func (v *Validator) CheckLinuxResources() (errs error) {
	logrus.Debugf("check linux resources")
	r := v.spec.Linux.Resources
	if r.Memory != nil {
		if r.Memory.Limit != nil && r.Memory.Swap != nil && uint64(*r.Memory.Limit) > uint64(*r.Memory.Swap) {
			errs = multierror.Append(errs, fmt.Errorf("minimum memoryswap should be larger than memory limit"))
		}
		if r.Memory.Limit != nil && r.Memory.Reservation != nil && uint64(*r.Memory.Reservation) > uint64(*r.Memory.Limit) {
			errs = multierror.Append(errs, fmt.Errorf("minimum memory limit should be larger than memory reservation"))
		}
	}
	if r.Network != nil && v.HostSpecific {
		var exist bool
		interfaces, err := net.Interfaces()
		if err != nil {
			errs = multierror.Append(errs, err)
			return
		}
		for _, prio := range r.Network.Priorities {
			exist = false
			for _, ni := range interfaces {
				if prio.Name == ni.Name {
					exist = true
					break
				}
			}
			if !exist {
				errs = multierror.Append(errs, fmt.Errorf("interface %s does not exist currently", prio.Name))
			}
		}
	}
	for index := 0; index < len(r.Devices); index++ {
		switch r.Devices[index].Type {
		case "a", "b", "c", "":
		default:
			errs = multierror.Append(errs, fmt.Errorf("type of devices %s is invalid", r.Devices[index].Type))
		}
		access := []byte(r.Devices[index].Access)
		for i := 0; i < len(access); i++ {
			switch access[i] {
			case 'r', 'w', 'm':
			default:
				errs = multierror.Append(errs, fmt.Errorf("access %s is invalid", r.Devices[index].Access))
				return
			}
		}
	}
	if r.BlockIO != nil && r.BlockIO.WeightDevice != nil {
		for i, weightDevice := range r.BlockIO.WeightDevice {
			if weightDevice.Weight == nil && weightDevice.LeafWeight == nil {
				errs = multierror.Append(errs,
					specerror.NewError(
						specerror.BlkIOWeightOrLeafWeightExist,
						fmt.Errorf("linux.resources.blockIO.weightDevice[%d] specifies neither weight nor leafWeight", i),
						rspec.Version))
			}
		}
	}
	return
}
CheckLinuxResources checks v.spec.Linux.Resources
package validate
import (
	"bufio"
	"encoding/json"
	"errors"
	"fmt"
	"io/ioutil"
	"net"
	"os"
	"path/filepath"
	"reflect"
	"regexp"
	"runtime"
	"strings"
	"unicode"
	"unicode/utf8"
	"github.com/blang/semver"
	"github.com/hashicorp/go-multierror"
	rspec "github.com/opencontainers/runtime-spec/specs-go"
	osFilepath "github.com/opencontainers/runtime-tools/filepath"
	"github.com/sirupsen/logrus"
	"github.com/syndtr/gocapability/capability"
	"github.com/opencontainers/runtime-tools/specerror"
	"github.com/xeipuuv/gojsonschema"
)
const specConfig = "config.json"
var (
	posixRlimits = []string{
		"RLIMIT_AS",
		"RLIMIT_CORE",
		"RLIMIT_CPU",
		"RLIMIT_DATA",
		"RLIMIT_FSIZE",
		"RLIMIT_NOFILE",
		"RLIMIT_STACK",
	}
	linuxRlimits = append(posixRlimits, []string{
		"RLIMIT_MEMLOCK",
		"RLIMIT_MSGQUEUE",
		"RLIMIT_NICE",
		"RLIMIT_NPROC",
		"RLIMIT_RSS",
		"RLIMIT_RTPRIO",
		"RLIMIT_RTTIME",
		"RLIMIT_SIGPENDING",
	}...)
