Update CDI package

Signed-off-by: Evan Lezar <elezar@nvidia.com>

vendor/github.com/opencontainers/runtime-spec/specs-go/config.go

@@ -12,6 +12,8 @@ type Spec struct {
 	Root *Root `json:"root,omitempty"`
 	// Hostname configures the container's hostname.
 	Hostname string `json:"hostname,omitempty"`
+	// Domainname configures the container's domainname.
+	Domainname string `json:"domainname,omitempty"`
 	// Mounts configures additional mounts (on top of Root).
 	Mounts []Mount `json:"mounts,omitempty"`
 	// Hooks configures callbacks for container lifecycle events.
@@ -117,6 +119,11 @@ type Mount struct {
 	Source string `json:"source,omitempty"`
 	// Options are fstab style mount options.
 	Options []string `json:"options,omitempty"`
+
+	// UID/GID mappings used for changing file owners w/o calling chown, fs should support it.
+	// Every mount point could have its own mapping.
+	UIDMappings []LinuxIDMapping `json:"uidMappings,omitempty" platform:"linux"`
+	GIDMappings []LinuxIDMapping `json:"gidMappings,omitempty" platform:"linux"`
 }
 
 // Hook specifies a command that is run at a particular event in the lifecycle of a container
@@ -252,8 +259,8 @@ type LinuxInterfacePriority struct {
 	Priority uint32 `json:"priority"`
 }
 
-// linuxBlockIODevice holds major:minor format supported in blkio cgroup
-type linuxBlockIODevice struct {
+// LinuxBlockIODevice holds major:minor format supported in blkio cgroup
+type LinuxBlockIODevice struct {
 	// Major is the device's major number.
 	Major int64 `json:"major"`
 	// Minor is the device's minor number.
@@ -262,7 +269,7 @@ type linuxBlockIODevice struct {
 
 // LinuxWeightDevice struct holds a `major:minor weight` pair for weightDevice
 type LinuxWeightDevice struct {
-	linuxBlockIODevice
+	LinuxBlockIODevice
 	// Weight is the bandwidth rate for the device.
 	Weight *uint16 `json:"weight,omitempty"`
 	// LeafWeight is the bandwidth rate for the device while competing with the cgroup's child cgroups, CFQ scheduler only
@@ -271,7 +278,7 @@ type LinuxWeightDevice struct {
 
 // LinuxThrottleDevice struct holds a `major:minor rate_per_second` pair
 type LinuxThrottleDevice struct {
-	linuxBlockIODevice
+	LinuxBlockIODevice
 	// Rate is the IO rate limit per cgroup per device
 	Rate uint64 `json:"rate"`
 }
@@ -330,6 +337,8 @@ type LinuxCPU struct {
 	Cpus string `json:"cpus,omitempty"`
 	// List of memory nodes in the cpuset. Default is to use any available memory node.
 	Mems string `json:"mems,omitempty"`
+	// cgroups are configured with minimum weight, 0: default behavior, 1: SCHED_IDLE.
+	Idle *int64 `json:"idle,omitempty"`
 }
 
 // LinuxPids for Linux cgroup 'pids' resource management (Linux 4.3)
@@ -524,11 +533,21 @@ type WindowsMemoryResources struct {
 
 // WindowsCPUResources contains CPU resource management settings.
 type WindowsCPUResources struct {
-	// Number of CPUs available to the container.
+	// Count is the number of CPUs available to the container. It represents the
+	// fraction of the configured processor `count` in a container in relation
+	// to the processors available in the host. The fraction ultimately
+	// determines the portion of processor cycles that the threads in a
+	// container can use during each scheduling interval, as the number of
+	// cycles per 10,000 cycles.
 	Count *uint64 `json:"count,omitempty"`
-	// CPU shares (relative weight to other containers with cpu shares).
+	// Shares limits the share of processor time given to the container relative
+	// to other workloads on the processor. The processor `shares` (`weight` at
+	// the platform level) is a value between 0 and 10000.
 	Shares *uint16 `json:"shares,omitempty"`
-	// Specifies the portion of processor cycles that this container can use as a percentage times 100.
+	// Maximum determines the portion of processor cycles that the threads in a
+	// container can use during each scheduling interval, as the number of
+	// cycles per 10,000 cycles. Set processor `maximum` to a percentage times
+	// 100.
 	Maximum *uint16 `json:"maximum,omitempty"`
 }
 
@@ -615,6 +634,19 @@ type Arch string
 // LinuxSeccompFlag is a flag to pass to seccomp(2).
 type LinuxSeccompFlag string
 
+const (
+	// LinuxSeccompFlagLog is a seccomp flag to request all returned
+	// actions except SECCOMP_RET_ALLOW to be logged. An administrator may
+	// override this filter flag by preventing specific actions from being
+	// logged via the /proc/sys/kernel/seccomp/actions_logged file. (since
+	// Linux 4.14)
+	LinuxSeccompFlagLog LinuxSeccompFlag = "SECCOMP_FILTER_FLAG_LOG"
+
+	// LinuxSeccompFlagSpecAllow can be used to disable Speculative Store
+	// Bypass mitigation. (since Linux 4.17)
+	LinuxSeccompFlagSpecAllow LinuxSeccompFlag = "SECCOMP_FILTER_FLAG_SPEC_ALLOW"
+)
+
 // Additional architectures permitted to be used for system calls
 // By default only the native architecture of the kernel is permitted
 const (

vendor/github.com/opencontainers/runtime-tools/error/error.go

@@ -1,122 +0,0 @@
-// Package error implements generic tooling for tracking RFC 2119
-// violations and linking back to the appropriate specification section.
-package error
-
-import (
-	"fmt"
-	"strings"
-)
-
-// Level represents the RFC 2119 compliance levels
-type Level int
-
-const (
-	// MAY-level
-
-	// May represents 'MAY' in RFC 2119.
-	May Level = iota
-	// Optional represents 'OPTIONAL' in RFC 2119.
-	Optional
-
-	// SHOULD-level
-
-	// Should represents 'SHOULD' in RFC 2119.
-	Should
-	// ShouldNot represents 'SHOULD NOT' in RFC 2119.
-	ShouldNot
-	// Recommended represents 'RECOMMENDED' in RFC 2119.
-	Recommended
-	// NotRecommended represents 'NOT RECOMMENDED' in RFC 2119.
-	NotRecommended
-
-	// MUST-level
-
-	// Must represents 'MUST' in RFC 2119
-	Must
-	// MustNot represents 'MUST NOT' in RFC 2119.
-	MustNot
-	// Shall represents 'SHALL' in RFC 2119.
-	Shall
-	// ShallNot represents 'SHALL NOT' in RFC 2119.
-	ShallNot
-	// Required represents 'REQUIRED' in RFC 2119.
-	Required
-)
-
-// Error represents an error with compliance level and specification reference.
-type Error struct {
-	// Level represents the RFC 2119 compliance level.
-	Level Level
-
-	// Reference is a URL for the violated specification requirement.
-	Reference string
-
-	// Err holds additional details about the violation.
-	Err error
-}
-
-// ParseLevel takes a string level and returns the RFC 2119 compliance level constant.
-func ParseLevel(level string) (Level, error) {
-	switch strings.ToUpper(level) {
-	case "MAY":
-		fallthrough
-	case "OPTIONAL":
-		return May, nil
-	case "SHOULD":
-		fallthrough
-	case "SHOULDNOT":
-		fallthrough
-	case "RECOMMENDED":
-		fallthrough
-	case "NOTRECOMMENDED":
-		return Should, nil
-	case "MUST":
-		fallthrough
-	case "MUSTNOT":
-		fallthrough
-	case "SHALL":
-		fallthrough
-	case "SHALLNOT":
-		fallthrough
-	case "REQUIRED":
-		return Must, nil
-	}
-
-	var l Level
-	return l, fmt.Errorf("%q is not a valid compliance level", level)
-}
-
-// String takes a RFC 2119 compliance level constant and returns a string representation.
-func (level Level) String() string {
-	switch level {
-	case May:
-		return "MAY"
-	case Optional:
-		return "OPTIONAL"
-	case Should:
-		return "SHOULD"
-	case ShouldNot:
-		return "SHOULD NOT"
-	case Recommended:
-		return "RECOMMENDED"
-	case NotRecommended:
-		return "NOT RECOMMENDED"
-	case Must:
-		return "MUST"
-	case MustNot:
-		return "MUST NOT"
-	case Shall:
-		return "SHALL"
-	case ShallNot:
-		return "SHALL NOT"
-	case Required:
-		return "REQUIRED"
-	}
-
-	panic(fmt.Sprintf("%d is not a valid compliance level", level))
-}
-
-// Error returns the error message with specification reference.
-func (err *Error) Error() string {
-	return fmt.Sprintf("%s\nRefer to: %s", err.Err.Error(), err.Reference)
-}

vendor/github.com/opencontainers/runtime-tools/filepath/abs.go

@@ -1,48 +0,0 @@
-package filepath
-
-import (
-	"regexp"
-	"strings"
-)
-
-var windowsAbs = regexp.MustCompile(`^[a-zA-Z]:\\.*$`)
-
-// Abs is a version of path/filepath's Abs with an explicit operating
-// system and current working directory.
-func Abs(os, path, cwd string) (_ string, err error) {
-	if IsAbs(os, path) {
-		return Clean(os, path), nil
-	}
-	return Clean(os, Join(os, cwd, path)), nil
-}
-
-// IsAbs is a version of path/filepath's IsAbs with an explicit
-// operating system.
-func IsAbs(os, path string) bool {
-	if os == "windows" {
-		// FIXME: copy hideous logic from Go's
-		// src/path/filepath/path_windows.go into somewhere where we can
-		// put 3-clause BSD licensed code.
-		return windowsAbs.MatchString(path)
-	}
-	sep := Separator(os)
-
-	// POSIX has [1]:
-	//
-	// > If a pathname begins with two successive <slash> characters,
-	// > the first component following the leading <slash> characters
-	// > may be interpreted in an implementation-defined manner,
-	// > although more than two leading <slash> characters shall be
-	// > treated as a single <slash> character.
-	//
-	// And Boost treats // as non-absolute [2], but Linux [3,4], Python
-	// [5] and Go [6] all treat // as absolute.
-	//
-	// [1]: http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap04.html#tag_04_13
-	// [2]: https://github.com/boostorg/filesystem/blob/boost-1.64.0/test/path_test.cpp#L861
-	// [3]: http://man7.org/linux/man-pages/man7/path_resolution.7.html
-	// [4]: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/filesystems/path-lookup.md?h=v4.12#n41
-	// [5]: https://github.com/python/cpython/blob/v3.6.1/Lib/posixpath.py#L64-L66
-	// [6]: https://go.googlesource.com/go/+/go1.8.3/src/path/path.go#199
-	return strings.HasPrefix(path, string(sep))
-}

vendor/github.com/opencontainers/runtime-tools/filepath/ancestor.go

@@ -1,32 +0,0 @@
-package filepath
-
-import (
-	"fmt"
-	"strings"
-)
-
-// IsAncestor returns true when pathB is an strict ancestor of pathA,
-// and false where the paths are equal or pathB is outside of pathA.
-// Paths that are not absolute will be made absolute with Abs.
-func IsAncestor(os, pathA, pathB, cwd string) (_ bool, err error) {
-	if pathA == pathB {
-		return false, nil
-	}
-
-	pathA, err = Abs(os, pathA, cwd)
-	if err != nil {
-		return false, err
-	}
-	pathB, err = Abs(os, pathB, cwd)
-	if err != nil {
-		return false, err
-	}
-	sep := Separator(os)
-	if !strings.HasSuffix(pathA, string(sep)) {
-		pathA = fmt.Sprintf("%s%c", pathA, sep)
-	}
-	if pathA == pathB {
-		return false, nil
-	}
-	return strings.HasPrefix(pathB, pathA), nil
-}

vendor/github.com/opencontainers/runtime-tools/filepath/clean.go

@@ -1,74 +0,0 @@
-package filepath
-
-import (
-	"fmt"
-	"strings"
-)
-
-// Clean is an explicit-OS version of path/filepath's Clean.
-func Clean(os, path string) string {
-	abs := IsAbs(os, path)
-	sep := Separator(os)
-	elements := strings.Split(path, string(sep))
-
-	// Replace multiple Separator elements with a single one.
-	for i := 0; i < len(elements); i++ {
-		if len(elements[i]) == 0 {
-			elements = append(elements[:i], elements[i+1:]...)
-			i--
-		}
-	}
-
-	// Eliminate each . path name element (the current directory).
-	for i := 0; i < len(elements); i++ {
-		if elements[i] == "." && len(elements) > 1 {
-			elements = append(elements[:i], elements[i+1:]...)
-			i--
-		}
-	}
-
-	// Eliminate each inner .. path name element (the parent directory)
-	// along with the non-.. element that precedes it.
-	for i := 1; i < len(elements); i++ {
-		if i == 1 && abs && sep == '\\' {
-			continue
-		}
-		if i > 0 && elements[i] == ".." {
-			elements = append(elements[:i-1], elements[i+1:]...)
-			i -= 2
-		}
-	}
-
-	// Eliminate .. elements that begin a rooted path:
-	// that is, replace "/.." by "/" at the beginning of a path,
-	// assuming Separator is '/'.
-	offset := 0
-	if sep == '\\' {
-		offset = 1
-	}
-	if abs {
-		for len(elements) > offset && elements[offset] == ".." {
-			elements = append(elements[:offset], elements[offset+1:]...)
-		}
-	}
-
-	cleaned := strings.Join(elements, string(sep))
-	if abs {
-		if sep == '/' {
-			cleaned = fmt.Sprintf("%c%s", sep, cleaned)
-		} else if len(elements) == 1 {
-			cleaned = fmt.Sprintf("%s%c", cleaned, sep)
-		}
-	}
-
-	// If the result of this process is an empty string, Clean returns
-	// the string ".".
-	if len(cleaned) == 0 {
-		cleaned = "."
-	}
-
-	if cleaned == path {
-		return path
-	}
-	return Clean(os, cleaned)
-}

vendor/github.com/opencontainers/runtime-tools/filepath/doc.go

@@ -1,6 +0,0 @@
-// Package filepath implements Go's filepath package with explicit
-// operating systems (and for some functions and explicit working
-// directory).  This allows tools built for one OS to operate on paths
-// targeting another OS.  For example, a Linux build can determine
-// whether a path is absolute on Linux or on Windows.
-package filepath

vendor/github.com/opencontainers/runtime-tools/filepath/join.go

@@ -1,9 +0,0 @@
-package filepath
-
-import "strings"
-
-// Join is an explicit-OS version of path/filepath's Join.
-func Join(os string, elem ...string) string {
-	sep := Separator(os)
-	return Clean(os, strings.Join(elem, string(sep)))
-}

vendor/github.com/opencontainers/runtime-tools/filepath/separator.go

@@ -1,9 +0,0 @@
-package filepath
-
-// Separator is an explicit-OS version of path/filepath's Separator.
-func Separator(os string) rune {
-	if os == "windows" {
-		return '\\'
-	}
-	return '/'
-}

vendor/github.com/opencontainers/runtime-tools/generate/generate.go

@@ -10,7 +10,7 @@ import (
 
 	rspec "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/opencontainers/runtime-tools/generate/seccomp"
-	"github.com/opencontainers/runtime-tools/validate"
+	capsCheck "github.com/opencontainers/runtime-tools/validate/capabilities"
 	"github.com/syndtr/gocapability/capability"
 )
 
