@ type Config struct {
RootlessCgroups bool `json:"rootless_cgroups,omitempty"`
}
-type HookName string
-type HookList []Hook
-type Hooks map[HookName]HookList
+type (
+ HookName string
+ HookList []Hook
+ Hooks map[HookName]HookList
+)
const (
// Prestart commands are executed after the container namespaces are created,
@@ -387,7 +389,7 @@ func (c Command) Run(s *specs.State) error {
case err := <-errC:
return err
case <-timerCh:
- cmd.Process.Kill()
+ _ = cmd.Process.Kill()
<-errC
return fmt.Errorf("hook ran past specified timeout of %.1fs", c.Timeout.Seconds())
}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/devices.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/devices.go
deleted file mode 100644
index b9e3664ce..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/devices.go
+++ /dev/null
@@ -1,17 +0,0 @@
-package configs
-
-import "github.com/opencontainers/runc/libcontainer/devices"
-
-type (
- // Deprecated: use libcontainer/devices.Device
- Device = devices.Device
-
- // Deprecated: use libcontainer/devices.Rule
- DeviceRule = devices.Rule
-
- // Deprecated: use libcontainer/devices.Type
- DeviceType = devices.Type
-
- // Deprecated: use libcontainer/devices.Permissions
- DevicePermissions = devices.Permissions
-)
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/mount.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/mount.go
index 670757ddb..a75ff10ec 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/mount.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/mount.go
@@ -3,7 +3,7 @@ package configs
const (
// EXT_COPYUP is a directive to copy up the contents of a directory when
// a tmpfs is mounted over it.
- EXT_COPYUP = 1 << iota
+ EXT_COPYUP = 1 << iota //nolint:golint // ignore "don't use ALL_CAPS" warning
)
type Mount struct {
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/namespaces_unsupported.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/namespaces_unsupported.go
index 19bf713de..cc76e2f58 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/namespaces_unsupported.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/namespaces_unsupported.go
@@ -4,5 +4,4 @@ package configs
// Namespace defines configuration for each namespace. It specifies an
// alternate path that is able to be joined via setns.
-type Namespace struct {
-}
+type Namespace struct{}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/configs/network.go b/vendor/github.com/opencontainers/runc/libcontainer/configs/network.go
index ccdb228e1..c44c3ea71 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/configs/network.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/configs/network.go
@@ -50,7 +50,10 @@ type Network struct {
HairpinMode bool `json:"hairpin_mode"`
}
-// Routes can be specified to create entries in the route table as the container is started
+// Route defines a routing table entry.
+//
+// Routes can be specified to create entries in the routing table as the container
+// is started.
//
// All of destination, source, and gateway should be either IPv4 or IPv6.
// One of the three options must be present, and omitted entries will use their
@@ -58,15 +61,15 @@ type Network struct {
// gateway to 1.2.3.4 and the interface to eth0 will set up a standard
// destination of 0.0.0.0(or *) when viewed in the route table.
type Route struct {
- // Sets the destination and mask, should be a CIDR. Accepts IPv4 and IPv6
+ // Destination specifies the destination IP address and mask in the CIDR form.
Destination string `json:"destination"`
- // Sets the source and mask, should be a CIDR. Accepts IPv4 and IPv6
+ // Source specifies the source IP address and mask in the CIDR form.
Source string `json:"source"`
- // Sets the gateway. Accepts IPv4 and IPv6
+ // Gateway specifies the gateway IP address.
Gateway string `json:"gateway"`
- // The device to set this route up for, for example: eth0
+ // InterfaceName specifies the device to set this route up for, for example eth0.
InterfaceName string `json:"interface_name"`
}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/devices/device_unix.go b/vendor/github.com/opencontainers/runc/libcontainer/devices/device_unix.go
index acb816998..6d5b3d09d 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/devices/device_unix.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/devices/device_unix.go
@@ -11,10 +11,8 @@ import (
"golang.org/x/sys/unix"
)
-var (
- // ErrNotADevice denotes that a file is not a valid linux device.
- ErrNotADevice = errors.New("not a device node")
-)
+// ErrNotADevice denotes that a file is not a valid linux device.
+var ErrNotADevice = errors.New("not a device node")
// Testing dependencies
var (
@@ -29,8 +27,9 @@ func mkDev(d *Rule) (uint64, error) {
return unix.Mkdev(uint32(d.Major), uint32(d.Minor)), nil
}
-// Given the path to a device and its cgroup_permissions(which cannot be easily queried) look up the
-// information about a linux device and return that information as a Device struct.
