libcontainer/notify_linux_v2: use fscommon.ReadFile
This is to benefit from openat2() implementation, on kernels
that support it. Theoretically this also improves security.
package libcontainer
import (
- "io/ioutil"
"path/filepath"
"strconv"
"strings"
"unsafe"
+ "github.com/opencontainers/runc/libcontainer/cgroups/fscommon"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"golang.org/x/sys/unix"
)
-func getValueFromCgroup(path, key string) (int, error) {
- content, err := ioutil.ReadFile(path)
+func getValueFromCgroup(path, file, key string) (int, error) {
+ content, err := fscommon.ReadFile(path, file)
if err != nil {
return 0, err
}
@@ -31,20 +31,18 @@ func getValueFromCgroup(path, key string) (int, error) {
}
func registerMemoryEventV2(cgDir, evName, cgEvName string) (<-chan struct{}, error) {
- eventControlPath := filepath.Join(cgDir, evName)
- cgEvPath := filepath.Join(cgDir, cgEvName)
fd, err := unix.InotifyInit()
if err != nil {
return nil, errors.Wrap(err, "unable to init inotify")
}
// watching oom kill
- evFd, err := unix.InotifyAddWatch(fd, eventControlPath, unix.IN_MODIFY)
+ evFd, err := unix.InotifyAddWatch(fd, filepath.Join(cgDir, evName), unix.IN_MODIFY)
if err != nil {
unix.Close(fd)
return nil, errors.Wrap(err, "unable to add inotify watch")
}
// Because no `unix.IN_DELETE|unix.IN_DELETE_SELF` event for cgroup file system, so watching all process exited
- cgFd, err := unix.InotifyAddWatch(fd, cgEvPath, unix.IN_MODIFY)
+ cgFd, err := unix.InotifyAddWatch(fd, filepath.Join(cgDir, cgEvName), unix.IN_MODIFY)
if err != nil {
unix.Close(fd)
return nil, errors.Wrap(err, "unable to add inotify watch")
@@ -79,12 +77,12 @@ func registerMemoryEventV2(cgDir, evName, cgEvName string) (<-chan struct{}, err
}
switch int(rawEvent.Wd) {
case evFd:
- oom, err := getValueFromCgroup(eventControlPath, "oom_kill")
+ oom, err := getValueFromCgroup(cgDir, evName, "oom_kill")
if err != nil || oom > 0 {
ch <- struct{}{}
}
case cgFd:
- pids, err := getValueFromCgroup(cgEvPath, "populated")
+ pids, err := getValueFromCgroup(cgDir, cgEvName, "populated")
if err != nil || pids == 0 {
return
}
