Repository: opencontainers/runc
File: libcontainer/intelrdt/intelrdt.go (Go)

Code before:
func IsMBAEnabled() bool {
	featuresInit()
	return mbaEnabled
}

// Apply applies Intel RDT configuration to the process with the specified pid.
func (m *Manager) Apply(pid int) (err error) {
	// If intelRdt is not specified in config, we do nothing
	if m.config.IntelRdt == nil {
		return nil
	}

	path := m.GetPath()

	m.mu.Lock()
	defer m.mu.Unlock()

	if m.config.IntelRdt.ClosID != "" && m.config.IntelRdt.L3CacheSchema == "" && m.config.IntelRdt.MemBwSchema == "" {
		// Check that the CLOS exists, i.e. it has been pre-configured to
		// conform with the runtime spec
		if _, err := os.Stat(path); err != nil {
			return fmt.Errorf("clos dir not accessible (must be pre-created when l3CacheSchema and memBwSchema are empty): %w", err)
		}
	}

	if err := os.Mkdir(path, 0o755); err != nil && !os.IsExist(err) {
		return newLastCmdError(err)
	}

	if err := WriteIntelRdtTasks(path, pid); err != nil {
		return newLastCmdError(err)
	}

	// Create MON group
	if monPath := m.GetMonPath(); monPath != "" {
		if err := os.Mkdir(monPath, 0o755); err != nil && !os.IsExist(err) {
			return newLastCmdError(err)
		}
		if err := WriteIntelRdtTasks(monPath, pid); err != nil {
			return newLastCmdError(err)
		}
	}

	m.path = path
	return nil
}

// Destroy destroys the Intel RDT container-specific container_id group.
func (m *Manager) Destroy() error {
	// Don't remove resctrl group if closid has been explicitly specified. The
	// group is likely externally managed, i.e. by some other entity than us.

Review comment (suggestion):
Who has control of this path? In runc this is trusted, okay, but is it exposed in k8s or containerd or some other to the user?

Not sure with the https://github.com/intel/k8s-rdt-controller what is exposed to an end user

Code after:
	}

	path := m.GetPath()

	m.mu.Lock()
	defer m.mu.Unlock()

	if m.config.IntelRdt.ClosID != "" && m.config.IntelRdt.L3CacheSchema == "" && m.config.IntelRdt.MemBwSchema == "" && len(m.config.IntelRdt.Schemata) == 0 {
		// Check that the CLOS exists, i.e. it has been pre-configured to
		// conform with the runtime spec
		if _, err := os.Stat(path); err != nil {
			return fmt.Errorf("clos dir not accessible (must be pre-created when schemata, l3CacheSchema and memBwSchema are empty): %w", err)
		}
	}

	if err := os.Mkdir(path, 0o755); err != nil && !os.IsExist(err) {
		return newLastCmdError(err)
	}

	if err := WriteIntelRdtTasks(path, pid); err != nil {
		return newLastCmdError(err)
	}

	// Create MON group
	if monPath := m.GetMonPath(); monPath != "" {
		if err := os.Mkdir(monPath, 0o755); err != nil && !os.IsExist(err) {
			return newLastCmdError(err)
		}
		if err := WriteIntelRdtTasks(monPath, pid); err != nil {
			return newLastCmdError(err)
		}
	}

	m.path = path
	return nil
}

// Destroy destroys the Intel RDT container-specific container_id group.
func (m *Manager) Destroy() error {
	if m.config.IntelRdt == nil {
		return nil
	}
	// Don't remove resctrl group if closid has been explicitly specified. The
	// group is likely externally managed, i.e. by some other entity than us.
	// There are probably other containers/tasks sharing the same group.
	if m.config.IntelRdt.ClosID == "" {
		m.mu.Lock()
		defer m.mu.Unlock()
		if err := os.Remove(m.GetPath()); err != nil && !os.IsNotExist(err) {
			return err
		}