Repository: opencontainers/runc
Pull request #2815 (2021-02-20 08:15:28)

Update README.md for libcontainer
Hi there!

In latest version v1.0.0-rc93 of runc, the following code written in [README.md for libcontainer](https://github.com/opencontainers/runc/blob/master/libcontainer/README.md) is not working, so I updated the README.md

```
config := &configs.Config{
        Rootfs: "/your/path/to/rootfs",
	Capabilities: &configs.Capabilities{
		Bounding: []string{
			"CAP_CHOWN",
			"CAP_DAC_OVERRIDE",
			"CAP_FSETID",
			"CAP_FOWNER",
			"CAP_MKNOD",
			"CAP_NET_RAW",
			"CAP_SETGID",
			"CAP_SETUID",
			"CAP_SETFCAP",
			"CAP_SETPCAP",
			"CAP_NET_BIND_SERVICE",
			"CAP_SYS_CHROOT",
			"CAP_KILL",
			"CAP_AUDIT_WRITE",
		},
	Cgroups: &configs.Cgroup{
		Name:   "test-container",
		Parent: "system",
		Resources: &configs.Resources{
			MemorySwappiness: nil,
			Devices:          specconv.AllowedDevices, // This code is not working(cannot use specconv.AllowedDevices (type []*devices.Device) as type []*devices.Rule in field value)
		},
	},
```


hnts: I squashed the commits!

Patch:
diff --git a/libcontainer/README.md b/libcontainer/README.md
index 8b25d5c1..870e533d 100644
--- a/libcontainer/README.md
+++ b/libcontainer/README.md
@@ -57,6 +57,10 @@ struct describing how the container is to be created. A sample would look simila
 
 ```go
 defaultMountFlags := unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV
+var devices []*configs.DeviceRule
+for _, device := range specconv.AllowedDevices {
+	devices = append(devices, &device.Rule)
+}
 config := &configs.Config{
 	Rootfs: "/your/path/to/rootfs",
 	Capabilities: &configs.Capabilities{
@@ -155,7 +159,7 @@ config := &configs.Config{
 		Parent: "system",
 		Resources: &configs.Resources{
 			MemorySwappiness: nil,
-			Devices:          specconv.AllowedDevices,
+			Devices:          devices,
 		},
 	},
 	MaskPaths: []string{
diff --git a/libcontainer/devices/devices.go b/libcontainer/devices/devices.go
index 11b51dca..5011f373 100644
--- a/libcontainer/devices/devices.go
+++ b/libcontainer/devices/devices.go
@@ -54,7 +54,7 @@ func DeviceFromPath(path, permissions string) (*Device, error) {
 			Permissions: Permissions(permissions),
 		},
 		Path:     path,
-		FileMode: os.FileMode(mode &^ unix.S_IFMT),
+		FileMode: os.FileMode(mode),
 		Uid:      stat.Uid,
 		Gid:      stat.Gid,
 	}, nil
diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
index 6d4042d0..6d646c58 100644
--- a/libcontainer/specconv/spec_linux.go
+++ b/libcontainer/specconv/spec_linux.go
@@ -698,7 +698,7 @@ next:
 				return nil, err
 			}
 			if d.FileMode != nil {
-				filemode = *d.FileMode &^ unix.S_IFMT
+				filemode = *d.FileMode
 			}
 			device := &devices.Device{
 				Rule: devices.Rule{


Test patch:
diff --git a/libcontainer/devices/devices_test.go b/libcontainer/devices/devices_test.go
index 3081bd06..02ebb4b6 100644
--- a/libcontainer/devices/devices_test.go
+++ b/libcontainer/devices/devices_test.go
@@ -82,13 +82,22 @@ func TestHostDevicesAllValid(t *testing.T) {
 		if device.Major == 0 {
 			t.Errorf("device entry %+v has zero major number", device)
 		}
+		// Devices should only have file modes that correspond to their type.
+		var expectedType os.FileMode
 		switch device.Type {
-		case BlockDevice, CharDevice:
+		case BlockDevice:
+			expectedType = unix.S_IFBLK
+		case CharDevice:
+			expectedType = unix.S_IFCHR
 		case FifoDevice:
 			t.Logf("fifo devices shouldn't show up from HostDevices")
 			fallthrough
 		default:
 			t.Errorf("device entry %+v has unexpected type %v", device, device.Type)
 		}
+		gotType := device.FileMode & unix.S_IFMT
+		if expectedType != gotType {
+			t.Errorf("device entry %+v has mismatched types (expected %#x, got %#x)", device, expectedType, gotType)
+		}
 	}
 }