@@ -11,6 +11,7 @@ import (
1111 "syscall"
1212
1313 "github.com/Sirupsen/logrus"
14+ "github.com/docker/docker/pkg/mount"
1415 rspec "github.com/opencontainers/runtime-spec/specs-go"
1516 "github.com/syndtr/gocapability/capability"
1617)
@@ -215,6 +216,61 @@ func validateRootFS(spec *rspec.Spec) error {
215216 return nil
216217}
217218
219+ func mountMatch (specMount rspec.Mount , sysMount rspec.Mount ) error {
220+ if specMount .Destination != sysMount .Destination {
221+ return fmt .Errorf ("mount destination expected: %v, actual: %v" , specMount .Destination , sysMount .Destination )
222+ }
223+
224+ if specMount .Type != sysMount .Type {
225+ return fmt .Errorf ("mount %v type expected: %v, actual: %v" , specMount .Destination , specMount .Type , sysMount .Type )
226+ }
227+
228+ if specMount .Source != sysMount .Source {
229+ return fmt .Errorf ("mount %v source expected: %v, actual: %v" , specMount .Destination , specMount .Source , sysMount .Source )
230+ }
231+
232+ optMap := make (map [string ]bool )
233+ for _ , opt := range sysMount .Options {
234+ optMap [opt ] = true
235+ }
236+ for _ , option := range specMount .Options {
237+ if _ , ok := optMap [option ]; ! ok {
238+ return fmt .Errorf ("mount %v option %v does not exist" , specMount .Destination , option )
239+ }
240+ }
241+
242+ return nil
243+ }
244+
245+ func validateMounts (spec * rspec.Spec ) error {
246+ fmt .Println ("validating mounts" )
247+ infos , err := mount .GetMounts ()
248+ if err != nil {
249+ return err
250+ }
251+
252+ mountsMap := make (map [string ]rspec.Mount )
253+ for _ , info := range infos {
254+ mountsMap [info .Mountpoint ] = rspec.Mount {
255+ Destination : info .Mountpoint ,
256+ Type : info .Fstype ,
257+ Source : info .Source ,
258+ Options : append (strings .Split (info .Opts , "," ), strings .Split (info .VfsOpts , "," )... )}
259+ }
260+
261+ for _ , specMount := range spec .Mounts {
262+ if sysMount , ok := mountsMap [specMount .Destination ]; ok {
263+ if err := mountMatch (specMount , sysMount ); err != nil {
264+ return err
265+ }
266+ } else {
267+ return fmt .Errorf ("Expected mount %v does not exist" , specMount .Destination )
268+ }
269+ }
270+
271+ return nil
272+ }
273+
218274func main () {
219275 spec , err := loadSpecConfig ()
220276 if err != nil {
@@ -228,6 +284,7 @@ func main() {
228284 validateHostname ,
229285 validateRlimits ,
230286 validateSysctls ,
287+ validateMounts ,
231288 }
232289
233290 for _ , v := range validations {
0 commit comments