mirror of
https://github.com/moby/moby.git
synced 2026-08-09 17:39:58 +00:00
1640d7b986
This fixes a panic when an invalid "device cgroup rule" is passed, resulting in an "index out of range". This bug was introduced in the original implementation in1756af6faf, but was not reproducible when using the CLI, because the same commit also added client-side validation on the flag before making an API request. The following example, uses an invalid rule (`c *:* rwm` - two spaces before the permissions); ```console $ docker run --rm --network=host --device-cgroup-rule='c *:* rwm' busybox invalid argument "c *:* rwm" for "--device-cgroup-rule" flag: invalid device cgroup format 'c *:* rwm' ``` Doing the same, but using the API results in a daemon panic when starting the container; Create a container with an invalid device cgroup rule: ```console curl -v \ --unix-socket /var/run/docker.sock \ "http://localhost/v1.41/containers/create?name=foobar" \ -H "Content-Type: application/json" \ -d '{"Image":"busybox:latest", "HostConfig":{"DeviceCgroupRules": ["c *:* rwm"]}}' ``` Start the container: ```console curl -v \ --unix-socket /var/run/docker.sock \ -X POST \ "http://localhost/v1.41/containers/foobar/start" ``` Observe the daemon logs: ``` 2021-01-22 12:53:03.313806 I | http: panic serving @: runtime error: index out of range [0] with length 0 goroutine 571 [running]: net/http.(*conn).serve.func1(0xc000cb2d20) /usr/local/go/src/net/http/server.go:1795 +0x13b panic(0x2f32380, 0xc000aebfc0) /usr/local/go/src/runtime/panic.go:679 +0x1b6 github.com/docker/docker/oci.AppendDevicePermissionsFromCgroupRules(0xc000175c00, 0x8, 0x8, 0xc0000bd380, 0x1, 0x4, 0x0, 0x0, 0xc0000e69c0, 0x0, ...) /go/src/github.com/docker/docker/oci/oci.go:34 +0x64f ``` This patch: - fixes the panic, allowing the daemon to return an error on container start - adds a unit-test to validate various permutations - adds a "todo" to verify the regular expression (and handling) of the "a" (all) value We should also consider performing this validation when _creating_ the container, so that an error is produced early. Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit5cc1753f2c) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>