diff --git a/pkg/util/utils.go b/pkg/util/utils.go index 83f4ec3ba7..e2e373efa5 100644 --- a/pkg/util/utils.go +++ b/pkg/util/utils.go @@ -21,6 +21,7 @@ import ( ruser "github.com/moby/sys/user" "github.com/opencontainers/runtime-spec/specs-go" "github.com/sirupsen/logrus" + "go.podman.io/common/pkg/sysctl" "go.podman.io/image/v5/types" "go.podman.io/podman/v6/libpod/define" "go.podman.io/podman/v6/pkg/namespaces" @@ -1088,51 +1089,7 @@ func Tmpdir() string { // ValidateSysctls validates a list of sysctl and returns it. func ValidateSysctls(strSlice []string) (map[string]string, error) { - sysctl := make(map[string]string) - validSysctlMap := map[string]bool{ - "kernel.msgmax": true, - "kernel.msgmnb": true, - "kernel.msgmni": true, - "kernel.sem": true, - "kernel.shmall": true, - "kernel.shmmax": true, - "kernel.shmmni": true, - "kernel.shm_rmid_forced": true, - } - validSysctlPrefixes := []string{ - "net.", - "fs.mqueue.", - } - - for _, val := range strSlice { - foundMatch := false - arr := strings.Split(val, "=") - if len(arr) < 2 { - return nil, fmt.Errorf("%s is invalid, sysctl values must be in the form of KEY=VALUE", val) - } - - trimmed := fmt.Sprintf("%s=%s", strings.TrimSpace(arr[0]), strings.TrimSpace(arr[1])) - if trimmed != val { - return nil, fmt.Errorf("'%s' is invalid, extra spaces found", val) - } - - if validSysctlMap[arr[0]] { - sysctl[arr[0]] = arr[1] - continue - } - - for _, prefix := range validSysctlPrefixes { - if strings.HasPrefix(arr[0], prefix) { - sysctl[arr[0]] = arr[1] - foundMatch = true - break - } - } - if !foundMatch { - return nil, fmt.Errorf("sysctl '%s' is not allowed", arr[0]) - } - } - return sysctl, nil + return sysctl.Validate(strSlice) } func CreateIDFile(path string, id string) error { diff --git a/pkg/util/utils_test.go b/pkg/util/utils_test.go index 3f15cfe870..c943d9aa2e 100644 --- a/pkg/util/utils_test.go +++ b/pkg/util/utils_test.go @@ -500,7 +500,7 @@ func TestValidateSysctlBadSysctl(t *testing.T) { } func TestValidateSysctlBadSysctlWithExtraSpaces(t *testing.T) { - expectedError := "'%s' is invalid, extra spaces found" + expectedError := "%q is invalid, extra spaces found" // should fail fast on first sysctl strSlice1 := []string{ diff --git a/vendor/go.podman.io/common/pkg/sysctl/sysctl.go b/vendor/go.podman.io/common/pkg/sysctl/sysctl.go new file mode 100644 index 0000000000..0df4c90e69 --- /dev/null +++ b/vendor/go.podman.io/common/pkg/sysctl/sysctl.go @@ -0,0 +1,55 @@ +package sysctl + +import ( + "fmt" + "strings" +) + +// Validate validates a list of sysctl and returns it. +func Validate(strSlice []string) (map[string]string, error) { + sysctl := make(map[string]string) + validSysctlMap := map[string]bool{ + "kernel.msgmax": true, + "kernel.msgmnb": true, + "kernel.msgmni": true, + "kernel.sem": true, + "kernel.shmall": true, + "kernel.shmmax": true, + "kernel.shmmni": true, + "kernel.shm_rmid_forced": true, + } + validSysctlPrefixes := []string{ + "net.", + "fs.mqueue.", + } + + for _, val := range strSlice { + foundMatch := false + arr := strings.Split(val, "=") + if len(arr) < 2 { + return nil, fmt.Errorf("%s is invalid, sysctl values must be in the form of KEY=VALUE", val) + } + + trimmed := fmt.Sprintf("%s=%s", strings.TrimSpace(arr[0]), strings.TrimSpace(arr[1])) + if trimmed != val { + return nil, fmt.Errorf("%q is invalid, extra spaces found", val) + } + + if validSysctlMap[arr[0]] { + sysctl[arr[0]] = arr[1] + continue + } + + for _, prefix := range validSysctlPrefixes { + if strings.HasPrefix(arr[0], prefix) { + sysctl[arr[0]] = arr[1] + foundMatch = true + break + } + } + if !foundMatch { + return nil, fmt.Errorf("sysctl %q is not allowed", arr[0]) + } + } + return sysctl, nil +} diff --git a/vendor/modules.txt b/vendor/modules.txt index ff516ec83a..2e965e5068 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -834,6 +834,7 @@ go.podman.io/common/pkg/ssh go.podman.io/common/pkg/strongunits go.podman.io/common/pkg/subscriptions go.podman.io/common/pkg/supplemented +go.podman.io/common/pkg/sysctl go.podman.io/common/pkg/sysinfo go.podman.io/common/pkg/systemd go.podman.io/common/pkg/timetype