Reject non-empty ContainerPath and CgroupPermissions

TBBle · TBBle · commit b63a0726ab70 · 2022-03-19T15:14:53.000+11:00
Since we don't use their content, it's better to fail than to ignore
them, so that users get useful feedback rather than silent surprises.

Signed-off-by: Paul "TBBle" Hampson &lt;Paul.Hampson@Pobox.com&gt;
diff --git a/daemon/oci_windows.go b/daemon/oci_windows.go
@@ -462,6 +462,14 @@ func setupWindowsDevices(devices []containertypes.DeviceMapping, isHyperV bool)
 	}
 
 	for _, deviceMapping := range devices {
+		if deviceMapping.PathInContainer != "" {
+			return nil, errors.Errorf("device container path: '%s' should be empty", deviceMapping.PathInContainer)
+		}
+
+		if deviceMapping.CgroupPermissions != "" {
+			return nil, errors.Errorf("device cgroup permissions: '%s' must be empty", deviceMapping.CgroupPermissions)
+		}
+
 		srcParts := strings.SplitN(deviceMapping.PathOnHost, "/", 2)
 		if len(srcParts) != 2 {
 			return nil, errors.New("invalid device assignment path")
diff --git a/daemon/oci_windows_test.go b/daemon/oci_windows_test.go
@@ -331,6 +331,20 @@ func TestSetupWindowsDevices(t *testing.T) {
 		assert.Equal(t, len(devices), 0)
 	})
 
+	t.Run("it fails if any devices have PathInContainer and HyperV is disabled", func(t *testing.T) {
+		devices, err := setupWindowsDevices([]containertypes.DeviceMapping{{PathOnHost: "class/anything", PathInContainer: "somepath"}, {PathOnHost: "class/goes"}}, false)
+		assert.ErrorContains(t, err, "device container path")
+		assert.ErrorContains(t, err, "somepath")
+		assert.Equal(t, len(devices), 0)
+	})
+
+	t.Run("it fails if any devices have CgroupPermissions and HyperV is disabled", func(t *testing.T) {
+		devices, err := setupWindowsDevices([]containertypes.DeviceMapping{{PathOnHost: "class/anything", CgroupPermissions: "somepermissions"}, {PathOnHost: "class/goes"}}, false)
+		assert.ErrorContains(t, err, "device cgroup permissions")
+		assert.ErrorContains(t, err, "somepermissions")
+		assert.Equal(t, len(devices), 0)
+	})
+
 	t.Run("it fails if any devices are blank and HyperV is disabled", func(t *testing.T) {
 		devices, err := setupWindowsDevices([]containertypes.DeviceMapping{{PathOnHost: "class/anything"}, {PathOnHost: ""}}, false)
 		assert.ErrorContains(t, err, "invalid device assignment path")
diff --git a/docs/api/version-history.md b/docs/api/version-history.md
@@ -50,6 +50,10 @@ keywords: "API, Docker, rcli, REST, documentation"
   if they are not set.
 * `GET /info` now omits the `KernelMemory` and `KernelMemoryTCP` if they are not
   supported by the host or host's configuration (if cgroups v2 are in use).
+* `POST /containers/create` for Windows containers now rejects non-empty values in
+  `HostConfig.Resources.Devices.PathInContainer` and
+  `HostConfig.Resources.Devices.CgroupPermissions` that were previously silently ignored.
+  This change is not versioned, and affects all API versions if the daemon has this patch.
 
 ## v1.41 API changes
 
