1 /* 2 Copyright The containerd Authors. 3 4 Licensed under the Apache License, Version 2.0 (the "License"); 5 you may not use this file except in compliance with the License. 6 You may obtain a copy of the License at 7 8 http://www.apache.org/licenses/LICENSE-2.0 9 10 Unless required by applicable law or agreed to in writing, software 11 distributed under the License is distributed on an "AS IS" BASIS, 12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 See the License for the specific language governing permissions and 14 limitations under the License. 15 */ 16 17 package v2 18 19 import ( 20 "fmt" 21 "path/filepath" 22 "strings" 23 ) 24 25 // NestedGroupPath will nest the cgroups based on the calling processes cgroup 26 // placing its child processes inside its own path 27 func NestedGroupPath(suffix string) (string, error) { 28 path, err := parseCgroupFile("/proc/self/cgroup") 29 if err != nil { 30 return "", err 31 } 32 return filepath.Join(path, suffix), nil 33 } 34 35 // PidGroupPath will return the correct cgroup paths for an existing process running inside a cgroup 36 // This is commonly used for the Load function to restore an existing container 37 func PidGroupPath(pid int) (string, error) { 38 p := fmt.Sprintf("/proc/%d/cgroup", pid) 39 return parseCgroupFile(p) 40 } 41 42 // VerifyGroupPath verifies the format of group path string g. 43 // The format is same as the third field in /proc/PID/cgroup. 44 // e.g. "/user.slice/user-1001.slice/session-1.scope" 45 // 46 // g must be a "clean" absolute path starts with "/", and must not contain "/sys/fs/cgroup" prefix. 47 // 48 // VerifyGroupPath doesn't verify whether g actually exists on the system. 49 func VerifyGroupPath(g string) error { 50 if !strings.HasPrefix(g, "/") { 51 return ErrInvalidGroupPath 52 } 53 if filepath.Clean(g) != g { 54 return ErrInvalidGroupPath 55 } 56 if strings.HasPrefix(g, "/sys/fs/cgroup") { 57 return ErrInvalidGroupPath 58 } 59 return nil 60 } 61