@@ -42,7 +42,7 @@ type ExportOptions struct {
 // New creates a configuration Generator with the default
 // configuration for the target operating system.
 func New(os string) (generator Generator, err error) {
-	if os != "linux" && os != "solaris" && os != "windows" {
+	if os != "linux" && os != "solaris" && os != "windows" && os != "freebsd" {
 		return generator, fmt.Errorf("no defaults configured for %s", os)
 	}
 
@@ -72,7 +72,7 @@ func New(os string) (generator Generator, err error) {
 		}
 	}
 
-	if os == "linux" || os == "solaris" {
+	if os == "linux" || os == "solaris" || os == "freebsd" {
 		config.Process.User = rspec.User{}
 		config.Process.Env = []string{
 			"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
@@ -237,6 +237,21 @@ func New(os string) (generator Generator, err error) {
 			},
 			Seccomp: seccomp.DefaultProfile(&config),
 		}
+	} else if os == "freebsd" {
+		config.Mounts = []rspec.Mount{
+			{
+				Destination: "/dev",
+				Type:        "devfs",
+				Source:      "devfs",
+				Options:     []string{"ruleset=4"},
+			},
+			{
+				Destination: "/dev/fd",
+				Type:        "fdescfs",
+				Source:      "fdesc",
+				Options:     []string{},
+			},
+		}
 	}
 
 	envCache := map[string]int{}
@@ -249,10 +264,6 @@ func New(os string) (generator Generator, err error) {
 
 // NewFromSpec creates a configuration Generator from a given
 // configuration.
-//
-// Deprecated: Replace with:
-//
-//   generator := Generator{Config: config}
 func NewFromSpec(config *rspec.Spec) Generator {
 	envCache := map[string]int{}
 	if config != nil && config.Process != nil {
@@ -1125,7 +1136,7 @@ func (g *Generator) SetupPrivileged(privileged bool) {
 	if privileged { // Add all capabilities in privileged mode.
 		var finalCapList []string
 		for _, cap := range capability.List() {
-			if g.HostSpecific && cap > validate.LastCap() {
+			if g.HostSpecific && cap > capsCheck.LastCap() {
 				continue
 			}
 			finalCapList = append(finalCapList, fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())))
@@ -1159,7 +1170,7 @@ func (g *Generator) ClearProcessCapabilities() {
 // AddProcessCapability adds a process capability into all 5 capability sets.
 func (g *Generator) AddProcessCapability(c string) error {
 	cp := strings.ToUpper(c)
-	if err := validate.CapValid(cp, g.HostSpecific); err != nil {
+	if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
 		return err
 	}
 
@@ -1222,7 +1233,7 @@ func (g *Generator) AddProcessCapability(c string) error {
 // AddProcessCapabilityAmbient adds a process capability into g.Config.Process.Capabilities.Ambient.
 func (g *Generator) AddProcessCapabilityAmbient(c string) error {
 	cp := strings.ToUpper(c)
-	if err := validate.CapValid(cp, g.HostSpecific); err != nil {
+	if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
 		return err
 	}
 
@@ -1246,7 +1257,7 @@ func (g *Generator) AddProcessCapabilityAmbient(c string) error {
 // AddProcessCapabilityBounding adds a process capability into g.Config.Process.Capabilities.Bounding.
 func (g *Generator) AddProcessCapabilityBounding(c string) error {
 	cp := strings.ToUpper(c)
-	if err := validate.CapValid(cp, g.HostSpecific); err != nil {
+	if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
 		return err
 	}
 
@@ -1269,7 +1280,7 @@ func (g *Generator) AddProcessCapabilityBounding(c string) error {
 // AddProcessCapabilityEffective adds a process capability into g.Config.Process.Capabilities.Effective.
 func (g *Generator) AddProcessCapabilityEffective(c string) error {
 	cp := strings.ToUpper(c)
-	if err := validate.CapValid(cp, g.HostSpecific); err != nil {
+	if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
 		return err
 	}
 
@@ -1292,7 +1303,7 @@ func (g *Generator) AddProcessCapabilityEffective(c string) error {
 // AddProcessCapabilityInheritable adds a process capability into g.Config.Process.Capabilities.Inheritable.
 func (g *Generator) AddProcessCapabilityInheritable(c string) error {
 	cp := strings.ToUpper(c)
-	if err := validate.CapValid(cp, g.HostSpecific); err != nil {
+	if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
 		return err
 	}
 
@@ -1315,7 +1326,7 @@ func (g *Generator) AddProcessCapabilityInheritable(c string) error {
 // AddProcessCapabilityPermitted adds a process capability into g.Config.Process.Capabilities.Permitted.
 func (g *Generator) AddProcessCapabilityPermitted(c string) error {
 	cp := strings.ToUpper(c)
-	if err := validate.CapValid(cp, g.HostSpecific); err != nil {
+	if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
 		return err
 	}
 
@@ -1368,7 +1379,7 @@ func (g *Generator) DropProcessCapability(c string) error {
 		}
 	}
 
-	return validate.CapValid(cp, false)
+	return capsCheck.CapValid(cp, false)
 }
 
 // DropProcessCapabilityAmbient drops a process capability from g.Config.Process.Capabilities.Ambient.
@@ -1384,7 +1395,7 @@ func (g *Generator) DropProcessCapabilityAmbient(c string) error {
 		}
 	}
 
-	return validate.CapValid(cp, false)
+	return capsCheck.CapValid(cp, false)
 }
 
 // DropProcessCapabilityBounding drops a process capability from g.Config.Process.Capabilities.Bounding.
@@ -1400,7 +1411,7 @@ func (g *Generator) DropProcessCapabilityBounding(c string) error {
 		}
 	}
 
-	return validate.CapValid(cp, false)
+	return capsCheck.CapValid(cp, false)
 }
 
 // DropProcessCapabilityEffective drops a process capability from g.Config.Process.Capabilities.Effective.
@@ -1416,7 +1427,7 @@ func (g *Generator) DropProcessCapabilityEffective(c string) error {
 		}
 	}
 
-	return validate.CapValid(cp, false)
+	return capsCheck.CapValid(cp, false)
 }
 
 // DropProcessCapabilityInheritable drops a process capability from g.Config.Process.Capabilities.Inheritable.
@@ -1432,7 +1443,7 @@ func (g *Generator) DropProcessCapabilityInheritable(c string) error {
 		}
 	}
 
-	return validate.CapValid(cp, false)
+	return capsCheck.CapValid(cp, false)
 }
 
 // DropProcessCapabilityPermitted drops a process capability from g.Config.Process.Capabilities.Permitted.
@@ -1448,7 +1459,7 @@ func (g *Generator) DropProcessCapabilityPermitted(c string) error {
 		}
 	}
 
-	return validate.CapValid(cp, false)
+	return capsCheck.CapValid(cp, false)
 }
 
 func mapStrToNamespace(ns string, path string) (rspec.LinuxNamespace, error) {
@@ -1606,6 +1617,12 @@ func (g *Generator) SetDefaultSeccompActionForce(action string) error {
 	return seccomp.ParseDefaultActionForce(action, g.Config.Linux.Seccomp)
 }
 
+// SetDomainName sets g.Config.Domainname
+func (g *Generator) SetDomainName(domain string) {
+	g.initConfig()
+	g.Config.Domainname = domain
+}
+
 // SetSeccompArchitecture sets the supported seccomp architectures
 func (g *Generator) SetSeccompArchitecture(architecture string) error {
 	g.initConfigLinuxSeccomp()

vendor/github.com/opencontainers/runtime-tools/generate/seccomp/seccomp_default.go

@@ -151,6 +151,9 @@ func DefaultProfile(rs *specs.Spec) *rspec.LinuxSeccomp {
 				"io_submit",
 				"ipc",
 				"kill",
+				"landlock_add_rule",
+				"landlock_create_ruleset",
+				"landlock_restrict_self",
 				"lchown",
 				"lchown32",
 				"lgetxattr",
@@ -303,6 +306,7 @@ func DefaultProfile(rs *specs.Spec) *rspec.LinuxSeccomp {
 				"stat64",
 				"statfs",
 				"statfs64",
+				"statx",
 				"symlink",
 				"symlinkat",
 				"sync",
@@ -353,11 +357,23 @@ func DefaultProfile(rs *specs.Spec) *rspec.LinuxSeccomp {
 					Value: 0x0,
 					Op:    rspec.OpEqualTo,
 				},
+			},
+		},
+		{
+			Names:  []string{"personality"},
+			Action: rspec.ActAllow,
+			Args: []rspec.LinuxSeccompArg{
 				{
 					Index: 0,
 					Value: 0x0008,
 					Op:    rspec.OpEqualTo,
 				},
+			},
+		},
+		{
+			Names:  []string{"personality"},
+			Action: rspec.ActAllow,
+			Args: []rspec.LinuxSeccompArg{
 				{
 					Index: 0,
 					Value: 0xffffffff,
@@ -512,7 +528,7 @@ func DefaultProfile(rs *specs.Spec) *rspec.LinuxSeccomp {
 				Args: []rspec.LinuxSeccompArg{
 					{
 						Index:    sysCloneFlagsIndex,
-						Value:    CloneNewNS | CloneNewUTS | CloneNewIPC | CloneNewUser | CloneNewPID | CloneNewNet,
+						Value:    CloneNewNS | CloneNewUTS | CloneNewIPC | CloneNewUser | CloneNewPID | CloneNewNet | CloneNewCgroup,
 						ValueTwo: 0,
 						Op:       rspec.OpMaskedEqual,
 					},

vendor/github.com/opencontainers/runtime-tools/generate/seccomp/seccomp_default_linux.go

@@ -3,14 +3,15 @@
 
 package seccomp
 
-import "syscall"
+import "golang.org/x/sys/unix"
 
 // System values passed through on linux
 const (
-	CloneNewIPC  = syscall.CLONE_NEWIPC
-	CloneNewNet  = syscall.CLONE_NEWNET
-	CloneNewNS   = syscall.CLONE_NEWNS
-	CloneNewPID  = syscall.CLONE_NEWPID
-	CloneNewUser = syscall.CLONE_NEWUSER
-	CloneNewUTS  = syscall.CLONE_NEWUTS
+	CloneNewIPC    = unix.CLONE_NEWIPC
+	CloneNewNet    = unix.CLONE_NEWNET
+	CloneNewNS     = unix.CLONE_NEWNS
+	CloneNewPID    = unix.CLONE_NEWPID
+	CloneNewUser   = unix.CLONE_NEWUSER
+	CloneNewUTS    = unix.CLONE_NEWUTS
+	CloneNewCgroup = unix.CLONE_NEWCGROUP
 )

vendor/github.com/opencontainers/runtime-tools/specerror/bundle.go

@@ -1,29 +0,0 @@
-package specerror
-
-import (
-	"fmt"
-
-	rfc2119 "github.com/opencontainers/runtime-tools/error"
-)
-
-// define error codes
-const (
-	// ConfigInRootBundleDir represents "This REQUIRED file MUST reside in the root of the bundle directory"
-	ConfigInRootBundleDir Code = 0xa001 + iota
-	// ConfigConstName represents "This REQUIRED file MUST be named `config.json`."
-	ConfigConstName
-	// ArtifactsInSingleDir represents "When supplied, while these artifacts MUST all be present in a single directory on the local filesystem, that directory itself is not part of the bundle."
-	ArtifactsInSingleDir
-)
-
-var (
-	containerFormatRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "bundle.md#container-format"), nil
-	}
-)
-
-func init() {
-	register(ConfigInRootBundleDir, rfc2119.Must, containerFormatRef)
-	register(ConfigConstName, rfc2119.Must, containerFormatRef)
-	register(ArtifactsInSingleDir, rfc2119.Must, containerFormatRef)
-}