	configSchemaTemplate = "https://raw.githubusercontent.com/opencontainers/runtime-spec/v%s/schema/config-schema.json"
)
type Validator struct {
	spec         *rspec.Spec
	bundlePath   string
	HostSpecific bool
	platform     string
}
func NewValidator(spec *rspec.Spec, bundlePath string, hostSpecific bool, platform string) (Validator, error) {
	if hostSpecific && platform != runtime.GOOS {
		return Validator{}, fmt.Errorf("When hostSpecific is set, platform must be same as the host platform")
	}
	return Validator{
		spec:         spec,
		bundlePath:   bundlePath,
		HostSpecific: hostSpecific,
		platform:     platform,
	}, nil
}
func NewValidatorFromPath(bundlePath string, hostSpecific bool, platform string) (Validator, error) {
	if bundlePath == "" {
		return Validator{}, fmt.Errorf("bundle path shouldn't be empty")
	}
	if _, err := os.Stat(bundlePath); err != nil {
		return Validator{}, err
	}
	configPath := filepath.Join(bundlePath, specConfig)
	content, err := ioutil.ReadFile(configPath)
	if err != nil {
		return Validator{}, specerror.NewError(specerror.ConfigInRootBundleDir, err, rspec.Version)
	}
	if !utf8.Valid(content) {
		return Validator{}, fmt.Errorf("%q is not encoded in UTF-8", configPath)
	}
	var spec rspec.Spec
	if err = json.Unmarshal(content, &spec); err != nil {
		return Validator{}, err
	}
	return NewValidator(&spec, bundlePath, hostSpecific, platform)
}
func (v *Validator) CheckAll() error {
	var errs *multierror.Error
	errs = multierror.Append(errs, v.CheckJSONSchema())
	errs = multierror.Append(errs, v.CheckPlatform())
	errs = multierror.Append(errs, v.CheckRoot())
	errs = multierror.Append(errs, v.CheckMandatoryFields())
	errs = multierror.Append(errs, v.CheckSemVer())
	errs = multierror.Append(errs, v.CheckMounts())
	errs = multierror.Append(errs, v.CheckProcess())
	errs = multierror.Append(errs, v.CheckLinux())
	errs = multierror.Append(errs, v.CheckAnnotations())
	if v.platform == "linux" || v.platform == "solaris" {
		errs = multierror.Append(errs, v.CheckHooks())
	}
	return errs.ErrorOrNil()
}
func JSONSchemaURL(version string) (url string, err error) {
	ver, err := semver.Parse(version)
	if err != nil {
		return "", specerror.NewError(specerror.SpecVersionInSemVer, err, rspec.Version)
	}
	configRenamedToConfigSchemaVersion, err := semver.Parse("1.0.0-rc2")  
	if ver.Compare(configRenamedToConfigSchemaVersion) == -1 {
		return "", fmt.Errorf("unsupported configuration version (older than %s)", configRenamedToConfigSchemaVersion)
	}
	return fmt.Sprintf(configSchemaTemplate, version), nil
}
func (v *Validator) CheckJSONSchema() (errs error) {
	logrus.Debugf("check JSON schema")
	url, err := JSONSchemaURL(v.spec.Version)
	if err != nil {
		errs = multierror.Append(errs, err)
		return errs
	}
	schemaLoader := gojsonschema.NewReferenceLoader(url)
	documentLoader := gojsonschema.NewGoLoader(v.spec)
	result, err := gojsonschema.Validate(schemaLoader, documentLoader)
	if err != nil {
		errs = multierror.Append(errs, err)
		return errs
	}
	if !result.Valid() {
		for _, resultError := range result.Errors() {
			errs = multierror.Append(errs, errors.New(resultError.String()))
		}
	}
	return errs
}
func (v *Validator) CheckRoot() (errs error) {
	logrus.Debugf("check root")
	if v.platform == "windows" && v.spec.Windows != nil {
		if v.spec.Windows.HyperV != nil {
			if v.spec.Root != nil {
				errs = multierror.Append(errs,
					specerror.NewError(specerror.RootOnHyperVNotSet, fmt.Errorf("for Hyper-V containers, Root must not be set"), rspec.Version))
			}
			return
		} else if v.spec.Root == nil {
			errs = multierror.Append(errs,
				specerror.NewError(specerror.RootOnWindowsRequired, fmt.Errorf("on Windows, for Windows Server Containers, this field is REQUIRED"), rspec.Version))
			return
		}
	} else if v.platform != "windows" && v.spec.Root == nil {
		errs = multierror.Append(errs,
			specerror.NewError(specerror.RootOnNonWindowsRequired, fmt.Errorf("on all other platforms, this field is REQUIRED"), rspec.Version))
