libct/configs/validate: validate mounts

Add a check that mount destination is absolute (as per OCI spec).

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

libcontainer/configs/validate/validator.go

@@ -39,6 +39,7 @@ func (v *ConfigValidator) Validate(config *configs.Config) error {
 		v.sysctl,
 		v.intelrdt,
 		v.rootlessEUID,
+		v.mounts,
 	}
 	for _, c := range checks {
 		if err := c(config); err != nil {
@@ -246,6 +247,16 @@ func (v *ConfigValidator) cgroups(config *configs.Config) error {
 	return nil
 }
 
+func (v *ConfigValidator) mounts(config *configs.Config) error {
+	for _, m := range config.Mounts {
+		if !filepath.IsAbs(m.Destination) {
+			return fmt.Errorf("invalid mount %+v: mount destination not absolute", m)
+		}
+	}
+
+	return nil
+}
+
 func isHostNetNS(path string) (bool, error) {
 	const currentProcessNetns = "/proc/self/ns/net"
 

libcontainer/configs/validate/validator_test.go

@@ -317,3 +317,36 @@ func TestValidateSysctlWithoutNETNamespace(t *testing.T) {
 		t.Error("Expected error to occur but it was nil")
 	}
 }
+
+func TestValidateMounts(t *testing.T) {
+	testCases := []struct {
+		isErr bool
+		dest  string
+	}{
+		{isErr: true, dest: "not/an/abs/path"},
+		{isErr: true, dest: "./rel/path"},
+		{isErr: true, dest: "./rel/path"},
+		{isErr: true, dest: "../../path"},
+		{isErr: false, dest: "/abs/path"},
+		{isErr: false, dest: "/abs/but/../unclean"},
+	}
+
+	validator := validate.New()
+
+	for _, tc := range testCases {
+		config := &configs.Config{
+			Rootfs: "/var",
+			Mounts: []*configs.Mount{
+				{Destination: tc.dest},
+			},
+		}
+
+		err := validator.Validate(config)
+		if tc.isErr && err == nil {
+			t.Errorf("mount dest: %s, expected error, got nil", tc.dest)
+		}
+		if !tc.isErr && err != nil {
+			t.Errorf("mount dest: %s, expected nil, got error %v", tc.dest, err)
+		}
+	}
+}