vendor/github.com/opencontainers/runtime-tools/specerror/config-linux.go

@@ -1,134 +0,0 @@
-package specerror
-
-import (
-	"fmt"
-
-	rfc2119 "github.com/opencontainers/runtime-tools/error"
-)
-
-// define error codes
-const (
-	// DefaultFilesystems represents "The following filesystems SHOULD be made available in each container's filesystem:"
-	DefaultFilesystems Code = 0xc001 + iota
-	// NSPathAbs represents "This value MUST be an absolute path in the runtime mount namespace."
-	NSPathAbs
-	// NSProcInPath represents "The runtime MUST place the container process in the namespace associated with that `path`."
-	NSProcInPath
-	// NSPathMatchTypeError represents "The runtime MUST generate an error if `path` is not associated with a namespace of type `type`."
-	NSPathMatchTypeError
-	// NSNewNSWithoutPath represents "If `path` is not specified, the runtime MUST create a new container namespace of type `type`."
-	NSNewNSWithoutPath
-	// NSInheritWithoutType represents "If a namespace type is not specified in the `namespaces` array, the container MUST inherit the runtime namespace of that type."
-	NSInheritWithoutType
-	// NSErrorOnDup represents "If a `namespaces` field contains duplicated namespaces with same `type`, the runtime MUST generate an error."
-	NSErrorOnDup
-	// UserNSMapOwnershipRO represents "The runtime SHOULD NOT modify the ownership of referenced filesystems to realize the mapping."
-	UserNSMapOwnershipRO
-	// DevicesAvailable represents "devices (array of objects, OPTIONAL) lists devices that MUST be available in the container."
-	DevicesAvailable
-	// DevicesFileNotMatch represents "If a file already exists at `path` that does not match the requested device, the runtime MUST generate an error."
-	DevicesFileNotMatch
-	// DevicesMajMinRequired represents "`major, minor` (int64, REQUIRED unless `type` is `p`) - major, minor numbers for the device."
-	DevicesMajMinRequired
-	// DevicesErrorOnDup represents "The same `type`, `major` and `minor` SHOULD NOT be used for multiple devices."
-	DevicesErrorOnDup
-	// DefaultDevices represents "In addition to any devices configured with this setting, the runtime MUST also supply default devices."
-	DefaultDevices
-	// CgroupsPathAbsOrRel represents "The value of `cgroupsPath` MUST be either an absolute path or a relative path."
-	CgroupsPathAbsOrRel
-	// CgroupsAbsPathRelToMount represents "In the case of an absolute path (starting with `/`), the runtime MUST take the path to be relative to the cgroups mount point."
-	CgroupsAbsPathRelToMount
-	// CgroupsPathAttach represents "If the value is specified, the runtime MUST consistently attach to the same place in the cgroups hierarchy given the same value of `cgroupsPath`."
-	CgroupsPathAttach
-	// CgroupsPathError represents "Runtimes MAY consider certain `cgroupsPath` values to be invalid, and MUST generate an error if this is the case."
-	CgroupsPathError
-	// DevicesApplyInOrder represents "The runtime MUST apply entries in the listed order."
-	DevicesApplyInOrder
-	// BlkIOWeightOrLeafWeightExist represents "You MUST specify at least one of `weight` or `leafWeight` in a given entry, and MAY specify both."
-	BlkIOWeightOrLeafWeightExist
-	// IntelRdtPIDWrite represents "If `intelRdt` is set, the runtime MUST write the container process ID to the `<container-id>/tasks` file in a mounted `resctrl` pseudo-filesystem, using the container ID from `start` and creating the `container-id` directory if necessary."
-	IntelRdtPIDWrite
-	// IntelRdtNoMountedResctrlError represents "If no mounted `resctrl` pseudo-filesystem is available in the runtime mount namespace, the runtime MUST generate an error."
-	IntelRdtNoMountedResctrlError
-	// NotManipResctrlWithoutIntelRdt represents "If `intelRdt` is not set, the runtime MUST NOT manipulate any `resctrl` pseudo-filesystems."
-	NotManipResctrlWithoutIntelRdt
-	// IntelRdtL3CacheSchemaWrite represents "If `l3CacheSchema` is set, runtimes MUST write the value to the `schemata` file in the `<container-id>` directory discussed in `intelRdt`."
-	IntelRdtL3CacheSchemaWrite
-	// IntelRdtL3CacheSchemaNotWrite represents "If `l3CacheSchema` is not set, runtimes MUST NOT write to `schemata` files in any `resctrl` pseudo-filesystems."
-	IntelRdtL3CacheSchemaNotWrite
-	// SeccSyscallsNamesRequired represents "`names` MUST contain at least one entry."
-	SeccSyscallsNamesRequired
-	// MaskedPathsAbs represents "maskedPaths (array of strings, OPTIONAL) will mask over the provided paths inside the container so that they cannot be read. The values MUST be absolute paths in the container namespace."
-	MaskedPathsAbs
-	// ReadonlyPathsAbs represents "readonlyPaths (array of strings, OPTIONAL) will set the provided paths as readonly inside the container. The values MUST be absolute paths in the container namespace."
-	ReadonlyPathsAbs
-)
-
-var (
-	defaultFilesystemsRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#default-filesystems"), nil
-	}
-	namespacesRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#namespaces"), nil
-	}
-	userNamespaceMappingsRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#user-namespace-mappings"), nil
-	}
-	devicesRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#devices"), nil
-	}
-	defaultDevicesRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#default-devices"), nil
-	}
-	cgroupsPathRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#cgroups-path"), nil
-	}
-	deviceWhitelistRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#device-whitelist"), nil
-	}
-	blockIoRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#block-io"), nil
-	}
-	intelrdtRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#intelrdt"), nil
-	}
-	seccompRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#seccomp"), nil
-	}
-	maskedPathsRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#masked-paths"), nil
-	}
-	readonlyPathsRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-linux.md#readonly-paths"), nil
-	}
-)
-
-func init() {
-	register(DefaultFilesystems, rfc2119.Should, defaultFilesystemsRef)
-	register(NSPathAbs, rfc2119.Must, namespacesRef)
-	register(NSProcInPath, rfc2119.Must, namespacesRef)
-	register(NSPathMatchTypeError, rfc2119.Must, namespacesRef)
-	register(NSNewNSWithoutPath, rfc2119.Must, namespacesRef)
-	register(NSInheritWithoutType, rfc2119.Must, namespacesRef)
-	register(NSErrorOnDup, rfc2119.Must, namespacesRef)
-	register(UserNSMapOwnershipRO, rfc2119.Should, userNamespaceMappingsRef)
-	register(DevicesAvailable, rfc2119.Must, devicesRef)
-	register(DevicesFileNotMatch, rfc2119.Must, devicesRef)
-	register(DevicesMajMinRequired, rfc2119.Required, devicesRef)
-	register(DevicesErrorOnDup, rfc2119.Should, devicesRef)
-	register(DefaultDevices, rfc2119.Must, defaultDevicesRef)
-	register(CgroupsPathAbsOrRel, rfc2119.Must, cgroupsPathRef)
-	register(CgroupsAbsPathRelToMount, rfc2119.Must, cgroupsPathRef)
-	register(CgroupsPathAttach, rfc2119.Must, cgroupsPathRef)
-	register(CgroupsPathError, rfc2119.Must, cgroupsPathRef)
-	register(DevicesApplyInOrder, rfc2119.Must, deviceWhitelistRef)
-	register(BlkIOWeightOrLeafWeightExist, rfc2119.Must, blockIoRef)
-	register(IntelRdtPIDWrite, rfc2119.Must, intelrdtRef)
-	register(IntelRdtNoMountedResctrlError, rfc2119.Must, intelrdtRef)
-	register(NotManipResctrlWithoutIntelRdt, rfc2119.Must, intelrdtRef)
-	register(IntelRdtL3CacheSchemaWrite, rfc2119.Must, intelrdtRef)
-	register(IntelRdtL3CacheSchemaNotWrite, rfc2119.Must, intelrdtRef)
-	register(SeccSyscallsNamesRequired, rfc2119.Must, seccompRef)
-	register(MaskedPathsAbs, rfc2119.Must, maskedPathsRef)
-	register(ReadonlyPathsAbs, rfc2119.Must, readonlyPathsRef)
-}

vendor/github.com/opencontainers/runtime-tools/specerror/config-windows.go

@@ -1,32 +0,0 @@
-package specerror
-
-import (
-	"fmt"
-
-	rfc2119 "github.com/opencontainers/runtime-tools/error"
-)
-
-// define error codes
-const (
-	// WindowsLayerFoldersRequired represents "`layerFolders` MUST contain at least one entry."
-	WindowsLayerFoldersRequired Code = 0xd001 + iota
-	// WindowsHyperVPresent represents "If present, the container MUST be run with Hyper-V isolation."
-	WindowsHyperVPresent
-	// WindowsHyperVOmit represents "If omitted, the container MUST be run as a Windows Server container."
-	WindowsHyperVOmit
-)
-
-var (
-	layerfoldersRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-windows.md#layerfolders"), nil
-	}
-	hypervRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config-windows.md#hyperv"), nil
-	}
-)
-
-func init() {
-	register(WindowsLayerFoldersRequired, rfc2119.Must, layerfoldersRef)
-	register(WindowsHyperVPresent, rfc2119.Must, hypervRef)
-	register(WindowsHyperVOmit, rfc2119.Must, hypervRef)
-}