+// DeviceFromPath takes the path to a device and its cgroup_permissions (which
+// cannot be easily queried) to look up the information about a linux device
+// and returns that information as a Device struct.
func DeviceFromPath(path, permissions string) (*Device, error) {
var stat unix.Stat_t
err := unixLstat(path, &stat)
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/system/linux.go b/vendor/github.com/opencontainers/runc/libcontainer/system/linux.go
deleted file mode 100644
index 4379a2070..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/system/linux.go
+++ /dev/null
@@ -1,101 +0,0 @@
-// +build linux
-
-package system
-
-import (
- "os/exec"
- "unsafe"
-
- "golang.org/x/sys/unix"
-)
-
-type ParentDeathSignal int
-
-func (p ParentDeathSignal) Restore() error {
- if p == 0 {
- return nil
- }
- current, err := GetParentDeathSignal()
- if err != nil {
- return err
- }
- if p == current {
- return nil
- }
- return p.Set()
-}
-
-func (p ParentDeathSignal) Set() error {
- return SetParentDeathSignal(uintptr(p))
-}
-
-func Execv(cmd string, args []string, env []string) error {
- name, err := exec.LookPath(cmd)
- if err != nil {
- return err
- }
-
- return unix.Exec(name, args, env)
-}
-
-func Prlimit(pid, resource int, limit unix.Rlimit) error {
- _, _, err := unix.RawSyscall6(unix.SYS_PRLIMIT64, uintptr(pid), uintptr(resource), uintptr(unsafe.Pointer(&limit)), uintptr(unsafe.Pointer(&limit)), 0, 0)
- if err != 0 {
- return err
- }
- return nil
-}
-
-func SetParentDeathSignal(sig uintptr) error {
- if err := unix.Prctl(unix.PR_SET_PDEATHSIG, sig, 0, 0, 0); err != nil {
- return err
- }
- return nil
-}
-
-func GetParentDeathSignal() (ParentDeathSignal, error) {
- var sig int
- if err := unix.Prctl(unix.PR_GET_PDEATHSIG, uintptr(unsafe.Pointer(&sig)), 0, 0, 0); err != nil {
- return -1, err
- }
- return ParentDeathSignal(sig), nil
-}
-
-func SetKeepCaps() error {
- if err := unix.Prctl(unix.PR_SET_KEEPCAPS, 1, 0, 0, 0); err != nil {
- return err
- }
-
- return nil
-}
-
-func ClearKeepCaps() error {
- if err := unix.Prctl(unix.PR_SET_KEEPCAPS, 0, 0, 0, 0); err != nil {
- return err
- }
-
- return nil
-}
-
-func Setctty() error {
- if err := unix.IoctlSetInt(0, unix.TIOCSCTTY, 0); err != nil {
- return err
- }
- return nil
-}
-
-// SetSubreaper sets the value i as the subreaper setting for the calling process
-func SetSubreaper(i int) error {
- return unix.Prctl(unix.PR_SET_CHILD_SUBREAPER, uintptr(i), 0, 0, 0)
-}
-
-// GetSubreaper returns the subreaper setting for the calling process
-func GetSubreaper() (int, error) {
- var i uintptr
-
- if err := unix.Prctl(unix.PR_GET_CHILD_SUBREAPER, uintptr(unsafe.Pointer(&i)), 0, 0, 0); err != nil {
- return -1, err
- }
-
- return int(i), nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/system/proc.go b/vendor/github.com/opencontainers/runc/libcontainer/system/proc.go
deleted file mode 100644
index b73cf70b4..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/system/proc.go
+++ /dev/null
@@ -1,103 +0,0 @@
-package system
-
-import (
- "fmt"
- "io/ioutil"
- "path/filepath"
- "strconv"
- "strings"
-)
-
-// State is the status of a process.
-type State rune
-
-const ( // Only values for Linux 3.14 and later are listed here
- Dead State = 'X'
- DiskSleep State = 'D'
- Running State = 'R'
- Sleeping State = 'S'
- Stopped State = 'T'
- TracingStop State = 't'
- Zombie State = 'Z'
-)
-
-// String forms of the state from proc(5)'s documentation for
-// /proc/[pid]/status' "State" field.
-func (s State) String() string {
- switch s {
- case Dead:
- return "dead"
- case DiskSleep:
- return "disk sleep"
- case Running:
- return "running"
- case Sleeping:
- return "sleeping"
- case Stopped:
- return "stopped"
- case TracingStop:
- return "tracing stop"
- case Zombie:
- return "zombie"
- default:
- return fmt.Sprintf("unknown (%c)", s)
- }
-}
-
-// Stat_t represents the information from /proc/[pid]/stat, as
-// described in proc(5) with names based on the /proc/[pid]/status
-// fields.
