3 files changed, 87 insertions, 22 deletions

diff --git a/pkg/util/utils.go b/pkg/util/utils.go
index a4df48c88..0c055745d 100644
--- a/pkg/util/utils.go
+++ b/pkg/util/utils.go
@@ -309,15 +309,15 @@ func ParseSignal(rawSignal string) (syscall.Signal, error) {
 	// Strip off leading dash, to allow -1 or -HUP
 	basename := strings.TrimPrefix(rawSignal, "-")
 
-	signal, err := signal.ParseSignal(basename)
+	sig, err := signal.ParseSignal(basename)
 	if err != nil {
 		return -1, err
 	}
 	// 64 is SIGRTMAX; wish we could get this from a standard Go library
-	if signal < 1 || signal > 64 {
+	if sig < 1 || sig > 64 {
 		return -1, errors.Errorf("valid signals are 1 through 64")
 	}
-	return signal, nil
+	return sig, nil
 }
 
 // ParseIDMapping takes idmappings and subuid and subgid maps and returns a storage mapping
@@ -609,3 +609,46 @@ func Tmpdir() string {
 
 	return tmpdir
 }
+
+// ValidateSysctls validates a list of sysctl and returns it.
+func ValidateSysctls(strSlice []string) (map[string]string, error) {
+	sysctl := make(map[string]string)
+	validSysctlMap := map[string]bool{
+		"kernel.msgmax":          true,
+		"kernel.msgmnb":          true,
+		"kernel.msgmni":          true,
+		"kernel.sem":             true,
+		"kernel.shmall":          true,
+		"kernel.shmmax":          true,
+		"kernel.shmmni":          true,
+		"kernel.shm_rmid_forced": true,
+	}
+	validSysctlPrefixes := []string{
+		"net.",
+		"fs.mqueue.",
+	}
+
+	for _, val := range strSlice {
+		foundMatch := false
+		arr := strings.Split(val, "=")
+		if len(arr) < 2 {
+			return nil, errors.Errorf("%s is invalid, sysctl values must be in the form of KEY=VALUE", val)
+		}
+		if validSysctlMap[arr[0]] {
+			sysctl[arr[0]] = arr[1]
+			continue
+		}
+
+		for _, prefix := range validSysctlPrefixes {
+			if strings.HasPrefix(arr[0], prefix) {
+				sysctl[arr[0]] = arr[1]
+				foundMatch = true
+				break
+			}
+		}
+		if !foundMatch {
+			return nil, errors.Errorf("sysctl '%s' is not whitelisted", arr[0])
+		}
+	}
+	return sysctl, nil
+}
diff --git a/pkg/util/utils_linux_test.go b/pkg/util/utils_linux_test.go
new file mode 100644
index 000000000..38e6dbef9
--- /dev/null
+++ b/pkg/util/utils_linux_test.go
@@ -0,0 +1,29 @@
+package util
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetImageConfigStopSignal(t *testing.T) {
+	// Linux-only beause parsing signal names is not supported on non-Linux systems by
+	// pkg/signal.
+	stopSignalValidInt, err := GetImageConfig([]string{"STOPSIGNAL 9"})
+	require.Nil(t, err)
+	assert.Equal(t, stopSignalValidInt.StopSignal, "9")
+
+	stopSignalValidString, err := GetImageConfig([]string{"STOPSIGNAL SIGKILL"})
+	require.Nil(t, err)
+	assert.Equal(t, stopSignalValidString.StopSignal, "9")
+
+	_, err = GetImageConfig([]string{"STOPSIGNAL 0"})
+	assert.NotNil(t, err)
+
+	_, err = GetImageConfig([]string{"STOPSIGNAL garbage"})
+	assert.NotNil(t, err)
+
+	_, err = GetImageConfig([]string{"STOPSIGNAL "})
+	assert.NotNil(t, err)
+}
diff --git a/pkg/util/utils_test.go b/pkg/util/utils_test.go
index f4b03599d..a9b37844e 100644
--- a/pkg/util/utils_test.go
+++ b/pkg/util/utils_test.go
@@ -219,25 +219,6 @@ func TestGetImageConfigLabel(t *testing.T) {
 	assert.NotNil(t, err)
 }
 
-func TestGetImageConfigStopSignal(t *testing.T) {
-	stopSignalValidInt, err := GetImageConfig([]string{"STOPSIGNAL 9"})
-	require.Nil(t, err)
-	assert.Equal(t, stopSignalValidInt.StopSignal, "9")
-
-	stopSignalValidString, err := GetImageConfig([]string{"STOPSIGNAL SIGKILL"})
-	require.Nil(t, err)
-	assert.Equal(t, stopSignalValidString.StopSignal, "9")
-
-	_, err = GetImageConfig([]string{"STOPSIGNAL 0"})
-	assert.NotNil(t, err)
-
-	_, err = GetImageConfig([]string{"STOPSIGNAL garbage"})
-	assert.NotNil(t, err)
-
-	_, err = GetImageConfig([]string{"STOPSIGNAL "})
-	assert.NotNil(t, err)
-}
-
 func TestGetImageConfigOnBuild(t *testing.T) {
 	onBuildOne, err := GetImageConfig([]string{"ONBUILD ADD /testdir1"})
 	require.Nil(t, err)
@@ -264,3 +245,15 @@ func TestGetImageConfigMisc(t *testing.T) {
 	_, err = GetImageConfig([]string{"BADINST testvalue"})
 	assert.NotNil(t, err)
 }
+
+func TestValidateSysctls(t *testing.T) {
+	strSlice := []string{"net.core.test1=4", "kernel.msgmax=2"}
+	result, _ := ValidateSysctls(strSlice)
+	assert.Equal(t, result["net.core.test1"], "4")
+}
+
+func TestValidateSysctlBadSysctl(t *testing.T) {
+	strSlice := []string{"BLAU=BLUE", "GELB^YELLOW"}
+	_, err := ValidateSysctls(strSlice)
+	assert.Error(t, err)
+}