vendor/github.com/opencontainers/runtime-tools/specerror/config.go

@@ -1,188 +0,0 @@
-package specerror
-
-import (
-	"fmt"
-
-	rfc2119 "github.com/opencontainers/runtime-tools/error"
-)
-
-// define error codes
-const (
-	// SpecVersionInSemVer represents "`ociVersion` (string, REQUIRED) MUST be in SemVer v2.0.0 format and specifies the version of the Open Container Initiative Runtime Specification with which the bundle complies."
-	SpecVersionInSemVer Code = 0xb001 + iota
-	// RootOnWindowsRequired represents "On Windows, for Windows Server Containers, this field is REQUIRED."
-	RootOnWindowsRequired
-	// RootOnHyperVNotSet represents "For Hyper-V Containers, this field MUST NOT be set."
-	RootOnHyperVNotSet
-	// RootOnNonWindowsRequired represents "On all other platforms, this field is REQUIRED."
-	RootOnNonWindowsRequired
-	// RootPathOnWindowsGUID represents "On Windows, `path` MUST be a volume GUID path."
-	RootPathOnWindowsGUID
-	// RootPathOnPosixConvention represents "The value SHOULD be the conventional `rootfs`."
-	RootPathOnPosixConvention
-	// RootPathExist represents "A directory MUST exist at the path declared by the field."
-	RootPathExist
-	// RootReadonlyImplement represents "`readonly` (bool, OPTIONAL) If true then the root filesystem MUST be read-only inside the container, defaults to false."
-	RootReadonlyImplement
-	// RootReadonlyOnWindowsFalse represents "* On Windows, this field MUST be omitted or false."
-	RootReadonlyOnWindowsFalse
-	// MountsInOrder represents "The runtime MUST mount entries in the listed order."
-	MountsInOrder
-	// MountsDestAbs represents "Destination of mount point: path inside container. This value MUST be an absolute path."
-	MountsDestAbs
-	// MountsDestOnWindowsNotNested represents "Windows: one mount destination MUST NOT be nested within another mount (e.g., c:\\foo and c:\\foo\\bar)."
-	MountsDestOnWindowsNotNested
-	// MountsOptionsOnWindowsROSupport represents "Windows: runtimes MUST support `ro`, mounting the filesystem read-only when `ro` is given."
-	MountsOptionsOnWindowsROSupport
-	// ProcRequiredAtStart represents "This property is REQUIRED when `start` is called."
-	ProcRequiredAtStart
-	// ProcConsoleSizeIgnore represents "Runtimes MUST ignore `consoleSize` if `terminal` is `false` or unset."
-	ProcConsoleSizeIgnore
-	// ProcCwdAbs represents "cwd (string, REQUIRED) is the working directory that will be set for the executable. This value MUST be an absolute path."
-	ProcCwdAbs
-	// ProcArgsOneEntryRequired represents "This specification extends the IEEE standard in that at least one entry is REQUIRED, and that entry is used with the same semantics as `execvp`'s *file*."
-	ProcArgsOneEntryRequired
-	// PosixProcRlimitsTypeGenError represents "The runtime MUST generate an error for any values which cannot be mapped to a relevant kernel interface."
-	PosixProcRlimitsTypeGenError
-	// PosixProcRlimitsTypeGet represents "For each entry in `rlimits`, a `getrlimit(3)` on `type` MUST succeed."
-	PosixProcRlimitsTypeGet
-	// PosixProcRlimitsTypeValueError represents "valid values are defined in the ... man page"
-	PosixProcRlimitsTypeValueError
-	// PosixProcRlimitsSoftMatchCur represents "`rlim.rlim_cur` MUST match the configured value."
-	PosixProcRlimitsSoftMatchCur
-	// PosixProcRlimitsHardMatchMax represents "`rlim.rlim_max` MUST match the configured value."
-	PosixProcRlimitsHardMatchMax
-	// PosixProcRlimitsErrorOnDup represents "If `rlimits` contains duplicated entries with same `type`, the runtime MUST generate an error."
-	PosixProcRlimitsErrorOnDup
-	// LinuxProcCapError represents "Any value which cannot be mapped to a relevant kernel interface MUST cause an error."
-	LinuxProcCapError
-	// LinuxProcOomScoreAdjSet represents "If `oomScoreAdj` is set, the runtime MUST set `oom_score_adj` to the given value."
-	LinuxProcOomScoreAdjSet
-	// LinuxProcOomScoreAdjNotSet represents "If `oomScoreAdj` is not set, the runtime MUST NOT change the value of `oom_score_adj`."
-	LinuxProcOomScoreAdjNotSet
-	// PlatformSpecConfOnWindowsSet represents "This MUST be set if the target platform of this spec is `windows`."
-	PlatformSpecConfOnWindowsSet
-	// PosixHooksPathAbs represents "This specification extends the IEEE standard in that `path` MUST be absolute."
-	PosixHooksPathAbs
-	// PosixHooksTimeoutPositive represents "If set, `timeout` MUST be greater than zero."
-	PosixHooksTimeoutPositive
-	// PosixHooksCalledInOrder represents "Hooks MUST be called in the listed order."
-	PosixHooksCalledInOrder
-	// PosixHooksStateToStdin represents "The state of the container MUST be passed to hooks over stdin so that they may do work appropriate to the current state of the container."
-	PosixHooksStateToStdin
-	// PrestartTiming represents "The pre-start hooks MUST be called after the `start` operation is called but before the user-specified program command is executed."
-	PrestartTiming
-	// PoststartTiming represents "The post-start hooks MUST be called after the user-specified process is executed but before the `start` operation returns."
-	PoststartTiming
-	// PoststopTiming represents "The post-stop hooks MUST be called after the container is deleted but before the `delete` operation returns."
-	PoststopTiming
-	// AnnotationsKeyValueMap represents "Annotations MUST be a key-value map."
-	AnnotationsKeyValueMap
-	// AnnotationsKeyString represents "Keys MUST be strings."
-	AnnotationsKeyString
-	// AnnotationsKeyRequired represents "Keys MUST NOT be an empty string."
-	AnnotationsKeyRequired
-	// AnnotationsKeyReversedDomain represents "Keys SHOULD be named using a reverse domain notation - e.g. `com.example.myKey`."
-	AnnotationsKeyReversedDomain
-	// AnnotationsKeyReservedNS represents "Keys using the `org.opencontainers` namespace are reserved and MUST NOT be used by subsequent specifications."
-	AnnotationsKeyReservedNS
-	// AnnotationsKeyIgnoreUnknown represents "Implementations that are reading/processing this configuration file MUST NOT generate an error if they encounter an unknown annotation key."
-	AnnotationsKeyIgnoreUnknown
-	// AnnotationsValueString represents "Values MUST be strings."
-	AnnotationsValueString
-	// ExtensibilityIgnoreUnknownProp represents "Runtimes that are reading or processing this configuration file MUST NOT generate an error if they encounter an unknown property."
-	ExtensibilityIgnoreUnknownProp
-	// ValidValues represents "Runtimes that are reading or processing this configuration file MUST generate an error when invalid or unsupported values are encountered."
-	ValidValues
-)
-
-var (
-	specificationVersionRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#specification-version"), nil
-	}
-	rootRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#root"), nil
-	}
-	mountsRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#mounts"), nil
-	}
-	processRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#process"), nil
-	}
-	posixProcessRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#posix-process"), nil
-	}
-	linuxProcessRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#linux-process"), nil
-	}
-	platformSpecificConfigurationRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#platform-specific-configuration"), nil
-	}
-	posixPlatformHooksRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#posix-platform-hooks"), nil
-	}
-	prestartRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#prestart"), nil
-	}
-	poststartRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#poststart"), nil
-	}
-	poststopRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#poststop"), nil
-	}
-	annotationsRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#annotations"), nil
-	}
-	extensibilityRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#extensibility"), nil
-	}
-	validValuesRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "config.md#valid-values"), nil
-	}
-)
-
-func init() {
-	register(SpecVersionInSemVer, rfc2119.Must, specificationVersionRef)
-	register(RootOnWindowsRequired, rfc2119.Required, rootRef)
-	register(RootOnHyperVNotSet, rfc2119.Must, rootRef)
-	register(RootOnNonWindowsRequired, rfc2119.Required, rootRef)
-	register(RootPathOnWindowsGUID, rfc2119.Must, rootRef)
-	register(RootPathOnPosixConvention, rfc2119.Should, rootRef)
-	register(RootPathExist, rfc2119.Must, rootRef)
-	register(RootReadonlyImplement, rfc2119.Must, rootRef)
-	register(RootReadonlyOnWindowsFalse, rfc2119.Must, rootRef)
-	register(MountsInOrder, rfc2119.Must, mountsRef)
-	register(MountsDestAbs, rfc2119.Must, mountsRef)
-	register(MountsDestOnWindowsNotNested, rfc2119.Must, mountsRef)
-	register(MountsOptionsOnWindowsROSupport, rfc2119.Must, mountsRef)
-	register(ProcRequiredAtStart, rfc2119.Required, processRef)
-	register(ProcConsoleSizeIgnore, rfc2119.Must, processRef)
-	register(ProcCwdAbs, rfc2119.Must, processRef)
-	register(ProcArgsOneEntryRequired, rfc2119.Required, processRef)
-	register(PosixProcRlimitsTypeGenError, rfc2119.Must, posixProcessRef)
-	register(PosixProcRlimitsTypeGet, rfc2119.Must, posixProcessRef)
-	register(PosixProcRlimitsTypeValueError, rfc2119.Should, posixProcessRef)
-	register(PosixProcRlimitsSoftMatchCur, rfc2119.Must, posixProcessRef)
-	register(PosixProcRlimitsHardMatchMax, rfc2119.Must, posixProcessRef)
-	register(PosixProcRlimitsErrorOnDup, rfc2119.Must, posixProcessRef)
-	register(LinuxProcCapError, rfc2119.Must, linuxProcessRef)
-	register(LinuxProcOomScoreAdjSet, rfc2119.Must, linuxProcessRef)
-	register(LinuxProcOomScoreAdjNotSet, rfc2119.Must, linuxProcessRef)
-	register(PlatformSpecConfOnWindowsSet, rfc2119.Must, platformSpecificConfigurationRef)
-	register(PosixHooksPathAbs, rfc2119.Must, posixPlatformHooksRef)
-	register(PosixHooksTimeoutPositive, rfc2119.Must, posixPlatformHooksRef)
-	register(PosixHooksCalledInOrder, rfc2119.Must, posixPlatformHooksRef)
-	register(PosixHooksStateToStdin, rfc2119.Must, posixPlatformHooksRef)
-	register(PrestartTiming, rfc2119.Must, prestartRef)
-	register(PoststartTiming, rfc2119.Must, poststartRef)
-	register(PoststopTiming, rfc2119.Must, poststopRef)
-	register(AnnotationsKeyValueMap, rfc2119.Must, annotationsRef)
-	register(AnnotationsKeyString, rfc2119.Must, annotationsRef)
-	register(AnnotationsKeyRequired, rfc2119.Must, annotationsRef)
-	register(AnnotationsKeyReversedDomain, rfc2119.Should, annotationsRef)
-	register(AnnotationsKeyReservedNS, rfc2119.Must, annotationsRef)
-	register(AnnotationsKeyIgnoreUnknown, rfc2119.Must, annotationsRef)
-	register(AnnotationsValueString, rfc2119.Must, annotationsRef)
-	register(ExtensibilityIgnoreUnknownProp, rfc2119.Must, extensibilityRef)
-	register(ValidValues, rfc2119.Must, validValuesRef)
-}

vendor/github.com/opencontainers/runtime-tools/specerror/error.go

@@ -1,152 +0,0 @@
-// Package specerror implements runtime-spec-specific tooling for
-// tracking RFC 2119 violations.
-package specerror
-
-import (
-	"fmt"
-
-	"github.com/hashicorp/go-multierror"
-	rfc2119 "github.com/opencontainers/runtime-tools/error"
-)
-
-const referenceTemplate = "https://github.com/opencontainers/runtime-spec/blob/v%s/%s"
-
-// Code represents the spec violation, enumerating both
-// configuration violations and runtime violations.
-type Code int64
-
-const (
-	// NonError represents that an input is not an error
-	NonError Code = 0x1a001 + iota
-	// NonRFCError represents that an error is not a rfc2119 error
-	NonRFCError
-)
-
-type errorTemplate struct {
-	Level     rfc2119.Level
-	Reference func(version string) (reference string, err error)
-}
-
-// Error represents a runtime-spec violation.
-type Error struct {
-	// Err holds the RFC 2119 violation.
-	Err rfc2119.Error
-
-	// Code is a matchable holds a Code
-	Code Code
-}
-
-// LevelErrors represents Errors filtered into fatal and warnings.
-type LevelErrors struct {
-	// Warnings holds Errors that were below a compliance-level threshold.
-	Warnings []*Error
-
-	// Error holds errors that were at or above a compliance-level
-	// threshold, as well as errors that are not Errors.
-	Error *multierror.Error
-}
-
-var ociErrors = map[Code]errorTemplate{}
-
-func register(code Code, level rfc2119.Level, ref func(versiong string) (string, error)) {
-	if _, ok := ociErrors[code]; ok {
-		panic(fmt.Sprintf("should not regist a same code twice: %v", code))
-	}
-
-	ociErrors[code] = errorTemplate{Level: level, Reference: ref}
-}
-
-// Error returns the error message with specification reference.
-func (err *Error) Error() string {
-	return err.Err.Error()
-}
-
-// NewRFCError creates an rfc2119.Error referencing a spec violation.
-//
-// A version string (for the version of the spec that was violated)
-// must be set to get a working URL.
-func NewRFCError(code Code, err error, version string) (*rfc2119.Error, error) {
-	template := ociErrors[code]
-	reference, err2 := template.Reference(version)
-	if err2 != nil {
-		return nil, err2
-	}
-	return &rfc2119.Error{
-		Level:     template.Level,
-		Reference: reference,
-		Err:       err,
-	}, nil
-}
-
-// NewRFCErrorOrPanic creates an rfc2119.Error referencing a spec
-// violation and panics on failure.  This is handy for situations
-// where you can't be bothered to check NewRFCError for failure.
-func NewRFCErrorOrPanic(code Code, err error, version string) *rfc2119.Error {
-	rfcError, err2 := NewRFCError(code, err, version)
-	if err2 != nil {
-		panic(err2.Error())
-	}
-	return rfcError
-}
-
-// NewError creates an Error referencing a spec violation.  The error
-// can be cast to an *Error for extracting structured information
-// about the level of the violation and a reference to the violated
-// spec condition.
-//
-// A version string (for the version of the spec that was violated)
-// must be set to get a working URL.
-func NewError(code Code, err error, version string) error {
-	rfcError, err2 := NewRFCError(code, err, version)
-	if err2 != nil {
-		return err2
-	}
-	return &Error{
-		Err:  *rfcError,
-		Code: code,
-	}
-}
-
-// FindError finds an error from a source error (multiple error) and
-// returns the error code if found.
-// If the source error is nil or empty, return NonError.
-// If the source error is not a multiple error, return NonRFCError.
-func FindError(err error, code Code) Code {
-	if err == nil {
-		return NonError
-	}
-
-	if merr, ok := err.(*multierror.Error); ok {
-		if merr.ErrorOrNil() == nil {
-			return NonError
-		}
-		for _, e := range merr.Errors {
-			if rfcErr, ok := e.(*Error); ok {
-				if rfcErr.Code == code {
-					return code
-				}
-			}
-		}
-	}
-	return NonRFCError
-}
-
-// SplitLevel removes RFC 2119 errors with a level less than 'level'
-// from the source error.  If the source error is not a multierror, it
-// is returned unchanged.
-func SplitLevel(errIn error, level rfc2119.Level) (levelErrors LevelErrors, errOut error) {
-	merr, ok := errIn.(*multierror.Error)
-	if !ok {
-		return levelErrors, errIn
-	}
-	for _, err := range merr.Errors {
-		e, ok := err.(*Error)
-		if ok && e.Err.Level < level {
-			fmt.Println(e)
-			levelErrors.Warnings = append(levelErrors.Warnings, e)
-			continue
-		}
-		levelErrors.Error = multierror.Append(levelErrors.Error, err)
-	}
-	return levelErrors, nil
-}

vendor/github.com/opencontainers/runtime-tools/specerror/runtime-linux.go

@@ -1,23 +0,0 @@
-package specerror
-
-import (
-	"fmt"
-
-	rfc2119 "github.com/opencontainers/runtime-tools/error"
-)
-
-// define error codes
-const (
-	// DefaultRuntimeLinuxSymlinks represents "While creating the container (step 2 in the lifecycle), runtimes MUST create default symlinks if the source file exists after processing `mounts`."
-	DefaultRuntimeLinuxSymlinks Code = 0xf001 + iota
-)
-
-var (
-	devSymbolicLinksRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime-linux.md#dev-symbolic-links"), nil
-	}
-)
-
-func init() {
-	register(DefaultRuntimeLinuxSymlinks, rfc2119.Must, devSymbolicLinksRef)
-}