-type Stat_t struct {
- // PID is the process ID.
- PID uint
-
- // Name is the command run by the process.
- Name string
-
- // State is the state of the process.
- State State
-
- // StartTime is the number of clock ticks after system boot (since
- // Linux 2.6).
- StartTime uint64
-}
-
-// Stat returns a Stat_t instance for the specified process.
-func Stat(pid int) (stat Stat_t, err error) {
- bytes, err := ioutil.ReadFile(filepath.Join("/proc", strconv.Itoa(pid), "stat"))
- if err != nil {
- return stat, err
- }
- return parseStat(string(bytes))
-}
-
-func parseStat(data string) (stat Stat_t, err error) {
- // From proc(5), field 2 could contain space and is inside `(` and `)`.
- // The following is an example:
- // 89653 (gunicorn: maste) S 89630 89653 89653 0 -1 4194560 29689 28896 0 3 146 32 76 19 20 0 1 0 2971844 52965376 3920 18446744073709551615 1 1 0 0 0 0 0 16781312 137447943 0 0 0 17 1 0 0 0 0 0 0 0 0 0 0 0 0 0
- i := strings.LastIndex(data, ")")
- if i <= 2 || i >= len(data)-1 {
- return stat, fmt.Errorf("invalid stat data: %q", data)
- }
-
- parts := strings.SplitN(data[:i], "(", 2)
- if len(parts) != 2 {
- return stat, fmt.Errorf("invalid stat data: %q", data)
- }
-
- stat.Name = parts[1]
- _, err = fmt.Sscanf(parts[0], "%d", &stat.PID)
- if err != nil {
- return stat, err
- }
-
- // parts indexes should be offset by 3 from the field number given
- // proc(5), because parts is zero-indexed and we've removed fields
- // one (PID) and two (Name) in the paren-split.
- parts = strings.Split(data[i+2:], " ")
- var state int
- fmt.Sscanf(parts[3-3], "%c", &state)
- stat.State = State(state)
- fmt.Sscanf(parts[22-3], "%d", &stat.StartTime)
- return stat, nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/system/syscall_linux_32.go b/vendor/github.com/opencontainers/runc/libcontainer/system/syscall_linux_32.go
deleted file mode 100644
index c5ca5d862..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/system/syscall_linux_32.go
+++ /dev/null
@@ -1,26 +0,0 @@
-// +build linux
-// +build 386 arm
-
-package system
-
-import (
- "golang.org/x/sys/unix"
-)
-
-// Setuid sets the uid of the calling thread to the specified uid.
-func Setuid(uid int) (err error) {
- _, _, e1 := unix.RawSyscall(unix.SYS_SETUID32, uintptr(uid), 0, 0)
- if e1 != 0 {
- err = e1
- }
- return
-}
-
-// Setgid sets the gid of the calling thread to the specified gid.
-func Setgid(gid int) (err error) {
- _, _, e1 := unix.RawSyscall(unix.SYS_SETGID32, uintptr(gid), 0, 0)
- if e1 != 0 {
- err = e1
- }
- return
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/system/syscall_linux_64.go b/vendor/github.com/opencontainers/runc/libcontainer/system/syscall_linux_64.go
deleted file mode 100644
index e05e30adc..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/system/syscall_linux_64.go
+++ /dev/null
@@ -1,26 +0,0 @@
-// +build linux
-// +build arm64 amd64 mips mipsle mips64 mips64le ppc ppc64 ppc64le riscv64 s390x
-
-package system
-
-import (
- "golang.org/x/sys/unix"
-)
-
-// Setuid sets the uid of the calling thread to the specified uid.
-func Setuid(uid int) (err error) {
- _, _, e1 := unix.RawSyscall(unix.SYS_SETUID, uintptr(uid), 0, 0)
- if e1 != 0 {
- err = e1
- }
- return
-}
-
-// Setgid sets the gid of the calling thread to the specified gid.
