mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-25 04:33:26 +00:00
Merge pull request #86802 from Aresforchina/fix-staticcheck-test04
make kubelet sysctl constants private
This commit is contained in:
commit
2f2923fc33
@ -25,28 +25,28 @@ type Namespace string
|
|||||||
|
|
||||||
const (
|
const (
|
||||||
// the Linux IPC namespace
|
// the Linux IPC namespace
|
||||||
IpcNamespace = Namespace("ipc")
|
ipcNamespace = Namespace("ipc")
|
||||||
|
|
||||||
// the network namespace
|
// the network namespace
|
||||||
NetNamespace = Namespace("net")
|
netNamespace = Namespace("net")
|
||||||
|
|
||||||
// the zero value if no namespace is known
|
// the zero value if no namespace is known
|
||||||
UnknownNamespace = Namespace("")
|
unknownNamespace = Namespace("")
|
||||||
)
|
)
|
||||||
|
|
||||||
var namespaces = map[string]Namespace{
|
var namespaces = map[string]Namespace{
|
||||||
"kernel.sem": IpcNamespace,
|
"kernel.sem": ipcNamespace,
|
||||||
}
|
}
|
||||||
|
|
||||||
var prefixNamespaces = map[string]Namespace{
|
var prefixNamespaces = map[string]Namespace{
|
||||||
"kernel.shm": IpcNamespace,
|
"kernel.shm": ipcNamespace,
|
||||||
"kernel.msg": IpcNamespace,
|
"kernel.msg": ipcNamespace,
|
||||||
"fs.mqueue.": IpcNamespace,
|
"fs.mqueue.": ipcNamespace,
|
||||||
"net.": NetNamespace,
|
"net.": netNamespace,
|
||||||
}
|
}
|
||||||
|
|
||||||
// NamespacedBy returns the namespace of the Linux kernel for a sysctl, or
|
// NamespacedBy returns the namespace of the Linux kernel for a sysctl, or
|
||||||
// UnknownNamespace if the sysctl is not known to be namespaced.
|
// unknownNamespace if the sysctl is not known to be namespaced.
|
||||||
func NamespacedBy(val string) Namespace {
|
func NamespacedBy(val string) Namespace {
|
||||||
if ns, found := namespaces[val]; found {
|
if ns, found := namespaces[val]; found {
|
||||||
return ns
|
return ns
|
||||||
@ -56,5 +56,5 @@ func NamespacedBy(val string) Namespace {
|
|||||||
return ns
|
return ns
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
return UnknownNamespace
|
return unknownNamespace
|
||||||
}
|
}
|
||||||
|
@ -22,10 +22,10 @@ import (
|
|||||||
|
|
||||||
func TestNamespacedBy(t *testing.T) {
|
func TestNamespacedBy(t *testing.T) {
|
||||||
tests := map[string]Namespace{
|
tests := map[string]Namespace{
|
||||||
"kernel.shm_rmid_forced": IpcNamespace,
|
"kernel.shm_rmid_forced": ipcNamespace,
|
||||||
"net.a.b.c": NetNamespace,
|
"net.a.b.c": netNamespace,
|
||||||
"fs.mqueue.a.b.c": IpcNamespace,
|
"fs.mqueue.a.b.c": ipcNamespace,
|
||||||
"foo": UnknownNamespace,
|
"foo": unknownNamespace,
|
||||||
}
|
}
|
||||||
|
|
||||||
for sysctl, ns := range tests {
|
for sysctl, ns := range tests {
|
||||||
|
@ -58,13 +58,13 @@ func NewWhitelist(patterns []string) (*patternWhitelist, error) {
|
|||||||
if strings.HasSuffix(s, "*") {
|
if strings.HasSuffix(s, "*") {
|
||||||
prefix := s[:len(s)-1]
|
prefix := s[:len(s)-1]
|
||||||
ns := NamespacedBy(prefix)
|
ns := NamespacedBy(prefix)
|
||||||
if ns == UnknownNamespace {
|
if ns == unknownNamespace {
|
||||||
return nil, fmt.Errorf("the sysctls %q are not known to be namespaced", s)
|
return nil, fmt.Errorf("the sysctls %q are not known to be namespaced", s)
|
||||||
}
|
}
|
||||||
w.prefixes[prefix] = ns
|
w.prefixes[prefix] = ns
|
||||||
} else {
|
} else {
|
||||||
ns := NamespacedBy(s)
|
ns := NamespacedBy(s)
|
||||||
if ns == UnknownNamespace {
|
if ns == unknownNamespace {
|
||||||
return nil, fmt.Errorf("the sysctl %q are not known to be namespaced", s)
|
return nil, fmt.Errorf("the sysctl %q are not known to be namespaced", s)
|
||||||
}
|
}
|
||||||
w.sysctls[s] = ns
|
w.sysctls[s] = ns
|
||||||
@ -83,20 +83,20 @@ func NewWhitelist(patterns []string) (*patternWhitelist, error) {
|
|||||||
func (w *patternWhitelist) validateSysctl(sysctl string, hostNet, hostIPC bool) error {
|
func (w *patternWhitelist) validateSysctl(sysctl string, hostNet, hostIPC bool) error {
|
||||||
nsErrorFmt := "%q not allowed with host %s enabled"
|
nsErrorFmt := "%q not allowed with host %s enabled"
|
||||||
if ns, found := w.sysctls[sysctl]; found {
|
if ns, found := w.sysctls[sysctl]; found {
|
||||||
if ns == IpcNamespace && hostIPC {
|
if ns == ipcNamespace && hostIPC {
|
||||||
return fmt.Errorf(nsErrorFmt, sysctl, ns)
|
return fmt.Errorf(nsErrorFmt, sysctl, ns)
|
||||||
}
|
}
|
||||||
if ns == NetNamespace && hostNet {
|
if ns == netNamespace && hostNet {
|
||||||
return fmt.Errorf(nsErrorFmt, sysctl, ns)
|
return fmt.Errorf(nsErrorFmt, sysctl, ns)
|
||||||
}
|
}
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
for p, ns := range w.prefixes {
|
for p, ns := range w.prefixes {
|
||||||
if strings.HasPrefix(sysctl, p) {
|
if strings.HasPrefix(sysctl, p) {
|
||||||
if ns == IpcNamespace && hostIPC {
|
if ns == ipcNamespace && hostIPC {
|
||||||
return fmt.Errorf(nsErrorFmt, sysctl, ns)
|
return fmt.Errorf(nsErrorFmt, sysctl, ns)
|
||||||
}
|
}
|
||||||
if ns == NetNamespace && hostNet {
|
if ns == netNamespace && hostNet {
|
||||||
return fmt.Errorf(nsErrorFmt, sysctl, ns)
|
return fmt.Errorf(nsErrorFmt, sysctl, ns)
|
||||||
}
|
}
|
||||||
return nil
|
return nil
|
||||||
|
Loading…
Reference in New Issue
Block a user