vendor/github.com/opencontainers/runtime-tools/specerror/runtime.go

@@ -1,179 +0,0 @@
-package specerror
-
-import (
-	"fmt"
-
-	rfc2119 "github.com/opencontainers/runtime-tools/error"
-)
-
-// define error codes
-const (
-	// EntityOperSameContainer represents "The entity using a runtime to create a container MUST be able to use the operations defined in this specification against that same container."
-	EntityOperSameContainer Code = 0xe001 + iota
-	// StateIDUniq represents "`id` (string, REQUIRED) is the container's ID. This MUST be unique across all containers on this host."
-	StateIDUniq
-	// StateNewStatus represents "Additional values MAY be defined by the runtime, however, they MUST be used to represent new runtime states not defined above."
-	StateNewStatus
-	// DefaultStateJSONPattern represents "When serialized in JSON, the format MUST adhere to the default pattern."
-	DefaultStateJSONPattern
-	// EnvCreateImplement represents "The container's runtime environment MUST be created according to the configuration in `config.json`."
-	EnvCreateImplement
-	// EnvCreateError represents "If the runtime is unable to create the environment specified in the `config.json`, it MUST generate an error."
-	EnvCreateError
-	// ProcNotRunAtResRequest represents "While the resources requested in the `config.json` MUST be created, the user-specified program (from `process`) MUST NOT be run at this time."
-	ProcNotRunAtResRequest
-	// ConfigUpdatesWithoutAffect represents "Any updates to `config.json` after this step MUST NOT affect the container."
-	ConfigUpdatesWithoutAffect
-	// PrestartHooksInvoke represents "The prestart hooks MUST be invoked by the runtime."
-	PrestartHooksInvoke
-	// PrestartHookFailGenError represents "If any prestart hook fails, the runtime MUST generate an error, stop the container, and continue the lifecycle at step 9."
-	PrestartHookFailGenError
-	// ProcImplement represents "The runtime MUST run the user-specified program, as specified by `process`."
-	ProcImplement
-	// PoststartHooksInvoke represents "The poststart hooks MUST be invoked by the runtime."
-	PoststartHooksInvoke
-	// PoststartHookFailGenWarn represents "If any poststart hook fails, the runtime MUST log a warning, but the remaining hooks and lifecycle continue as if the hook had succeeded."
-	PoststartHookFailGenWarn
-	// UndoCreateSteps represents "The container MUST be destroyed by undoing the steps performed during create phase (step 2)."
-	UndoCreateSteps
-	// PoststopHooksInvoke represents "The poststop hooks MUST be invoked by the runtime."
-	PoststopHooksInvoke
-	// PoststopHookFailGenWarn represents "If any poststop hook fails, the runtime MUST log a warning, but the remaining hooks and lifecycle continue as if the hook had succeeded."
-	PoststopHookFailGenWarn
-	// ErrorsLeaveStateUnchange represents "Unless otherwise stated, generating an error MUST leave the state of the environment as if the operation were never attempted - modulo any possible trivial ancillary changes such as logging."
-	ErrorsLeaveStateUnchange
-	// WarnsLeaveFlowUnchange represents "Unless otherwise stated, logging a warning does not change the flow of the operation; it MUST continue as if the warning had not been logged."
-	WarnsLeaveFlowUnchange
-	// DefaultOperations represents "Unless otherwise stated, runtimes MUST support the default operations."
-	DefaultOperations
-	// QueryWithoutIDGenError represents "This operation MUST generate an error if it is not provided the ID of a container."
-	QueryWithoutIDGenError
-	// QueryNonExistGenError represents "Attempting to query a container that does not exist MUST generate an error."
-	QueryNonExistGenError
-	// QueryStateImplement represents "This operation MUST return the state of a container as specified in the State section."
-	QueryStateImplement
-	// CreateWithBundlePathAndID represents "This operation MUST generate an error if it is not provided a path to the bundle and the container ID to associate with the container."
-	CreateWithBundlePathAndID
-	// CreateWithUniqueID represents "If the ID provided is not unique across all containers within the scope of the runtime, or is not valid in any other way, the implementation MUST generate an error and a new container MUST NOT be created."
-	CreateWithUniqueID
-	// CreateNewContainer represents "This operation MUST create a new container."
-	CreateNewContainer
-	// PropsApplyExceptProcOnCreate represents "All of the properties configured in `config.json` except for `process` MUST be applied."
-	PropsApplyExceptProcOnCreate
-	// ProcArgsApplyUntilStart represents `process.args` MUST NOT be applied until triggered by the `start` operation."
-	ProcArgsApplyUntilStart
-	// PropApplyFailGenError represents "If the runtime cannot apply a property as specified in the configuration, it MUST generate an error."
-	PropApplyFailGenError
-	// PropApplyFailNotCreate represents "If the runtime cannot apply a property as specified in the configuration, a new container MUST NOT be created."
-	PropApplyFailNotCreate
-	// StartWithoutIDGenError represents "`start` operation MUST generate an error if it is not provided the container ID."
-	StartWithoutIDGenError
-	// StartNotCreatedHaveNoEffect represents "Attempting to `start` a container that is not `created` MUST have no effect on the container."
-	StartNotCreatedHaveNoEffect
-	// StartNotCreatedGenError represents "Attempting to `start` a container that is not `created` MUST generate an error."
-	StartNotCreatedGenError
-	// StartProcImplement represents "`start` operation MUST run the user-specified program as specified by `process`."
-	StartProcImplement
-	// StartWithProcUnsetGenError represents "`start` operation MUST generate an error if `process` was not set."
-	StartWithProcUnsetGenError
-	// KillWithoutIDGenError represents "`kill` operation MUST generate an error if it is not provided the container ID."
-	KillWithoutIDGenError
-	// KillNonCreateRunHaveNoEffect represents "Attempting to send a signal to a container that is neither `created` nor `running` MUST have no effect on the container."
-	KillNonCreateRunHaveNoEffect
-	// KillNonCreateRunGenError represents "Attempting to send a signal to a container that is neither `created` nor `running` MUST generate an error."
-	KillNonCreateRunGenError
-	// KillSignalImplement represents "`kill` operation MUST send the specified signal to the container process."
-	KillSignalImplement
-	// DeleteWithoutIDGenError represents "`delete` operation MUST generate an error if it is not provided the container ID."
-	DeleteWithoutIDGenError
-	// DeleteNonStopHaveNoEffect represents "Attempting to `delete` a container that is not `stopped` MUST have no effect on the container."
-	DeleteNonStopHaveNoEffect
-	// DeleteNonStopGenError represents "Attempting to `delete` a container that is not `stopped` MUST generate an error."
-	DeleteNonStopGenError
-	// DeleteResImplement represents "Deleting a container MUST delete the resources that were created during the `create` step."
-	DeleteResImplement
-	// DeleteOnlyCreatedRes represents "Note that resources associated with the container, but not created by this container, MUST NOT be deleted."
-	DeleteOnlyCreatedRes
-)
-
-var (
-	scopeOfAContainerRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#scope-of-a-container"), nil
-	}
-	stateRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#state"), nil
-	}
-	lifecycleRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#lifecycle"), nil
-	}
-	errorsRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#errors"), nil
-	}
-	warningsRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#warnings"), nil
-	}
-	operationsRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#operations"), nil
-	}
-	queryStateRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#query-state"), nil
-	}
-	createRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#create"), nil
-	}
-	startRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#start"), nil
-	}
-	killRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#kill"), nil
-	}
-	deleteRef = func(version string) (reference string, err error) {
-		return fmt.Sprintf(referenceTemplate, version, "runtime.md#delete"), nil
-	}
-)
-
-func init() {
-	register(EntityOperSameContainer, rfc2119.Must, scopeOfAContainerRef)
-	register(StateIDUniq, rfc2119.Must, stateRef)
-	register(StateNewStatus, rfc2119.Must, stateRef)
-	register(DefaultStateJSONPattern, rfc2119.Must, stateRef)
-	register(EnvCreateImplement, rfc2119.Must, lifecycleRef)
-	register(EnvCreateError, rfc2119.Must, lifecycleRef)
-	register(ProcNotRunAtResRequest, rfc2119.Must, lifecycleRef)
-	register(ConfigUpdatesWithoutAffect, rfc2119.Must, lifecycleRef)
-	register(PrestartHooksInvoke, rfc2119.Must, lifecycleRef)
-	register(PrestartHookFailGenError, rfc2119.Must, lifecycleRef)
-	register(ProcImplement, rfc2119.Must, lifecycleRef)
-	register(PoststartHooksInvoke, rfc2119.Must, lifecycleRef)
-	register(PoststartHookFailGenWarn, rfc2119.Must, lifecycleRef)
-	register(UndoCreateSteps, rfc2119.Must, lifecycleRef)
-	register(PoststopHooksInvoke, rfc2119.Must, lifecycleRef)
-	register(PoststopHookFailGenWarn, rfc2119.Must, lifecycleRef)
-	register(ErrorsLeaveStateUnchange, rfc2119.Must, errorsRef)
-	register(WarnsLeaveFlowUnchange, rfc2119.Must, warningsRef)
-	register(DefaultOperations, rfc2119.Must, operationsRef)
-	register(QueryWithoutIDGenError, rfc2119.Must, queryStateRef)
-	register(QueryNonExistGenError, rfc2119.Must, queryStateRef)
-	register(QueryStateImplement, rfc2119.Must, queryStateRef)
-	register(CreateWithBundlePathAndID, rfc2119.Must, createRef)
-	register(CreateWithUniqueID, rfc2119.Must, createRef)
-	register(CreateNewContainer, rfc2119.Must, createRef)
-	register(PropsApplyExceptProcOnCreate, rfc2119.Must, createRef)
-	register(ProcArgsApplyUntilStart, rfc2119.Must, createRef)
-	register(PropApplyFailGenError, rfc2119.Must, createRef)
-	register(PropApplyFailNotCreate, rfc2119.Must, createRef)
-	register(StartWithoutIDGenError, rfc2119.Must, startRef)
-	register(StartNotCreatedHaveNoEffect, rfc2119.Must, startRef)
-	register(StartNotCreatedGenError, rfc2119.Must, startRef)
-	register(StartProcImplement, rfc2119.Must, startRef)
-	register(StartWithProcUnsetGenError, rfc2119.Must, startRef)
-	register(KillWithoutIDGenError, rfc2119.Must, killRef)
-	register(KillNonCreateRunHaveNoEffect, rfc2119.Must, killRef)
-	register(KillNonCreateRunGenError, rfc2119.Must, killRef)
-	register(KillSignalImplement, rfc2119.Must, killRef)
-	register(DeleteWithoutIDGenError, rfc2119.Must, deleteRef)
-	register(DeleteNonStopHaveNoEffect, rfc2119.Must, deleteRef)
-	register(DeleteNonStopGenError, rfc2119.Must, deleteRef)
-	register(DeleteResImplement, rfc2119.Must, deleteRef)
-	register(DeleteOnlyCreatedRes, rfc2119.Must, deleteRef)
-}

vendor/github.com/opencontainers/runtime-tools/validate/capabilities/validate.go

@@ -0,0 +1,31 @@
+package capabilities
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/syndtr/gocapability/capability"
+)
+
+// CapValid checks whether a capability is valid
+func CapValid(c string, hostSpecific bool) error {
+	isValid := false
+
+	if !strings.HasPrefix(c, "CAP_") {
+		return fmt.Errorf("capability %s must start with CAP_", c)
+	}
+	for _, cap := range capability.List() {
+		if c == fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())) {
+			if hostSpecific && cap > LastCap() {
+				return fmt.Errorf("%s is not supported on the current host", c)
+			}
+			isValid = true
+			break
+		}
+	}
+
+	if !isValid {
+		return fmt.Errorf("invalid capability: %s", c)
+	}
+	return nil
+}

vendor/github.com/opencontainers/runtime-tools/validate/capabilities/validate_linux.go

@@ -0,0 +1,16 @@
+package capabilities
+
+import (
+	"github.com/syndtr/gocapability/capability"
+)
+
+// LastCap return last cap of system
+func LastCap() capability.Cap {
+	last := capability.CAP_LAST_CAP
+	// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap
+	if last == capability.Cap(63) {
+		last = capability.CAP_BLOCK_SUSPEND
+	}
+
+	return last
+}

vendor/github.com/opencontainers/runtime-tools/validate/capabilities/validate_unsupported.go

@@ -1,7 +1,7 @@
 //go:build !linux
 // +build !linux
 
-package validate
+package capabilities
 
 import (
 	"github.com/syndtr/gocapability/capability"
@@ -11,8 +11,3 @@ import (
 func LastCap() capability.Cap {
 	return capability.Cap(-1)
 }
-
-// CheckLinux is a noop on this platform
-func (v *Validator) CheckLinux() (errs error) {
-	return nil
-}

