Skip to content

Commit

Permalink
libct: Signal: slight refactor
Browse files Browse the repository at this point in the history
Let's use c.hasInit and c.isPaused where needed instead of
c.curentStatus for simplicity.

Signed-off-by: Kir Kolyshkin <[email protected]>
  • Loading branch information
kolyshkin committed Nov 2, 2023
1 parent fdeb45c commit 055dfab
Showing 1 changed file with 6 additions and 9 deletions.
15 changes: 6 additions & 9 deletions libcontainer/container_linux.go
Original file line number Diff line number Diff line change
Expand Up @@ -364,14 +364,8 @@ func (c *Container) start(process *Process) (retErr error) {
func (c *Container) Signal(s os.Signal) error {
c.m.Lock()
defer c.m.Unlock()
status, err := c.currentStatus()
if err != nil {
return err
}
// To avoid a PID reuse attack, don't kill non-running container.
switch status {
case Running, Created, Paused:
default:
if !c.hasInit() {
return ErrNotRunning
}

Expand All @@ -382,6 +376,7 @@ func (c *Container) Signal(s os.Signal) error {
//
// OTOH, if PID namespace is shared, we should kill all pids to avoid
// leftover processes.
var err error
if s == unix.SIGKILL && !c.config.Namespaces.IsPrivate(configs.NEWPID) {
err = signalAllProcesses(c.cgroupManager, unix.SIGKILL)
} else {
Expand All @@ -390,11 +385,13 @@ func (c *Container) Signal(s os.Signal) error {
if err != nil {
return fmt.Errorf("unable to signal init: %w", err)
}
if status == Paused && s == unix.SIGKILL {
if s == unix.SIGKILL {
// For cgroup v1, killing a process in a frozen cgroup
// does nothing until it's thawed. Only thaw the cgroup
// for SIGKILL.
_ = c.cgroupManager.Freeze(configs.Thawed)
if paused, _ := c.isPaused(); paused {
_ = c.cgroupManager.Freeze(configs.Thawed)
}
}
return nil
}
Expand Down

0 comments on commit 055dfab

Please sign in to comment.