Files
moby/internal/platform/platform_linux_test.go
Cesar Talledo a3fef5debc Mask Linux thermal interrupt info in /proc and /sys.
On Linux, mask "/proc/interrupts" and "/sys/devices/system/cpu/cpu<x>/thermal_throttle"
inside containers by default. Privileged containers or containers started
with --security-opt="systempaths=unconfined" are not affected.

Mitigates potential Thermal Side-Channel Vulnerability Exploit
(https://github.com/moby/moby/security/advisories/GHSA-6fw5-f8r9-fgfm).

Also: improve integration test TestCreateWithCustomMaskedPaths() to ensure
default masked paths don't apply to privileged containers.

Signed-off-by: Cesar Talledo <cesar.talledo@docker.com>
2025-03-10 17:18:10 -07:00

55 lines
974 B
Go

package platform
import (
"testing"
"gotest.tools/v3/assert"
is "gotest.tools/v3/assert/cmp"
)
func TestParsePossibleCPUs(t *testing.T) {
tests := []struct {
name string
input string
expected []int
}{
{
name: "Continuous Range",
input: "0-3",
expected: []int{0, 1, 2, 3},
},
{
name: "Non-Continuous Range",
input: "0-2,4,6-7",
expected: []int{0, 1, 2, 4, 6, 7},
},
{
name: "Single CPU",
input: "5",
expected: []int{5},
},
{
name: "Empty Input",
input: "",
expected: nil,
},
{
name: "Invalid Range",
input: "0-2,invalid",
expected: nil,
},
{
name: "Malformed Range",
input: "0-2-3",
expected: nil,
},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
result := parsePossibleCPUs(test.input)
assert.Assert(t, is.DeepEqual(result, test.expected), "Expected %v but got %v", test.expected, result)
})
}
}