-func Setgid(gid int) (err error) {
- _, _, e1 := unix.RawSyscall(unix.SYS_SETGID, uintptr(gid), 0, 0)
- if e1 != 0 {
- err = e1
- }
- return
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/system/userns_deprecated.go b/vendor/github.com/opencontainers/runc/libcontainer/system/userns_deprecated.go
deleted file mode 100644
index 2de3462a5..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/system/userns_deprecated.go
+++ /dev/null
@@ -1,5 +0,0 @@
-package system
-
-import "github.com/opencontainers/runc/libcontainer/userns"
-
-var RunningInUserNS = userns.RunningInUserNS
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/system/xattrs_linux.go b/vendor/github.com/opencontainers/runc/libcontainer/system/xattrs_linux.go
deleted file mode 100644
index a6823fc99..000000000
--- a/vendor/github.com/opencontainers/runc/libcontainer/system/xattrs_linux.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package system
-
-import "golang.org/x/sys/unix"
-
-// Returns a []byte slice if the xattr is set and nil otherwise
-// Requires path and its attribute as arguments
-func Lgetxattr(path string, attr string) ([]byte, error) {
- var sz int
- // Start with a 128 length byte array
- dest := make([]byte, 128)
- sz, errno := unix.Lgetxattr(path, attr, dest)
-
- switch {
- case errno == unix.ENODATA:
- return nil, errno
- case errno == unix.ENOTSUP:
- return nil, errno
- case errno == unix.ERANGE:
- // 128 byte array might just not be good enough,
- // A dummy buffer is used to get the real size
- // of the xattrs on disk
- sz, errno = unix.Lgetxattr(path, attr, []byte{})
- if errno != nil {
- return nil, errno
- }
- dest = make([]byte, sz)
- sz, errno = unix.Lgetxattr(path, attr, dest)
- if errno != nil {
- return nil, errno
- }
- case errno != nil:
- return nil, errno
- }
- return dest[:sz], nil
-}
diff --git a/vendor/github.com/opencontainers/runc/libcontainer/user/user.go b/vendor/github.com/opencontainers/runc/libcontainer/user/user.go
index 68da4400d..d2c16f7fd 100644
--- a/vendor/github.com/opencontainers/runc/libcontainer/user/user.go
+++ b/vendor/github.com/opencontainers/runc/libcontainer/user/user.go
@@ -11,19 +11,17 @@ import (
)
const (
- minId = 0
- maxId = 1<<31 - 1 //for 32-bit systems compatibility
+ minID = 0
+ maxID = 1<<31 - 1 // for 32-bit systems compatibility
)
var (
- // The current operating system does not provide the required data for user lookups.
- ErrUnsupported = errors.New("user lookup: operating system does not provide passwd-formatted data")
-
- // No matching entries found in file.
+ // ErrNoPasswdEntries is returned if no matching entries were found in /etc/group.
ErrNoPasswdEntries = errors.New("no matching entries in passwd file")
- ErrNoGroupEntries = errors.New("no matching entries in group file")
-
- ErrRange = fmt.Errorf("uids and gids must be in range %d-%d", minId, maxId)
+ // ErrNoGroupEntries is returned if no matching entries were found in /etc/passwd.
+ ErrNoGroupEntries = errors.New("no matching entries in group file")
+ // ErrRange is returned if a UID or GID is outside of the valid range.
+ ErrRange = fmt.Errorf("uids and gids must be in range %d-%d", minID, maxID)
)
type User struct {
@@ -328,7 +326,7 @@ func GetExecUser(userSpec string, defaults *ExecUser, passwd, group io.Reader) (
user.Uid = uidArg
// Must be inside valid uid range.
- if user.Uid < minId || user.Uid > maxId {
+ if user.Uid < minID || user.Uid > maxID {
return nil, ErrRange
}
@@ -377,7 +375,7 @@ func GetExecUser(userSpec string, defaults *ExecUser, passwd, group io.Reader) (
user.Gid = gidArg
// Must be inside valid gid range.
- if user.Gid < minId || user.Gid > maxId {
+ if user.Gid < minID || user.Gid > maxID {
return nil, ErrRange
}
@@ -401,7 +399,7 @@ func GetExecUser(userSpec string, defaults *ExecUser, passwd, group io.Reader) (
// or the given group data is nil, the id will be returned as-is
// provided it is in the legal range.
func GetAdditionalGroups(additionalGroups []string, group io.Reader) ([]int, error) {
- var groups = []Group{}
+ groups := []Group{}
if group != nil {
var err error
groups, err = ParseGroupFilter(group, func(g Group) bool {
@@ -439,7 +437,7 @@ func GetAdditionalGroups(additionalGroups []string, group io.Reader) ([]int, err
return nil, fmt.Errorf("Unable to find group %s", ag)
}
// Ensure gid is inside gid range.
- if gid < minId || gid > maxId {
+ if gid < minID || gid > maxID {
return nil, ErrRange
}
gidMap[int(gid)] = struct{}{}