Skip to content

Commit 1f1e91b

Browse files
committed
libct/specconv: check mount destination is absolute
Per OCI runtime spec, mount destination MUST be absolute. Let's check that and return an error if not. Signed-off-by: Kir Kolyshkin <[email protected]>
1 parent 46e7065 commit 1f1e91b

File tree

1 file changed

+10
-3
lines changed

1 file changed

+10
-3
lines changed

libcontainer/specconv/spec_linux.go

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,11 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) {
238238
}
239239

240240
for _, m := range spec.Mounts {
241-
config.Mounts = append(config.Mounts, createLibcontainerMount(cwd, m))
241+
cm, err := createLibcontainerMount(cwd, m)
242+
if err != nil {
243+
return nil, fmt.Errorf("invalid mount %+v: %w", m, err)
244+
}
245+
config.Mounts = append(config.Mounts, cm)
242246
}
243247

244248
defaultDevs, err := createDevices(spec, config)
@@ -327,7 +331,10 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) {
327331
return config, nil
328332
}
329333

330-
func createLibcontainerMount(cwd string, m specs.Mount) *configs.Mount {
334+
func createLibcontainerMount(cwd string, m specs.Mount) (*configs.Mount, error) {
335+
if !filepath.IsAbs(m.Destination) {
336+
return nil, fmt.Errorf("mount destination %s not absolute", m.Destination)
337+
}
331338
flags, pgflags, data, ext := parseMountOptions(m.Options)
332339
source := m.Source
333340
device := m.Type
@@ -348,7 +355,7 @@ func createLibcontainerMount(cwd string, m specs.Mount) *configs.Mount {
348355
Flags: flags,
349356
PropagationFlags: pgflags,
350357
Extensions: ext,
351-
}
358+
}, nil
352359
}
353360

354361
// systemd property name check: latin letters only, at least 3 of them

0 commit comments

Comments
 (0)