From a6c5e3824b6b8d3a443e1a14136360cc73779296 Mon Sep 17 00:00:00 2001 From: lujingxiao Date: Sat, 19 Jan 2019 11:17:06 +0800 Subject: [PATCH 015/111] hookspec: add limit of hook spec file reason: add limit of hook spec file, to prevent docker daemon OOM. Change-Id: I11afebf163de3c401ed4f9b8f30c403f1d15de77 Signed-off-by: xiadanni Signed-off-by: lujingxiao --- components/engine/daemon/container.go | 8 ++++++++ components/engine/daemon/daemon_unix.go | 15 ++------------- 2 files changed, 10 insertions(+), 13 deletions(-) diff --git a/components/engine/daemon/container.go b/components/engine/daemon/container.go index 8f9f6baf25..a8cb950f44 100644 --- a/components/engine/daemon/container.go +++ b/components/engine/daemon/container.go @@ -30,6 +30,11 @@ import ( "github.com/pkg/errors" ) +const ( + // hook spec file size limit (in bytes) + hookSpecSizeLimit = (10 * 1024 * 1024) +) + // GetContainer looks for a container using the provided information, which could be // one of the following inputs from the caller: // - A full container ID, which will exact match a container in daemon's list @@ -251,6 +256,9 @@ func (daemon *Daemon) sanitizeHookSpec(spec string) (string, error) { if !fi.Mode().IsRegular() { return "", fmt.Errorf("hook spec file must be a regular text file") } + if fi.Size() > hookSpecSizeLimit { + return "", fmt.Errorf("Hook spec file size must not exceed %d bytes", hookSpecSizeLimit) + } } return spec, nil } diff --git a/components/engine/daemon/daemon_unix.go b/components/engine/daemon/daemon_unix.go index ebf4e067fb..5b390d2db1 100644 --- a/components/engine/daemon/daemon_unix.go +++ b/components/engine/daemon/daemon_unix.go @@ -628,21 +628,10 @@ func (daemon *Daemon) verifyPlatformContainerSettings(hostConfig *containertypes } } - if hostConfig.HookSpec != "" { - hostConfig.HookSpec = filepath.Clean(hostConfig.HookSpec) - if !filepath.IsAbs(hostConfig.HookSpec) { - return warnings, fmt.Errorf("Hook spec file must be an absolute path") - } - fi, err := os.Stat(hostConfig.HookSpec) - if err != nil { - return warnings, fmt.Errorf("stat hook spec file failed: %v", err) - } - if !fi.Mode().IsRegular() { - return warnings, fmt.Errorf("Hook spec file must be a regular text file") - } + if hostConfig.HookSpec, err = daemon.sanitizeHookSpec(hostConfig.HookSpec); err != nil { + return warnings, err } - if hostConfig.Runtime == "" { hostConfig.Runtime = daemon.configStore.GetDefaultRuntimeName() } -- 2.17.1