Affected by GO-2022-0452 and 7 other vulnerabilities

GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

GO-2023-1627: Opencontainers runc Incorrect Authorization vulnerability in github.com/opencontainers/runc

GO-2023-1682: Rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in github.com/opencontainers/runc

GO-2023-1683: AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

GO-2024-2491: Container breakout through process.cwd trickery and leaked fds in github.com/opencontainers/runc

GO-2024-3110: Can be confused to create empty files/directories on the host in github.com/opencontainers/runc

GO-2025-3543: WITHDRAWN: Libcontainer is affected by capabilities elevation in github.com/opencontainers/runc

GO-2025-4098: Container escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc

cgroups

package

v1.0.0 Latest Latest Go to latest Published: Jun 17, 2021 License: Apache-2.0 Imports: 19 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/opencontainers/runc

Links

Documentation ¶

Rendered for

Index ¶

Constants
Variables
func FindCgroupMountpoint(cgroupPath, subsystem string) (string, error)
func FindCgroupMountpointAndRoot(cgroupPath, subsystem string) (string, string, error)
func GetInitCgroup(subsystem string) (string, error)
func GetInitCgroupPath(subsystem string) (string, error)
func GetOwnCgroup(subsystem string) (string, error)
func GetOwnCgroupPath(subsystem string) (string, error)
func IsNotFound(err error) bool
func NewNotFoundError(sub string) error
func OpenFile(dir, file string, flags int) (*os.File, error)
func ReadFile(dir, file string) (string, error)
func WriteFile(dir, file, data string) error
type NotFoundError
- func (e *NotFoundError) Error() string

Constants ¶

View Source

const (
	CgroupNamePrefix = "name="
)

Variables ¶

View Source

var (
	ErrV1NoUnified = errors.New("invalid configuration: cannot use unified on cgroup v1")
)

View Source

var (
	// TestMode is set to true by unit tests that need "fake" cgroupfs.
	TestMode bool
)

Functions ¶

func FindCgroupMountpoint ¶

func FindCgroupMountpoint(cgroupPath, subsystem string) (string, error)

https://www.kernel.org/doc/Documentation/cgroup-v1/cgroups.txt

func FindCgroupMountpointAndRoot ¶

func FindCgroupMountpointAndRoot(cgroupPath, subsystem string) (string, string, error)

func GetInitCgroup ¶

func GetInitCgroup(subsystem string) (string, error)

func GetInitCgroupPath ¶

func GetInitCgroupPath(subsystem string) (string, error)

func GetOwnCgroup ¶

func GetOwnCgroup(subsystem string) (string, error)

GetOwnCgroup returns the relative path to the cgroup docker is running in.

func GetOwnCgroupPath ¶

func GetOwnCgroupPath(subsystem string) (string, error)

func IsNotFound ¶

func IsNotFound(err error) bool

func NewNotFoundError ¶

func NewNotFoundError(sub string) error

func OpenFile ¶

func OpenFile(dir, file string, flags int) (*os.File, error)

OpenFile opens a cgroup file in a given dir with given flags. It is supposed to be used for cgroup files only.

func ReadFile ¶

func ReadFile(dir, file string) (string, error)

ReadFile reads data from a cgroup file in dir. It is supposed to be used for cgroup files only.

func WriteFile ¶

func WriteFile(dir, file, data string) error

WriteFile writes data to a cgroup file in dir. It is supposed to be used for cgroup files only.

Types ¶

type NotFoundError ¶

type NotFoundError struct {
	Subsystem string
}

func (*NotFoundError) Error ¶

func (e *NotFoundError) Error() string

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
devices
ebpf
devicefilter Package devicefilter contains eBPF device filter program The implementation is based on https://github.com/containers/crun/blob/0.10.2/src/libcrun/ebpf.c Although ebpf.c is originally licensed under LGPL-3.0-or-later, the author (Giuseppe Scrivano) agreed to relicense the file in Apache License 2.0: https://github.com/opencontainers/runc/issues/2144#issuecomment-543116397	Package devicefilter contains eBPF device filter program The implementation is based on https://github.com/containers/crun/blob/0.10.2/src/libcrun/ebpf.c Although ebpf.c is originally licensed under LGPL-3.0-or-later, the author (Giuseppe Scrivano) agreed to relicense the file in Apache License 2.0: https://github.com/opencontainers/runc/issues/2144#issuecomment-543116397
fs
fs2
fscommon
systemd

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL