From 6c573c68eeca66ce298274fd24101b5e061a3a60 Mon Sep 17 00:00:00 2001 From: pandaWall Date: Wed, 28 Oct 2026 15:39:35 +0800 Subject: [PATCH] runtime-tools: fix panics adjusting seccomp/rlimits of sectionless specs AdjustSeccompPolicy() and AdjustRlimits() write to g.Config.Linux and g.Config.Process without making sure the corresponding OCI Spec section exists. Every other adjuster initializes the section it touches first (AdjustResources() calls initConfigLinux(), AdjustLinuxScheduler() and SetProcessIOPriority() call initConfigProcess(), ...), but these two are missing the corresponding calls. A plugin adjustment carrying a seccomp policy or POSIX rlimits therefore takes the runtime down with a nil pointer dereference on a Spec that does not have the relevant section. Signed-off-by: pandaWall --- pkg/runtime-tools/generate/generate.go | 8 ++++ .../generate/generate_suite_test.go | 45 +++++++++++++++++++ 2 files changed, 53 insertions(+) diff --git a/pkg/runtime-tools/generate/generate.go b/pkg/runtime-tools/generate/generate.go index d1ade6ef..a3c2944b 100644 --- a/pkg/runtime-tools/generate/generate.go +++ b/pkg/runtime-tools/generate/generate.go @@ -457,6 +457,8 @@ func (g *Generator) AdjustSeccompPolicy(policy *nri.LinuxSeccomp) error { return nil } + g.initConfigLinux() + // Note: we explicitly do not use the SetDefaultSeccompAction() and // SetSeccompArchitecture() helpers from generate here, because they // expect a "humanized" version of the action (e.g. "allow" or "x86"). @@ -586,6 +588,12 @@ func (g *Generator) InjectCDIDevices(devices []*nri.CDIDevice) error { // AdjustRlimits adjusts the (Linux) POSIX resource limits in the OCI Spec. func (g *Generator) AdjustRlimits(rlimits []*nri.POSIXRlimit) error { + if len(rlimits) == 0 { + return nil + } + + g.initConfigProcess() + for _, l := range rlimits { if l == nil { continue diff --git a/pkg/runtime-tools/generate/generate_suite_test.go b/pkg/runtime-tools/generate/generate_suite_test.go index 4e8ade6e..11a28f60 100644 --- a/pkg/runtime-tools/generate/generate_suite_test.go +++ b/pkg/runtime-tools/generate/generate_suite_test.go @@ -309,6 +309,51 @@ func TestAdjustment(t *testing.T) { require.NoError(t, xg.Adjust(adjust)) require.Nil(t, spec.Linux.IntelRdt) }) + + t.Run("seccomp policy without Linux section", func(t *testing.T) { + spec := makeSpec() + spec.Linux = nil + seccomp := rspec.LinuxSeccomp{ + DefaultAction: rspec.ActErrno, + Architectures: []rspec.Arch{}, + Flags: []rspec.LinuxSeccompFlag{}, + Syscalls: []rspec.LinuxSyscall{}, + } + adjust := &api.ContainerAdjustment{ + Linux: &api.LinuxContainerAdjustment{ + SeccompPolicy: api.FromOCILinuxSeccomp(&seccomp), + }, + } + + xg := xgen.SpecGenerator(ocigen.New(spec)) + require.NotNil(t, xg) + require.NoError(t, xg.Adjust(adjust)) + require.NotNil(t, spec.Linux) + require.Equal(t, seccomp, *spec.Linux.Seccomp) + }) + + t.Run("rlimits without Process section", func(t *testing.T) { + spec := makeSpec() + spec.Process = nil + rlimits := []rspec.POSIXRlimit{{ + Type: "nofile", + Hard: 456, + Soft: 123, + }} + adjust := &api.ContainerAdjustment{ + Rlimits: []*api.POSIXRlimit{{ + Type: "nofile", + Hard: 456, + Soft: 123, + }}, + } + + xg := xgen.SpecGenerator(ocigen.New(spec)) + require.NotNil(t, xg) + require.NoError(t, xg.Adjust(adjust)) + require.NotNil(t, spec.Process) + require.Equal(t, rlimits, spec.Process.Rlimits) + }) } type specOption func(*rspec.Spec)