vendor/github.com/opencontainers/runtime-tools/validate/validate.go

@@ -1,837 +0,0 @@
-package validate
-
-import (
-	"bufio"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"net"
-	"os"
-	"path/filepath"
-	"reflect"
-	"regexp"
-	"runtime"
-	"strings"
-	"unicode"
-	"unicode/utf8"
-
-	"github.com/blang/semver"
-	"github.com/hashicorp/go-multierror"
-	rspec "github.com/opencontainers/runtime-spec/specs-go"
-	osFilepath "github.com/opencontainers/runtime-tools/filepath"
-	"github.com/sirupsen/logrus"
-	"github.com/syndtr/gocapability/capability"
-
-	"github.com/opencontainers/runtime-tools/specerror"
-	"github.com/xeipuuv/gojsonschema"
-)
-
-const specConfig = "config.json"
-
-var (
-	// http://pubs.opengroup.org/onlinepubs/9699919799/functions/getrlimit.html
-	posixRlimits = []string{
-		"RLIMIT_AS",
-		"RLIMIT_CORE",
-		"RLIMIT_CPU",
-		"RLIMIT_DATA",
-		"RLIMIT_FSIZE",
-		"RLIMIT_NOFILE",
-		"RLIMIT_STACK",
-	}
-
-	// https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man2/getrlimit.2?h=man-pages-4.13
-	linuxRlimits = append(posixRlimits, []string{
-		"RLIMIT_MEMLOCK",
-		"RLIMIT_MSGQUEUE",
-		"RLIMIT_NICE",
-		"RLIMIT_NPROC",
-		"RLIMIT_RSS",
-		"RLIMIT_RTPRIO",
-		"RLIMIT_RTTIME",
-		"RLIMIT_SIGPENDING",
-	}...)
-
-	configSchemaTemplate = "https://raw.githubusercontent.com/opencontainers/runtime-spec/v%s/schema/config-schema.json"
-)
-
-// Validator represents a validator for runtime bundle
-type Validator struct {
-	spec         *rspec.Spec
-	bundlePath   string
-	HostSpecific bool
-	platform     string
-}
-
-// NewValidator creates a Validator
-func NewValidator(spec *rspec.Spec, bundlePath string, hostSpecific bool, platform string) (Validator, error) {
-	if hostSpecific && platform != runtime.GOOS {
-		return Validator{}, fmt.Errorf("When hostSpecific is set, platform must be same as the host platform")
-	}
-	return Validator{
-		spec:         spec,
-		bundlePath:   bundlePath,
-		HostSpecific: hostSpecific,
-		platform:     platform,
-	}, nil
-}
-
-// NewValidatorFromPath creates a Validator with specified bundle path
-func NewValidatorFromPath(bundlePath string, hostSpecific bool, platform string) (Validator, error) {
-	if bundlePath == "" {
-		return Validator{}, fmt.Errorf("bundle path shouldn't be empty")
-	}
-
-	if _, err := os.Stat(bundlePath); err != nil {
-		return Validator{}, err
-	}
-
-	configPath := filepath.Join(bundlePath, specConfig)
-	content, err := ioutil.ReadFile(configPath)
-	if err != nil {
-		return Validator{}, specerror.NewError(specerror.ConfigInRootBundleDir, err, rspec.Version)
-	}
-	if !utf8.Valid(content) {
-		return Validator{}, fmt.Errorf("%q is not encoded in UTF-8", configPath)
-	}
-	var spec rspec.Spec
-	if err = json.Unmarshal(content, &spec); err != nil {
-		return Validator{}, err
-	}
-
-	return NewValidator(&spec, bundlePath, hostSpecific, platform)
-}
-
-// CheckAll checks all parts of runtime bundle
-func (v *Validator) CheckAll() error {
-	var errs *multierror.Error
-	errs = multierror.Append(errs, v.CheckJSONSchema())
-	errs = multierror.Append(errs, v.CheckPlatform())
-	errs = multierror.Append(errs, v.CheckRoot())
-	errs = multierror.Append(errs, v.CheckMandatoryFields())
-	errs = multierror.Append(errs, v.CheckSemVer())
-	errs = multierror.Append(errs, v.CheckMounts())
-	errs = multierror.Append(errs, v.CheckProcess())
-	errs = multierror.Append(errs, v.CheckLinux())
-	errs = multierror.Append(errs, v.CheckAnnotations())
-	if v.platform == "linux" || v.platform == "solaris" {
-		errs = multierror.Append(errs, v.CheckHooks())
-	}
-
-	return errs.ErrorOrNil()
-}
-
-// JSONSchemaURL returns the URL for the JSON Schema specifying the
-// configuration format.  It consumes configSchemaTemplate, but we
-// provide it as a function to isolate consumers from inconsistent
-// naming as runtime-spec evolves.
-func JSONSchemaURL(version string) (url string, err error) {
-	ver, err := semver.Parse(version)
-	if err != nil {
-		return "", specerror.NewError(specerror.SpecVersionInSemVer, err, rspec.Version)
-	}
-	if ver.LT(semver.Version{Major: 1, Minor: 0, Patch: 2}) {
-		return "", errors.New("unsupported configuration version (older than 1.0.2)")
-	}
-	return fmt.Sprintf(configSchemaTemplate, version), nil
-}
-
-// CheckJSONSchema validates the configuration against the
-// runtime-spec JSON Schema, using the version of the schema that
-// matches the configuration's declared version.
-func (v *Validator) CheckJSONSchema() (errs error) {
-	logrus.Debugf("check JSON schema")
-
-	url, err := JSONSchemaURL(strings.TrimSuffix(v.spec.Version, "-dev"))
-	if err != nil {
-		errs = multierror.Append(errs, err)
-		return errs
-	}
-
-	schemaLoader := gojsonschema.NewReferenceLoader(url)
-	documentLoader := gojsonschema.NewGoLoader(v.spec)
-	result, err := gojsonschema.Validate(schemaLoader, documentLoader)
-	if err != nil {
-		errs = multierror.Append(errs, err)
-		return errs
-	}
-
-	if !result.Valid() {
-		for _, resultError := range result.Errors() {
-			errs = multierror.Append(errs, errors.New(resultError.String()))
-		}
-	}
-
-	return errs
-}
-
-// CheckRoot checks status of v.spec.Root
-func (v *Validator) CheckRoot() (errs error) {
-	logrus.Debugf("check root")
-
-	if v.platform == "windows" && v.spec.Windows != nil {
-		if v.spec.Windows.HyperV != nil {
-			if v.spec.Root != nil {
-				errs = multierror.Append(errs,
-					specerror.NewError(specerror.RootOnHyperVNotSet, fmt.Errorf("for Hyper-V containers, Root must not be set"), rspec.Version))
-			}
-			return
-		} else if v.spec.Root == nil {
-			errs = multierror.Append(errs,
-				specerror.NewError(specerror.RootOnWindowsRequired, fmt.Errorf("on Windows, for Windows Server Containers, this field is REQUIRED"), rspec.Version))
-			return
-		}
-	} else if v.platform != "windows" && v.spec.Root == nil {
-		errs = multierror.Append(errs,
-			specerror.NewError(specerror.RootOnNonWindowsRequired, fmt.Errorf("on all other platforms, this field is REQUIRED"), rspec.Version))
-		return
-	}
-
-	if v.platform == "windows" {
-		matched, err := regexp.MatchString(`\\\\[?]\\Volume[{][a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}[}]\\`, v.spec.Root.Path)
-		if err != nil {
-			errs = multierror.Append(errs, err)
-		} else if !matched {
-			errs = multierror.Append(errs,
-				specerror.NewError(specerror.RootPathOnWindowsGUID, fmt.Errorf("root.path is %q, but it MUST be a volume GUID path when target platform is windows", v.spec.Root.Path), rspec.Version))
-		}
-
-		if v.spec.Root.Readonly {
-			errs = multierror.Append(errs,
-				specerror.NewError(specerror.RootReadonlyOnWindowsFalse, fmt.Errorf("root.readonly field MUST be omitted or false when target platform is windows"), rspec.Version))
-		}
-
-		return
-	}
-
-	absBundlePath, err := filepath.Abs(v.bundlePath)
-	if err != nil {
-		errs = multierror.Append(errs, fmt.Errorf("unable to convert %q to an absolute path", v.bundlePath))
-		return
-	}
-
-	if filepath.Base(v.spec.Root.Path) != "rootfs" {
-		errs = multierror.Append(errs,
-			specerror.NewError(specerror.RootPathOnPosixConvention, fmt.Errorf("path name should be the conventional 'rootfs'"), rspec.Version))
-	}
-
-	var rootfsPath string
-	var absRootPath string
-	if filepath.IsAbs(v.spec.Root.Path) {
-		rootfsPath = v.spec.Root.Path
-		absRootPath = filepath.Clean(rootfsPath)
-	} else {
-		var err error
-		rootfsPath = filepath.Join(v.bundlePath, v.spec.Root.Path)
-		absRootPath, err = filepath.Abs(rootfsPath)
-		if err != nil {
-			errs = multierror.Append(errs, fmt.Errorf("unable to convert %q to an absolute path", rootfsPath))
-			return
-		}
-	}
-
-	if fi, err := os.Stat(rootfsPath); err != nil {
-		errs = multierror.Append(errs,
-			specerror.NewError(specerror.RootPathExist, fmt.Errorf("cannot find the root path %q", rootfsPath), rspec.Version))
-	} else if !fi.IsDir() {
-		errs = multierror.Append(errs,
-			specerror.NewError(specerror.RootPathExist, fmt.Errorf("root.path %q is not a directory", rootfsPath), rspec.Version))
-	}
-
-	rootParent := filepath.Dir(absRootPath)
-	if absRootPath == string(filepath.Separator) || rootParent != absBundlePath {
-		errs = multierror.Append(errs,
-			specerror.NewError(specerror.ArtifactsInSingleDir, fmt.Errorf("root.path is %q, but it MUST be a child of %q", v.spec.Root.Path, absBundlePath), rspec.Version))
-	}
-
-	return
-}
-
-// CheckSemVer checks v.spec.Version
-func (v *Validator) CheckSemVer() (errs error) {
-	logrus.Debugf("check semver")
-
-	version := v.spec.Version
-	_, err := semver.Parse(version)
-	if err != nil {
-		errs = multierror.Append(errs,
-			specerror.NewError(specerror.SpecVersionInSemVer, fmt.Errorf("%q is not valid SemVer: %s", version, err.Error()), rspec.Version))
-	}
-	if version != rspec.Version {
-		errs = multierror.Append(errs, fmt.Errorf("validate currently only handles version %s, but the supplied configuration targets %s", rspec.Version, version))
-	}
-
-	return
-}
-
-// CheckHooks check v.spec.Hooks
-func (v *Validator) CheckHooks() (errs error) {
-	logrus.Debugf("check hooks")
-
-	if v.platform != "linux" && v.platform != "solaris" {
-		errs = multierror.Append(errs, fmt.Errorf("For %q platform, the configuration structure does not support hooks", v.platform))
-		return
-	}
-
-	if v.spec.Hooks != nil {
-		errs = multierror.Append(errs, v.checkEventHooks("prestart", v.spec.Hooks.Prestart, v.HostSpecific))
-		errs = multierror.Append(errs, v.checkEventHooks("poststart", v.spec.Hooks.Poststart, v.HostSpecific))
-		errs = multierror.Append(errs, v.checkEventHooks("poststop", v.spec.Hooks.Poststop, v.HostSpecific))
-	}
-
-	return
-}
-
-func (v *Validator) checkEventHooks(hookType string, hooks []rspec.Hook, hostSpecific bool) (errs error) {
-	for i, hook := range hooks {
-		if !osFilepath.IsAbs(v.platform, hook.Path) {
-			errs = multierror.Append(errs,
-				specerror.NewError(
-					specerror.PosixHooksPathAbs,
-					fmt.Errorf("hooks.%s[%d].path %v: is not absolute path",
-						hookType, i, hook.Path),
-					rspec.Version))
-		}
-
-		if hostSpecific {
-			fi, err := os.Stat(hook.Path)
-			if err != nil {
-				errs = multierror.Append(errs, fmt.Errorf("cannot find %s hook: %v", hookType, hook.Path))
-			}
-			if fi.Mode()&0111 == 0 {
-				errs = multierror.Append(errs, fmt.Errorf("the %s hook %v: is not executable", hookType, hook.Path))
-			}
-		}
-
-		for _, env := range hook.Env {
-			if !envValid(env) {
-				errs = multierror.Append(errs, fmt.Errorf("env %q for hook %v is in the invalid form", env, hook.Path))
-			}
-		}
-	}
-
-	return
-}
-
-// CheckProcess checks v.spec.Process
-func (v *Validator) CheckProcess() (errs error) {
-	logrus.Debugf("check process")
-
-	if v.spec.Process == nil {
-		return
-	}
-
-	process := v.spec.Process
-	if !osFilepath.IsAbs(v.platform, process.Cwd) {
-		errs = multierror.Append(errs,
-			specerror.NewError(
-				specerror.ProcCwdAbs,
-				fmt.Errorf("cwd %q is not an absolute path", process.Cwd),
-				rspec.Version))
-	}
-
-	for _, env := range process.Env {
-		if !envValid(env) {
-			errs = multierror.Append(errs, fmt.Errorf("env %q should be in the form of 'key=value'. The left hand side must consist solely of letters, digits, and underscores '_'", env))
-		}
-	}
-
-	if len(process.Args) == 0 {
-		errs = multierror.Append(errs,
-			specerror.NewError(
-				specerror.ProcArgsOneEntryRequired,
-				fmt.Errorf("args must not be empty"),
-				rspec.Version))
-	} else {
-		if filepath.IsAbs(process.Args[0]) && v.spec.Root != nil {
-			var rootfsPath string
-			if filepath.IsAbs(v.spec.Root.Path) {
-				rootfsPath = v.spec.Root.Path
-			} else {
-				rootfsPath = filepath.Join(v.bundlePath, v.spec.Root.Path)
-			}
-			absPath := filepath.Join(rootfsPath, process.Args[0])
-			fileinfo, err := os.Stat(absPath)
-			if os.IsNotExist(err) {
-				logrus.Warnf("executable %q is not available in rootfs currently", process.Args[0])
-			} else if err != nil {
-				errs = multierror.Append(errs, err)
-			} else {
-				m := fileinfo.Mode()
-				if m.IsDir() || m&0111 == 0 {
-					errs = multierror.Append(errs, fmt.Errorf("arg %q is not executable", process.Args[0]))
-				}
-			}
-		}
-	}
-
-	if v.platform == "linux" || v.platform == "solaris" {
-		errs = multierror.Append(errs, v.CheckRlimits())
-	}
-
-	if v.platform == "linux" {
-		if v.spec.Process.Capabilities != nil {
-			errs = multierror.Append(errs, v.CheckCapabilities())
-		}
-
-		if len(process.ApparmorProfile) > 0 {
-			profilePath := filepath.Join(v.bundlePath, v.spec.Root.Path, "/etc/apparmor.d", process.ApparmorProfile)
-			_, err := os.Stat(profilePath)
-			if err != nil {
-				errs = multierror.Append(errs, err)
-			}
-		}
-	}
-
-	return
-}
-
-// CheckCapabilities checks v.spec.Process.Capabilities
-func (v *Validator) CheckCapabilities() (errs error) {
-	if v.platform != "linux" {
-		errs = multierror.Append(errs, fmt.Errorf("For %q platform, the configuration structure does not support process.capabilities", v.platform))
-		return
-	}
-
-	process := v.spec.Process
-	var effective, permitted, inheritable, ambient bool
-	caps := make(map[string][]string)
-
