1 files changed, 25 insertions, 7 deletions
diff --git a/pkg/spec/parse.go b/pkg/spec/parse.go
index 6fa0b0636..38d93b87f 100644
--- a/pkg/spec/parse.go
+++ b/pkg/spec/parse.go
@@ -2,24 +2,29 @@ package createconfig
 
 import (
 	"fmt"
+	"regexp"
 	"strconv"
 	"strings"
 
 	"github.com/docker/go-units"
+	"github.com/pkg/errors"
 )
 
+// deviceCgroupRulegex defines the valid format of device-cgroup-rule
+var deviceCgroupRuleRegex = regexp.MustCompile(`^([acb]) ([0-9]+|\*):([0-9]+|\*) ([rwm]{1,3})$`)
+
 // Pod signifies a kernel namespace is being shared
 // by a container with the pod it is associated with
 const Pod = "pod"
 
 // weightDevice is a structure that holds device:weight pair
 type weightDevice struct {
-	path   string
-	weight uint16
+	Path   string
+	Weight uint16
 }
 
 func (w *weightDevice) String() string {
-	return fmt.Sprintf("%s:%d", w.path, w.weight)
+	return fmt.Sprintf("%s:%d", w.Path, w.Weight)
 }
 
 // LinuxNS is a struct that contains namespace information
@@ -54,9 +59,9 @@ func NS(s string) string {
 	return ""
 }
 
-// validateweightDevice validates that the specified string has a valid device-weight format
+// ValidateweightDevice validates that the specified string has a valid device-weight format
 // for blkio-weight-device flag
-func validateweightDevice(val string) (*weightDevice, error) {
+func ValidateweightDevice(val string) (*weightDevice, error) {
 	split := strings.SplitN(val, ":", 2)
 	if len(split) != 2 {
 		return nil, fmt.Errorf("bad format: %s", val)
@@ -73,8 +78,8 @@ func validateweightDevice(val string) (*weightDevice, error) {
 	}
 
 	return &weightDevice{
-		path:   split[0],
-		weight: uint16(weight),
+		Path:   split[0],
+		Weight: uint16(weight),
 	}, nil
 }
 
@@ -205,3 +210,16 @@ func IsValidDeviceMode(mode string) bool {
 	}
 	return true
 }
+
+// validateDeviceCgroupRule validates the format of deviceCgroupRule
+func validateDeviceCgroupRule(deviceCgroupRule string) error {
+	if !deviceCgroupRuleRegex.MatchString(deviceCgroupRule) {
+		return errors.Errorf("invalid device cgroup rule format: '%s'", deviceCgroupRule)
+	}
+	return nil
+}
+
+// parseDeviceCgroupRule matches and parses the deviceCgroupRule into slice
+func parseDeviceCgroupRule(deviceCgroupRule string) [][]string {
+	return deviceCgroupRuleRegex.FindAllStringSubmatch(deviceCgroupRule, -1)
+}