		return
	}
	if v.platform == "windows" {
		matched, err := regexp.MatchString(`\\\\[?]\\Volume[{][a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}[}]\\`, v.spec.Root.Path)
		if err != nil {
			errs = multierror.Append(errs, err)
		} else if !matched {
			errs = multierror.Append(errs,
				specerror.NewError(specerror.RootPathOnWindowsGUID, fmt.Errorf("root.path is %q, but it MUST be a volume GUID path when target platform is windows", v.spec.Root.Path), rspec.Version))
		}
		if v.spec.Root.Readonly {
			errs = multierror.Append(errs,
				specerror.NewError(specerror.RootReadonlyOnWindowsFalse, fmt.Errorf("root.readonly field MUST be omitted or false when target platform is windows"), rspec.Version))
		}
		return
	}
	absBundlePath, err := filepath.Abs(v.bundlePath)
	if err != nil {
		errs = multierror.Append(errs, fmt.Errorf("unable to convert %q to an absolute path", v.bundlePath))
		return
	}
	if filepath.Base(v.spec.Root.Path) != "rootfs" {
		errs = multierror.Append(errs,
			specerror.NewError(specerror.RootPathOnPosixConvention, fmt.Errorf("path name should be the conventional 'rootfs'"), rspec.Version))
	}
	var rootfsPath string
	var absRootPath string
	if filepath.IsAbs(v.spec.Root.Path) {
		rootfsPath = v.spec.Root.Path
		absRootPath = filepath.Clean(rootfsPath)
	} else {
		var err error
		rootfsPath = filepath.Join(v.bundlePath, v.spec.Root.Path)
		absRootPath, err = filepath.Abs(rootfsPath)
		if err != nil {
			errs = multierror.Append(errs, fmt.Errorf("unable to convert %q to an absolute path", rootfsPath))
			return
		}
	}
	if fi, err := os.Stat(rootfsPath); err != nil {
		errs = multierror.Append(errs,
			specerror.NewError(specerror.RootPathExist, fmt.Errorf("cannot find the root path %q", rootfsPath), rspec.Version))
	} else if !fi.IsDir() {
		errs = multierror.Append(errs,
			specerror.NewError(specerror.RootPathExist, fmt.Errorf("root.path %q is not a directory", rootfsPath), rspec.Version))
	}
	rootParent := filepath.Dir(absRootPath)
	if absRootPath == string(filepath.Separator) || rootParent != absBundlePath {
		errs = multierror.Append(errs,
			specerror.NewError(specerror.ArtifactsInSingleDir, fmt.Errorf("root.path is %q, but it MUST be a child of %q", v.spec.Root.Path, absBundlePath), rspec.Version))
	}
	return
}
func (v *Validator) CheckSemVer() (errs error) {
	logrus.Debugf("check semver")
	version := v.spec.Version
	_, err := semver.Parse(version)
	if err != nil {
		errs = multierror.Append(errs,
			specerror.NewError(specerror.SpecVersionInSemVer, fmt.Errorf("%q is not valid SemVer: %s", version, err.Error()), rspec.Version))
	}
	if version != rspec.Version {
		errs = multierror.Append(errs, fmt.Errorf("validate currently only handles version %s, but the supplied configuration targets %s", rspec.Version, version))
	}
	return
}
func (v *Validator) CheckHooks() (errs error) {
	logrus.Debugf("check hooks")
	if v.platform != "linux" && v.platform != "solaris" {
		errs = multierror.Append(errs, fmt.Errorf("For %q platform, the configuration structure does not support hooks", v.platform))
		return
	}
	if v.spec.Hooks != nil {
		errs = multierror.Append(errs, v.checkEventHooks("prestart", v.spec.Hooks.Prestart, v.HostSpecific))
		errs = multierror.Append(errs, v.checkEventHooks("poststart", v.spec.Hooks.Poststart, v.HostSpecific))
		errs = multierror.Append(errs, v.checkEventHooks("poststop", v.spec.Hooks.Poststop, v.HostSpecific))
	}
	return
}
func (v *Validator) checkEventHooks(hookType string, hooks []rspec.Hook, hostSpecific bool) (errs error) {
	for i, hook := range hooks {
		if !osFilepath.IsAbs(v.platform, hook.Path) {
			errs = multierror.Append(errs,
				specerror.NewError(
					specerror.PosixHooksPathAbs,
					fmt.Errorf("hooks.%s[%d].path %v: is not absolute path",
						hookType, i, hook.Path),
					rspec.Version))
		}
		if hostSpecific {
			fi, err := os.Stat(hook.Path)
			if err != nil {
				errs = multierror.Append(errs, fmt.Errorf("cannot find %s hook: %v", hookType, hook.Path))