-	for _, cap := range process.Capabilities.Bounding {
-		caps[cap] = append(caps[cap], "bounding")
-	}
-	for _, cap := range process.Capabilities.Effective {
-		caps[cap] = append(caps[cap], "effective")
-	}
-	for _, cap := range process.Capabilities.Inheritable {
-		caps[cap] = append(caps[cap], "inheritable")
-	}
-	for _, cap := range process.Capabilities.Permitted {
-		caps[cap] = append(caps[cap], "permitted")
-	}
-	for _, cap := range process.Capabilities.Ambient {
-		caps[cap] = append(caps[cap], "ambient")
-	}
-
-	for capability, owns := range caps {
-		if err := CapValid(capability, v.HostSpecific); err != nil {
-			errs = multierror.Append(errs, fmt.Errorf("capability %q is not valid, man capabilities(7)", capability))
-		}
-
-		effective, permitted, ambient, inheritable = false, false, false, false
-		for _, set := range owns {
-			if set == "effective" {
-				effective = true
-				continue
-			}
-			if set == "inheritable" {
-				inheritable = true
-				continue
-			}
-			if set == "permitted" {
-				permitted = true
-				continue
-			}
-			if set == "ambient" {
-				ambient = true
-				continue
-			}
-		}
-		if effective && !permitted {
-			errs = multierror.Append(errs, fmt.Errorf("effective capability %q is not allowed, as it's not permitted", capability))
-		}
-		if ambient && !(permitted && inheritable) {
-			errs = multierror.Append(errs, fmt.Errorf("ambient capability %q is not allowed, as it's not permitted and inheribate", capability))
-		}
-	}
-
-	return
-}
-
-// CheckRlimits checks v.spec.Process.Rlimits
-func (v *Validator) CheckRlimits() (errs error) {
-	if v.platform != "linux" && v.platform != "solaris" {
-		errs = multierror.Append(errs, fmt.Errorf("For %q platform, the configuration structure does not support process.rlimits", v.platform))
-		return
-	}
-
-	process := v.spec.Process
-	for index, rlimit := range process.Rlimits {
-		for i := index + 1; i < len(process.Rlimits); i++ {
-			if process.Rlimits[index].Type == process.Rlimits[i].Type {
-				errs = multierror.Append(errs,
-					specerror.NewError(
-						specerror.PosixProcRlimitsErrorOnDup,
-						fmt.Errorf("rlimit can not contain the same type %q",
-							process.Rlimits[index].Type),
-						rspec.Version))
-			}
-		}
-		errs = multierror.Append(errs, v.rlimitValid(rlimit))
-	}
-
-	return
-}
-
-func supportedMountTypes(OS string, hostSpecific bool) (map[string]bool, error) {
-	supportedTypes := make(map[string]bool)
-
-	if OS != "linux" && OS != "windows" {
-		logrus.Warnf("%v is not supported to check mount type", OS)
-		return nil, nil
-	} else if OS == "windows" {
-		supportedTypes["ntfs"] = true
-		return supportedTypes, nil
-	}
-
-	if hostSpecific {
-		f, err := os.Open("/proc/filesystems")
-		if err != nil {
-			return nil, err
-		}
-		defer f.Close()
-
-		s := bufio.NewScanner(f)
-		for s.Scan() {
-			if err := s.Err(); err != nil {
-				return supportedTypes, err
-			}
-
-			text := s.Text()
-			parts := strings.Split(text, "\t")
-			if len(parts) > 1 {
-				supportedTypes[parts[1]] = true
-			} else {
-				supportedTypes[parts[0]] = true
-			}
-		}
-
-		supportedTypes["bind"] = true
-
-		return supportedTypes, nil
-	}
-	logrus.Warn("Checking linux mount types without --host-specific is not supported yet")
-	return nil, nil
-}
-
-// CheckMounts checks v.spec.Mounts
-func (v *Validator) CheckMounts() (errs error) {
-	logrus.Debugf("check mounts")
-
-	supportedTypes, err := supportedMountTypes(v.platform, v.HostSpecific)
-	if err != nil {
-		errs = multierror.Append(errs, err)
-		return
-	}
-
-	for i, mountA := range v.spec.Mounts {
-		if supportedTypes != nil && !supportedTypes[mountA.Type] {
-			errs = multierror.Append(errs, fmt.Errorf("unsupported mount type %q", mountA.Type))
-		}
-		if !osFilepath.IsAbs(v.platform, mountA.Destination) {
-			errs = multierror.Append(errs,
-				specerror.NewError(
-					specerror.MountsDestAbs,
-					fmt.Errorf("mounts[%d].destination %q is not absolute",
-						i,
-						mountA.Destination),
-					rspec.Version))
-		}
-		for j, mountB := range v.spec.Mounts {
-			if i == j {
-				continue
-			}
-			// whether B.Desination is nested within A.Destination
-			nested, err := osFilepath.IsAncestor(v.platform, mountA.Destination, mountB.Destination, ".")
-			if err != nil {
-				errs = multierror.Append(errs, err)
-				continue
-			}
-			if nested {
-				if v.platform == "windows" && i < j {
-					errs = multierror.Append(errs,
-						specerror.NewError(
-							specerror.MountsDestOnWindowsNotNested,
-							fmt.Errorf("on Windows, %v nested within %v is forbidden",
-								mountB.Destination, mountA.Destination),
-							rspec.Version))
-				}
-				if i > j {
-					logrus.Warnf("%v will be covered by %v", mountB.Destination, mountA.Destination)
-				}
-			}
-		}
-	}
-
-	return
-}
-
-// CheckPlatform checks v.platform
-func (v *Validator) CheckPlatform() (errs error) {
-	logrus.Debugf("check platform")
-
-	if v.platform != "linux" && v.platform != "solaris" && v.platform != "windows" {
-		errs = multierror.Append(errs, fmt.Errorf("platform %q is not supported", v.platform))
-		return
-	}
-
-	if v.HostSpecific && v.platform != runtime.GOOS {
-		errs = multierror.Append(errs, fmt.Errorf("platform %q differs from the host %q, skipping host-specific checks", v.platform, runtime.GOOS))
-		v.HostSpecific = false
-	}
-
-	if v.platform == "windows" {
-		if v.spec.Windows == nil {
-			errs = multierror.Append(errs,
-				specerror.NewError(
-					specerror.PlatformSpecConfOnWindowsSet,
-					fmt.Errorf("'windows' MUST be set when platform is `windows`"),
-					rspec.Version))
-		}
-	}
-
-	return
-}
-
-// CheckLinuxResources checks v.spec.Linux.Resources
-func (v *Validator) CheckLinuxResources() (errs error) {
-	logrus.Debugf("check linux resources")
-
-	r := v.spec.Linux.Resources
-	if r.Memory != nil {
-		if r.Memory.Limit != nil && r.Memory.Swap != nil && uint64(*r.Memory.Limit) > uint64(*r.Memory.Swap) {
-			errs = multierror.Append(errs, fmt.Errorf("minimum memoryswap should be larger than memory limit"))
-		}
-		if r.Memory.Limit != nil && r.Memory.Reservation != nil && uint64(*r.Memory.Reservation) > uint64(*r.Memory.Limit) {
-			errs = multierror.Append(errs, fmt.Errorf("minimum memory limit should be larger than memory reservation"))
-		}
-	}
-	if r.Network != nil && v.HostSpecific {
-		var exist bool
-		interfaces, err := net.Interfaces()
-		if err != nil {
-			errs = multierror.Append(errs, err)
-			return
-		}
-		for _, prio := range r.Network.Priorities {
-			exist = false
-			for _, ni := range interfaces {
-				if prio.Name == ni.Name {
-					exist = true
-					break
-				}
-			}
-			if !exist {
-				errs = multierror.Append(errs, fmt.Errorf("interface %s does not exist currently", prio.Name))
-			}
-		}
-	}
-	for index := 0; index < len(r.Devices); index++ {
-		switch r.Devices[index].Type {
-		case "a", "b", "c", "":
-		default:
-			errs = multierror.Append(errs, fmt.Errorf("type of devices %s is invalid", r.Devices[index].Type))
-		}
-
-		access := []byte(r.Devices[index].Access)
-		for i := 0; i < len(access); i++ {
-			switch access[i] {
-			case 'r', 'w', 'm':
-			default:
-				errs = multierror.Append(errs, fmt.Errorf("access %s is invalid", r.Devices[index].Access))
-				return
-			}
-		}
-	}
-
-	if r.BlockIO != nil && r.BlockIO.WeightDevice != nil {
-		for i, weightDevice := range r.BlockIO.WeightDevice {
-			if weightDevice.Weight == nil && weightDevice.LeafWeight == nil {
-				errs = multierror.Append(errs,
-					specerror.NewError(
-						specerror.BlkIOWeightOrLeafWeightExist,
-						fmt.Errorf("linux.resources.blockIO.weightDevice[%d] specifies neither weight nor leafWeight", i),
-						rspec.Version))
-			}
-		}
-	}
-
-	return
-}
-
-// CheckAnnotations checks v.spec.Annotations
-func (v *Validator) CheckAnnotations() (errs error) {
-	logrus.Debugf("check annotations")
-
-	reversedDomain := regexp.MustCompile(`^[A-Za-z]{2,6}(\.[A-Za-z0-9-]{1,63})+$`)
-	for key := range v.spec.Annotations {
-		if strings.HasPrefix(key, "org.opencontainers") {
-			errs = multierror.Append(errs,
-				specerror.NewError(
-					specerror.AnnotationsKeyReservedNS,
-					fmt.Errorf("key %q is reserved", key),
-					rspec.Version))
-		}
-
-		if !reversedDomain.MatchString(key) {
-			errs = multierror.Append(errs,
-				specerror.NewError(
-					specerror.AnnotationsKeyReversedDomain,
-					fmt.Errorf("key %q SHOULD be named using a reverse domain notation", key),
-					rspec.Version))
-		}
-	}
-
-	return
-}
-
-// CapValid checks whether a capability is valid
-func CapValid(c string, hostSpecific bool) error {
-	isValid := false
-
-	if !strings.HasPrefix(c, "CAP_") {
-		return fmt.Errorf("capability %s must start with CAP_", c)
-	}
-	for _, cap := range capability.List() {
-		if c == fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())) {
-			if hostSpecific && cap > LastCap() {
-				return fmt.Errorf("%s is not supported on the current host", c)
-			}
-			isValid = true
-			break
-		}
-	}
-
-	if !isValid {
-		return fmt.Errorf("invalid capability: %s", c)
-	}
-	return nil
-}
-
-func envValid(env string) bool {
-	items := strings.Split(env, "=")
-	if len(items) < 2 {
-		return false
-	}
-	for i, ch := range strings.TrimSpace(items[0]) {
-		if !unicode.IsDigit(ch) && !unicode.IsLetter(ch) && ch != '_' {
-			return false
-		}
-		if i == 0 && unicode.IsDigit(ch) {
-			logrus.Warnf("Env %v: variable name beginning with digit is not recommended.", env)
-		}
-	}
-	return true
-}
-
-func (v *Validator) rlimitValid(rlimit rspec.POSIXRlimit) (errs error) {
-	if rlimit.Hard < rlimit.Soft {
-		errs = multierror.Append(errs, fmt.Errorf("hard limit of rlimit %s should not be less than soft limit", rlimit.Type))
-	}
-
-	if v.platform == "linux" {
-		for _, val := range linuxRlimits {
-			if val == rlimit.Type {
-				return
-			}
-		}
-		errs = multierror.Append(errs, specerror.NewError(specerror.PosixProcRlimitsTypeValueError, fmt.Errorf("rlimit type %q may not be valid", rlimit.Type), v.spec.Version))
-	} else if v.platform == "solaris" {
-		for _, val := range posixRlimits {
-			if val == rlimit.Type {
-				return
-			}
-		}
-		errs = multierror.Append(errs, specerror.NewError(specerror.PosixProcRlimitsTypeValueError, fmt.Errorf("rlimit type %q may not be valid", rlimit.Type), v.spec.Version))
-	} else {
-		logrus.Warnf("process.rlimits validation not yet implemented for platform %q", v.platform)
-	}
-
-	return
-}
-
-func isStruct(t reflect.Type) bool {
-	return t.Kind() == reflect.Struct
-}
-
-func isStructPtr(t reflect.Type) bool {
-	return t.Kind() == reflect.Ptr && t.Elem().Kind() == reflect.Struct
-}
-
-func checkMandatoryUnit(field reflect.Value, tagField reflect.StructField, parent string) (errs error) {
-	mandatory := !strings.Contains(tagField.Tag.Get("json"), "omitempty")
-	switch field.Kind() {
-	case reflect.Ptr:
-		if mandatory && field.IsNil() {
-			errs = multierror.Append(errs, fmt.Errorf("'%s.%s' should not be empty", parent, tagField.Name))
-		}
-	case reflect.String:
-		if mandatory && (field.Len() == 0) {
-			errs = multierror.Append(errs, fmt.Errorf("'%s.%s' should not be empty", parent, tagField.Name))
-		}
-	case reflect.Slice:
-		if mandatory && (field.IsNil() || field.Len() == 0) {
-			errs = multierror.Append(errs, fmt.Errorf("'%s.%s' should not be empty", parent, tagField.Name))
-			return
-		}
-		for index := 0; index < field.Len(); index++ {
-			mValue := field.Index(index)
-			if mValue.CanInterface() {
-				errs = multierror.Append(errs, checkMandatory(mValue.Interface()))
-			}
-		}
-	case reflect.Map:
-		if mandatory && (field.IsNil() || field.Len() == 0) {
-			errs = multierror.Append(errs, fmt.Errorf("'%s.%s' should not be empty", parent, tagField.Name))
-			return
-		}
-		keys := field.MapKeys()
-		for index := 0; index < len(keys); index++ {
-			mValue := field.MapIndex(keys[index])
-			if mValue.CanInterface() {
-				errs = multierror.Append(errs, checkMandatory(mValue.Interface()))
-			}
-		}
-	default:
-	}
-
-	return
-}
-
-func checkMandatory(obj interface{}) (errs error) {
-	objT := reflect.TypeOf(obj)
-	objV := reflect.ValueOf(obj)
-	if isStructPtr(objT) {
-		objT = objT.Elem()
-		objV = objV.Elem()
-	} else if !isStruct(objT) {
-		return
-	}
-
-	for i := 0; i < objT.NumField(); i++ {
-		t := objT.Field(i).Type
-		if isStructPtr(t) && objV.Field(i).IsNil() {
-			if !strings.Contains(objT.Field(i).Tag.Get("json"), "omitempty") {
-				errs = multierror.Append(errs, fmt.Errorf("'%s.%s' should not be empty", objT.Name(), objT.Field(i).Name))
-			}
-		} else if (isStruct(t) || isStructPtr(t)) && objV.Field(i).CanInterface() {
-			errs = multierror.Append(errs, checkMandatory(objV.Field(i).Interface()))
-		} else {
-			errs = multierror.Append(errs, checkMandatoryUnit(objV.Field(i), objT.Field(i), objT.Name()))
-		}
-
-	}
-	return
-}
-
-// CheckMandatoryFields checks mandatory field of container's config file
-func (v *Validator) CheckMandatoryFields() error {
-	logrus.Debugf("check mandatory fields")
-
-	if v.spec == nil {
-		return fmt.Errorf("Spec can't be nil")
-	}
-
-	return checkMandatory(v.spec)
-}

