From 69c296739dbe07a34ebbb9af9f16f9aab783c203 Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Wed, 17 Feb 2021 16:23:51 +0100 Subject: [PATCH] cgroups: validate that only a single cgroup mount type is set Signed-off-by: Christian Brauner --- src/lxc/cgroups/cgfsng.c | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/src/lxc/cgroups/cgfsng.c b/src/lxc/cgroups/cgfsng.c index dbf6b9360..275d781b9 100644 --- a/src/lxc/cgroups/cgfsng.c +++ b/src/lxc/cgroups/cgfsng.c @@ -1951,8 +1951,33 @@ __cgfsng_ops static bool cgfsng_mount(struct cgroup_ops *ops, if ((cg_flags & LXC_AUTO_CGROUP_MASK) == 0) return log_trace(true, "No cgroup mounts requested"); - if (cg_flags & LXC_AUTO_CGROUP_FORCE) + if (cg_flags & LXC_AUTO_CGROUP_FORCE) { + cg_flags &= ~LXC_AUTO_CGROUP_FORCE; wants_force_mount = true; + } + + switch (cg_flags) { + case LXC_AUTO_CGROUP_RO: + TRACE("Read-only cgroup mounts requested"); + break; + case LXC_AUTO_CGROUP_RW: + TRACE("Read-write cgroup mounts requested"); + break; + case LXC_AUTO_CGROUP_MIXED: + TRACE("Mixed cgroup mounts requested"); + break; + case LXC_AUTO_CGROUP_FULL_RO: + TRACE("Full read-only cgroup mounts requested"); + break; + case LXC_AUTO_CGROUP_FULL_RW: + TRACE("Full read-write cgroup mounts requested"); + break; + case LXC_AUTO_CGROUP_FULL_MIXED: + TRACE("Full mixed cgroup mounts requested"); + break; + default: + return log_error_errno(false, EINVAL, "Invalid cgroup mount options specified"); + } if (!wants_force_mount) { wants_force_mount = !lxc_wants_cap(CAP_SYS_ADMIN, conf); -- 2.47.2