vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Merge pull request #11882 from hqhq/hq_warn_device_cg

Browse source 
add devices cgroup check as hard requirement
This commit is contained in:
Brian Goff 2015-04-27 18:42:57 -04:00
commit f71e128a11
1 changed files with 12 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
sysinfo/sysinfo.go
View file

@ -23,20 +23,16 @@ func New(quiet bool) *SysInfo {
sysInfo := &SysInfo{} sysInfo := &SysInfo{}
if cgroupMemoryMountpoint, err := cgroups.FindCgroupMountpoint("memory"); err != nil { if cgroupMemoryMountpoint, err := cgroups.FindCgroupMountpoint("memory"); err != nil {
if !quiet { if !quiet {
logrus.Warnf("%v", err) logrus.Warnf("Your kernel does not support cgroup memory limit: %v", err)
} }
} else { } else {
_, err1 := ioutil.ReadFile(path.Join(cgroupMemoryMountpoint, "memory.limit_in_bytes")) // If memory cgroup is mounted, MemoryLimit is always enabled.
_, err2 := ioutil.ReadFile(path.Join(cgroupMemoryMountpoint, "memory.soft_limit_in_bytes")) sysInfo.MemoryLimit = true
sysInfo.MemoryLimit = err1 == nil && err2 == nil
if !sysInfo.MemoryLimit && !quiet {
logrus.Warn("Your kernel does not support cgroup memory limit.")
}
_, err = ioutil.ReadFile(path.Join(cgroupMemoryMountpoint, "memory.memsw.limit_in_bytes")) _, err1 := ioutil.ReadFile(path.Join(cgroupMemoryMountpoint, "memory.memsw.limit_in_bytes"))
sysInfo.SwapLimit = err == nil sysInfo.SwapLimit = err1 == nil
if !sysInfo.SwapLimit && !quiet { if !sysInfo.SwapLimit && !quiet {
logrus.Warn("Your kernel does not support cgroup swap limit.") logrus.Warn("Your kernel does not support swap memory limit.")
} }
} }
@ -58,5 +54,11 @@ func New(quiet bool) *SysInfo {
} else { } else {
sysInfo.AppArmor = true sysInfo.AppArmor = true
} }
// Check if Devices cgroup is mounted, it is hard requirement for container security.
if _, err := cgroups.FindCgroupMountpoint("devices"); err != nil {
logrus.Fatalf("Error mounting devices cgroup: %v", err)
}
return sysInfo return sysInfo
} }