From c7ebaeee0e642c55c4780c790f5251c8bb0fbd4c Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Wed, 24 Nov 2021 11:06:38 +0100 Subject: libpod: leave thread locked on errors if the SELinux label could not be restored correctly, leave the OS thread locked so that it is terminated once it returns to the threads pool. [NO NEW TESTS NEEDED] the failure is hard to reproduce Signed-off-by: Giuseppe Scrivano --- libpod/oci_conmon_linux.go | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) (limited to 'libpod') diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go index 3aab6864a..8534c9fdb 100644 --- a/libpod/oci_conmon_linux.go +++ b/libpod/oci_conmon_linux.go @@ -847,10 +847,14 @@ func (r *ConmonOCIRuntime) CheckpointContainer(ctr *Container, options Container err = utils.ExecCmdWithStdStreams(os.Stdin, os.Stdout, os.Stderr, nil, r.path, args...) // Ignore error returned from SetSocketLabel("") call, // can't recover. - if labelErr := label.SetSocketLabel(""); labelErr != nil { + if labelErr := label.SetSocketLabel(""); labelErr == nil { + // Unlock the thread only if the process label could be restored + // successfully. Otherwise leave the thread locked and the Go runtime + // will terminate it once it returns to the threads pool. + runtime.UnlockOSThread() + } else { logrus.Errorf("Unable to reset socket label: %q", labelErr) } - runtime.UnlockOSThread() runtimeCheckpointDuration := func() int64 { if options.PrintStats { @@ -1464,10 +1468,14 @@ func startCommandGivenSelinux(cmd *exec.Cmd, ctr *Container) error { err = cmd.Start() // Ignore error returned from SetProcessLabel("") call, // can't recover. - if labelErr := label.SetProcessLabel(""); labelErr != nil { + if labelErr := label.SetProcessLabel(""); labelErr == nil { + // Unlock the thread only if the process label could be restored + // successfully. Otherwise leave the thread locked and the Go runtime + // will terminate it once it returns to the threads pool. + runtime.UnlockOSThread() + } else { logrus.Errorf("Unable to set process label: %q", labelErr) } - runtime.UnlockOSThread() return err } -- cgit v1.2.3-54-g00ecf