Repository: opencontainers/runc (go)

Issue:
specconv.CreateLibcontainerConfig doesn't honor spec.Process.NoNewPrivileges
If the passed in `opts` to `CreateLibcontainerConfig` specifies the `NoNewPrivileges` flag under `Process`, it is not honored and the generated config doesn't set the flag appropriately. 

Pull request description:
Honor spec.Process.NoNewPrivileges in specconv.CreateLibcontainerConfig
The change ensures that the passed in value of NoNewPrivileges under spec.Process
is reflected in the container config generated by specconv.CreateLibcontainerConfig

Closes #2397

Signed-off-by: Pradyumna Agrawal <pradyumnaa@vmware.com>

Patch:
diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
index 727fdbd1..f6212b83 100644
--- a/libcontainer/specconv/spec_linux.go
+++ b/libcontainer/specconv/spec_linux.go
@@ -260,6 +260,7 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) {
 	}
 	if spec.Process != nil {
 		config.OomScoreAdj = spec.Process.OOMScoreAdj
+		config.NoNewPrivileges = spec.Process.NoNewPrivileges
 		if spec.Process.SelinuxLabel != "" {
 			config.ProcessLabel = spec.Process.SelinuxLabel
 		}


Test patch:
diff --git a/libcontainer/specconv/spec_linux_test.go b/libcontainer/specconv/spec_linux_test.go
index 9c268865..18bb7c7f 100644
--- a/libcontainer/specconv/spec_linux_test.go
+++ b/libcontainer/specconv/spec_linux_test.go
@@ -391,6 +391,11 @@ func TestSpecconvExampleValidate(t *testing.T) {
 		t.Errorf("Couldn't create libcontainer config: %v", err)
 	}
 
+	if config.NoNewPrivileges != spec.Process.NoNewPrivileges {
+		t.Errorf("specconv NoNewPrivileges mismatch. Expected %v got %v",
+			spec.Process.NoNewPrivileges, config.NoNewPrivileges)
+	}
+
 	validator := validate.New()
 	if err := validator.Validate(config); err != nil {
 		t.Errorf("Expected specconv to produce valid container config: %v", err)