			}
			if fi.Mode()&0111 == 0 {
				errs = multierror.Append(errs, fmt.Errorf("the %s hook %v: is not executable", hookType, hook.Path))
			}
		}
		for _, env := range hook.Env {
			if !envValid(env) {
				errs = multierror.Append(errs, fmt.Errorf("env %q for hook %v is in the invalid form", env, hook.Path))
			}
		}
	}
	return
}
func (v *Validator) CheckProcess() (errs error) {
	logrus.Debugf("check process")
	if v.spec.Process == nil {
		return
	}
	process := v.spec.Process
	if !osFilepath.IsAbs(v.platform, process.Cwd) {
		errs = multierror.Append(errs,
			specerror.NewError(
				specerror.ProcCwdAbs,
				fmt.Errorf("cwd %q is not an absolute path", process.Cwd),
				rspec.Version))
	}
	for _, env := range process.Env {
		if !envValid(env) {
			errs = multierror.Append(errs, fmt.Errorf("env %q should be in the form of 'key=value'. The left hand side must consist solely of letters, digits, and underscores '_'", env))
		}
	}
	if len(process.Args) == 0 {
		errs = multierror.Append(errs,
			specerror.NewError(
				specerror.ProcArgsOneEntryRequired,
				fmt.Errorf("args must not be empty"),
				rspec.Version))
	} else {
		if filepath.IsAbs(process.Args[0]) && v.spec.Root != nil {
			var rootfsPath string
			if filepath.IsAbs(v.spec.Root.Path) {
				rootfsPath = v.spec.Root.Path
			} else {
				rootfsPath = filepath.Join(v.bundlePath, v.spec.Root.Path)
			}
			absPath := filepath.Join(rootfsPath, process.Args[0])
			fileinfo, err := os.Stat(absPath)
			if os.IsNotExist(err) {
				logrus.Warnf("executable %q is not available in rootfs currently", process.Args[0])
			} else if err != nil {
				errs = multierror.Append(errs, err)
			} else {
				m := fileinfo.Mode()
				if m.IsDir() || m&0111 == 0 {
					errs = multierror.Append(errs, fmt.Errorf("arg %q is not executable", process.Args[0]))
				}
			}
		}
	}
	if v.platform == "linux" || v.platform == "solaris" {
		errs = multierror.Append(errs, v.CheckRlimits())
	}
	if v.platform == "linux" {
		if v.spec.Process.Capabilities != nil {
			errs = multierror.Append(errs, v.CheckCapabilities())
		}
		if len(process.ApparmorProfile) > 0 {
			profilePath := filepath.Join(v.bundlePath, v.spec.Root.Path, "/etc/apparmor.d", process.ApparmorProfile)
			_, err := os.Stat(profilePath)
			if err != nil {
				errs = multierror.Append(errs, err)
			}
		}
	}
	return
}
func (v *Validator) CheckCapabilities() (errs error) {
	if v.platform != "linux" {
		errs = multierror.Append(errs, fmt.Errorf("For %q platform, the configuration structure does not support process.capabilities", v.platform))
		return
	}
	process := v.spec.Process
	var effective, permitted, inheritable, ambient bool
	caps := make(map[string][]string)
	for _, cap := range process.Capabilities.Bounding {
		caps[cap] = append(caps[cap], "bounding")
	}
	for _, cap := range process.Capabilities.Effective {
		caps[cap] = append(caps[cap], "effective")
	}
	for _, cap := range process.Capabilities.Inheritable {
		caps[cap] = append(caps[cap], "inheritable")
	}
	for _, cap := range process.Capabilities.Permitted {
		caps[cap] = append(caps[cap], "permitted")
	}
	for _, cap := range process.Capabilities.Ambient {
		caps[cap] = append(caps[cap], "ambient")
	}
	for capability, owns := range caps {
		if err := CapValid(capability, v.HostSpecific); err != nil {
			errs = multierror.Append(errs, fmt.Errorf("capability %q is not valid, man capabilities(7)", capability))
		}
		effective, permitted, ambient, inheritable = false, false, false, false
		for _, set := range owns {
			if set == "effective" {
				effective = true
				continue
			}
			if set == "inheritable" {
				inheritable = true
				continue
			}
			if set == "permitted" {
				permitted = true
				continue
			}
			if set == "ambient" {
				ambient = true
				continue
			}
		}
		if effective && !permitted {
			errs = multierror.Append(errs, fmt.Errorf("effective capability %q is not allowed, as it's not permitted", capability))
		}
		if ambient && !(permitted && inheritable) {
			errs = multierror.Append(errs, fmt.Errorf("ambient capability %q is not allowed, as it's not permitted and inheribate", capability))
		}
	}
	return
}
func (v *Validator) CheckRlimits() (errs error) {
	if v.platform != "linux" && v.platform != "solaris" {
		errs = multierror.Append(errs, fmt.Errorf("For %q platform, the configuration structure does not support process.rlimits", v.platform))
		return
	}
	process := v.spec.Process
	for index, rlimit := range process.Rlimits {
		for i := index + 1; i < len(process.Rlimits); i++ {
			if process.Rlimits[index].Type == process.Rlimits[i].Type {
				errs = multierror.Append(errs,
					specerror.NewError(
						specerror.PosixProcRlimitsErrorOnDup,
						fmt.Errorf("rlimit can not contain the same type %q",
							process.Rlimits[index].Type),
						rspec.Version))
			}
		}
		errs = multierror.Append(errs, v.rlimitValid(rlimit))
	}
	return
}
func supportedMountTypes(OS string, hostSpecific bool) (map[string]bool, error) {
	supportedTypes := make(map[string]bool)
	if OS != "linux" && OS != "windows" {
		logrus.Warnf("%v is not supported to check mount type", OS)
		return nil, nil
	} else if OS == "windows" {
		supportedTypes["ntfs"] = true
		return supportedTypes, nil
	}
	if hostSpecific {
		f, err := os.Open("/proc/filesystems")
		if err != nil {
			return nil, err
		}
		defer f.Close()
		s := bufio.NewScanner(f)
		for s.Scan() {
			if err := s.Err(); err != nil {
				return supportedTypes, err
			}
			text := s.Text()
			parts := strings.Split(text, "\t")
			if len(parts) > 1 {
				supportedTypes[parts[1]] = true
			} else {
				supportedTypes[parts[0]] = true
			}
		}
		supportedTypes["bind"] = true
		return supportedTypes, nil
	}
	logrus.Warn("Checking linux mount types without --host-specific is not supported yet")
	return nil, nil
}
func (v *Validator) CheckMounts() (errs error) {
	logrus.Debugf("check mounts")
	supportedTypes, err := supportedMountTypes(v.platform, v.HostSpecific)
	if err != nil {
		errs = multierror.Append(errs, err)
		return
	}
	for i, mountA := range v.spec.Mounts {
		if supportedTypes != nil && !supportedTypes[mountA.Type] {
			errs = multierror.Append(errs, fmt.Errorf("unsupported mount type %q", mountA.Type))
		}
		if !osFilepath.IsAbs(v.platform, mountA.Destination) {
			errs = multierror.Append(errs,
				specerror.NewError(
					specerror.MountsDestAbs,
					fmt.Errorf("mounts[%d].destination %q is not absolute",
						i,
						mountA.Destination),
					rspec.Version))
		}
		for j, mountB := range v.spec.Mounts {
			if i == j {
				continue
			}
			nested, err := osFilepath.IsAncestor(v.platform, mountA.Destination, mountB.Destination, ".")
			if err != nil {
				errs = multierror.Append(errs, err)
				continue
			}
			if nested {
				if v.platform == "windows" && i < j {
					errs = multierror.Append(errs,
						specerror.NewError(
							specerror.MountsDestOnWindowsNotNested,
							fmt.Errorf("on Windows, %v nested within %v is forbidden",
								mountB.Destination, mountA.Destination),
							rspec.Version))
				}
				if i > j {
					logrus.Warnf("%v will be covered by %v", mountB.Destination, mountA.Destination)
				}
			}
		}
	}
	return
}
func (v *Validator) CheckPlatform() (errs error) {
	logrus.Debugf("check platform")
	if v.platform != "linux" && v.platform != "solaris" && v.platform != "windows" {
		errs = multierror.Append(errs, fmt.Errorf("platform %q is not supported", v.platform))
		return
	}
	if v.HostSpecific && v.platform != runtime.GOOS {
		errs = multierror.Append(errs, fmt.Errorf("platform %q differs from the host %q, skipping host-specific checks", v.platform, runtime.GOOS))
		v.HostSpecific = false
	}
	if v.platform == "windows" {
		if v.spec.Windows == nil {
			errs = multierror.Append(errs,
				specerror.NewError(
					specerror.PlatformSpecConfOnWindowsSet,
					fmt.Errorf("'windows' MUST be set when platform is `windows`"),
					rspec.Version))
		}
	}
	return
}