vendor/github.com/opencontainers/runtime-tools/validate/validate_linux.go

@@ -1,238 +0,0 @@
-//go:build linux
-// +build linux
-
-package validate
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-
-	"github.com/syndtr/gocapability/capability"
-
-	multierror "github.com/hashicorp/go-multierror"
-	rspec "github.com/opencontainers/runtime-spec/specs-go"
-	osFilepath "github.com/opencontainers/runtime-tools/filepath"
-	"github.com/opencontainers/runtime-tools/specerror"
-	"github.com/opencontainers/selinux/go-selinux/label"
-	"github.com/sirupsen/logrus"
-)
-
-// LastCap return last cap of system
-func LastCap() capability.Cap {
-	last := capability.CAP_LAST_CAP
-	// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap
-	if last == capability.Cap(63) {
-		last = capability.CAP_BLOCK_SUSPEND
-	}
-
-	return last
-}
-
-func deviceValid(d rspec.LinuxDevice) bool {
-	switch d.Type {
-	case "b", "c", "u":
-		if d.Major <= 0 || d.Minor <= 0 {
-			return false
-		}
-	case "p":
-		if d.Major != 0 || d.Minor != 0 {
-			return false
-		}
-	default:
-		return false
-	}
-	return true
-}
-
-// CheckLinux checks v.spec.Linux
-func (v *Validator) CheckLinux() (errs error) {
-	logrus.Debugf("check linux")
-
-	if v.spec.Linux == nil {
-		return
-	}
-
-	var nsTypeList = map[rspec.LinuxNamespaceType]struct {
-		num      int
-		newExist bool
-	}{
-		rspec.PIDNamespace:     {0, false},
-		rspec.NetworkNamespace: {0, false},
-		rspec.MountNamespace:   {0, false},
-		rspec.IPCNamespace:     {0, false},
-		rspec.UTSNamespace:     {0, false},
-		rspec.UserNamespace:    {0, false},
-		rspec.CgroupNamespace:  {0, false},
-	}
-
-	for index := 0; index < len(v.spec.Linux.Namespaces); index++ {
-		ns := v.spec.Linux.Namespaces[index]
-		if ns.Path != "" && !osFilepath.IsAbs(v.platform, ns.Path) {
-			errs = multierror.Append(errs, specerror.NewError(specerror.NSPathAbs, fmt.Errorf("namespace.path %q is not an absolute path", ns.Path), rspec.Version))
-		}
-
-		tmpItem := nsTypeList[ns.Type]
-		tmpItem.num = tmpItem.num + 1
-		if tmpItem.num > 1 {
-			errs = multierror.Append(errs, specerror.NewError(specerror.NSErrorOnDup, fmt.Errorf("duplicated namespace %q", ns.Type), rspec.Version))
-		}
-
-		if len(ns.Path) == 0 {
-			tmpItem.newExist = true
-		}
-		nsTypeList[ns.Type] = tmpItem
-	}
-
-	if (len(v.spec.Linux.UIDMappings) > 0 || len(v.spec.Linux.GIDMappings) > 0) && !nsTypeList[rspec.UserNamespace].newExist {
-		errs = multierror.Append(errs, errors.New("the UID/GID mappings requires a new User namespace to be specified as well"))
-	}
-
-	for k := range v.spec.Linux.Sysctl {
-		if strings.HasPrefix(k, "net.") && !nsTypeList[rspec.NetworkNamespace].newExist {
-			errs = multierror.Append(errs, fmt.Errorf("sysctl %v requires a new Network namespace to be specified as well", k))
-		}
-		if strings.HasPrefix(k, "fs.mqueue.") {
-			if !nsTypeList[rspec.MountNamespace].newExist || !nsTypeList[rspec.IPCNamespace].newExist {
-				errs = multierror.Append(errs, fmt.Errorf("sysctl %v requires a new IPC namespace and Mount namespace to be specified as well", k))
-			}
-		}
-	}
-
-	if v.platform == "linux" && !nsTypeList[rspec.UTSNamespace].newExist && v.spec.Hostname != "" {
-		errs = multierror.Append(errs, fmt.Errorf("on Linux, hostname requires a new UTS namespace to be specified as well"))
-	}
-
-	// Linux devices validation
-	devList := make(map[string]bool)
-	devTypeList := make(map[string]bool)
-	for index := 0; index < len(v.spec.Linux.Devices); index++ {
-		device := v.spec.Linux.Devices[index]
-		if !deviceValid(device) {
-			errs = multierror.Append(errs, fmt.Errorf("device %v is invalid", device))
-		}
-
-		if _, exists := devList[device.Path]; exists {
-			errs = multierror.Append(errs, fmt.Errorf("device %s is duplicated", device.Path))
-		} else {
-			var rootfsPath string
-			if filepath.IsAbs(v.spec.Root.Path) {
-				rootfsPath = v.spec.Root.Path
-			} else {
-				rootfsPath = filepath.Join(v.bundlePath, v.spec.Root.Path)
-			}
-			absPath := filepath.Join(rootfsPath, device.Path)
-			fi, err := os.Stat(absPath)
-			if os.IsNotExist(err) {
-				devList[device.Path] = true
-			} else if err != nil {
-				errs = multierror.Append(errs, err)
-			} else {
-				fStat, ok := fi.Sys().(*syscall.Stat_t)
-				if !ok {
-					errs = multierror.Append(errs, specerror.NewError(specerror.DevicesAvailable,
-						fmt.Errorf("cannot determine state for device %s", device.Path), rspec.Version))
-					continue
-				}
-				var devType string
-				switch fStat.Mode & syscall.S_IFMT {
-				case syscall.S_IFCHR:
-					devType = "c"
-				case syscall.S_IFBLK:
-					devType = "b"
-				case syscall.S_IFIFO:
-					devType = "p"
-				default:
-					devType = "unmatched"
-				}
-				if devType != device.Type || (devType == "c" && device.Type == "u") {
-					errs = multierror.Append(errs, specerror.NewError(specerror.DevicesFileNotMatch,
-						fmt.Errorf("unmatched %s already exists in filesystem", device.Path), rspec.Version))
-					continue
-				}
-				if devType != "p" {
-					dev := fStat.Rdev
-					major := (dev >> 8) & 0xfff
-					minor := (dev & 0xff) | ((dev >> 12) & 0xfff00)
-					if int64(major) != device.Major || int64(minor) != device.Minor {
-						errs = multierror.Append(errs, specerror.NewError(specerror.DevicesFileNotMatch,
-							fmt.Errorf("unmatched %s already exists in filesystem", device.Path), rspec.Version))
-						continue
-					}
-				}
-				if device.FileMode != nil {
-					expectedPerm := *device.FileMode & os.ModePerm
-					actualPerm := fi.Mode() & os.ModePerm
-					if expectedPerm != actualPerm {
-						errs = multierror.Append(errs, specerror.NewError(specerror.DevicesFileNotMatch,
-							fmt.Errorf("unmatched %s already exists in filesystem", device.Path), rspec.Version))
-						continue
-					}
-				}
-				if device.UID != nil {
-					if *device.UID != fStat.Uid {
-						errs = multierror.Append(errs, specerror.NewError(specerror.DevicesFileNotMatch,
-							fmt.Errorf("unmatched %s already exists in filesystem", device.Path), rspec.Version))
-						continue
-					}
-				}
-				if device.GID != nil {
-					if *device.GID != fStat.Gid {
-						errs = multierror.Append(errs, specerror.NewError(specerror.DevicesFileNotMatch,
-							fmt.Errorf("unmatched %s already exists in filesystem", device.Path), rspec.Version))
-						continue
-					}
-				}
-			}
-		}
-
-		// unify u->c when comparing, they are synonyms
-		var devID string
-		if device.Type == "u" {
-			devID = fmt.Sprintf("%s:%d:%d", "c", device.Major, device.Minor)
-		} else {
-			devID = fmt.Sprintf("%s:%d:%d", device.Type, device.Major, device.Minor)
-		}
-
-		if _, exists := devTypeList[devID]; exists {
-			logrus.Warnf("%v", specerror.NewError(specerror.DevicesErrorOnDup, fmt.Errorf("type:%s, major:%d and minor:%d for linux devices is duplicated", device.Type, device.Major, device.Minor), rspec.Version))
-		} else {
-			devTypeList[devID] = true
-		}
-	}
-
-	if v.spec.Linux.Resources != nil {
-		errs = multierror.Append(errs, v.CheckLinuxResources())
-	}
-
-	for _, maskedPath := range v.spec.Linux.MaskedPaths {
-		if !strings.HasPrefix(maskedPath, "/") {
-			errs = multierror.Append(errs,
-				specerror.NewError(
-					specerror.MaskedPathsAbs,
-					fmt.Errorf("maskedPath %v is not an absolute path", maskedPath),
-					rspec.Version))
-		}
-	}
-
-	for _, readonlyPath := range v.spec.Linux.ReadonlyPaths {
-		if !strings.HasPrefix(readonlyPath, "/") {
-			errs = multierror.Append(errs,
-				specerror.NewError(
-					specerror.ReadonlyPathsAbs,
-					fmt.Errorf("readonlyPath %v is not an absolute path", readonlyPath),
-					rspec.Version))
-		}
-	}
-
-	if v.spec.Linux.MountLabel != "" {
-		if err := label.Validate(v.spec.Linux.MountLabel); err != nil {
-			errs = multierror.Append(errs, fmt.Errorf("mountLabel %v is invalid", v.spec.Linux.MountLabel))
-		}
-	}
-
-	return
-}

vendor/github.com/opencontainers/selinux/LICENSE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright {yyyy} {name of copyright owner}
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.

vendor/github.com/opencontainers/selinux/go-selinux/doc.go

@@ -1,14 +0,0 @@
-/*
-Package selinux provides a high-level interface for interacting with selinux.
-
-Usage:
-
-	import "github.com/opencontainers/selinux/go-selinux"
-
-	// Ensure that selinux is enforcing mode.
-	if selinux.EnforceMode() != selinux.Enforcing {
-		selinux.SetEnforceMode(selinux.Enforcing)
-	}
-
-*/
-package selinux

vendor/github.com/opencontainers/selinux/go-selinux/label/label.go

@@ -1,97 +0,0 @@
-package label
-
-import (
-	"fmt"
-
-	"github.com/opencontainers/selinux/go-selinux"
-)
-
-// Deprecated: use selinux.ROFileLabel
-var ROMountLabel = selinux.ROFileLabel
-
-// SetProcessLabel takes a process label and tells the kernel to assign the
-// label to the next program executed by the current process.
-// Deprecated: use selinux.SetExecLabel
-var SetProcessLabel = selinux.SetExecLabel
-
-// ProcessLabel returns the process label that the kernel will assign
-// to the next program executed by the current process.  If "" is returned
-// this indicates that the default labeling will happen for the process.
-// Deprecated: use selinux.ExecLabel
-var ProcessLabel = selinux.ExecLabel
-
-// SetSocketLabel takes a process label and tells the kernel to assign the
-// label to the next socket that gets created
-// Deprecated: use selinux.SetSocketLabel
-var SetSocketLabel = selinux.SetSocketLabel
-
-// SocketLabel retrieves the current default socket label setting
-// Deprecated: use selinux.SocketLabel
-var SocketLabel = selinux.SocketLabel
-
-// SetKeyLabel takes a process label and tells the kernel to assign the
-// label to the next kernel keyring that gets created
-// Deprecated: use selinux.SetKeyLabel
-var SetKeyLabel = selinux.SetKeyLabel
-
-// KeyLabel retrieves the current default kernel keyring label setting
-// Deprecated: use selinux.KeyLabel
-var KeyLabel = selinux.KeyLabel
-
-// FileLabel returns the label for specified path
-// Deprecated: use selinux.FileLabel
-var FileLabel = selinux.FileLabel
-
-// PidLabel will return the label of the process running with the specified pid
-// Deprecated: use selinux.PidLabel
-var PidLabel = selinux.PidLabel
-
-// Init initialises the labeling system
-func Init() {
-	_ = selinux.GetEnabled()
-}
-
-// ClearLabels will clear all reserved labels
-// Deprecated: use selinux.ClearLabels
-var ClearLabels = selinux.ClearLabels
-
-// ReserveLabel will record the fact that the MCS label has already been used.
-// This will prevent InitLabels from using the MCS label in a newly created
-// container
-// Deprecated: use selinux.ReserveLabel
-func ReserveLabel(label string) error {
-	selinux.ReserveLabel(label)
-	return nil
-}
-
-// ReleaseLabel will remove the reservation of the MCS label.
-// This will allow InitLabels to use the MCS label in a newly created
-// containers
-// Deprecated: use selinux.ReleaseLabel
-func ReleaseLabel(label string) error {
-	selinux.ReleaseLabel(label)
-	return nil
-}
-
-// DupSecOpt takes a process label and returns security options that
-// can be used to set duplicate labels on future container processes
-// Deprecated: use selinux.DupSecOpt
-var DupSecOpt = selinux.DupSecOpt
-
-// FormatMountLabel returns a string to be used by the mount command.
-// The format of this string will be used to alter the labeling of the mountpoint.
-// The string returned is suitable to be used as the options field of the mount command.
-// If you need to have additional mount point options, you can pass them in as
-// the first parameter.  Second parameter is the label that you wish to apply
-// to all content in the mount point.
-func FormatMountLabel(src, mountLabel string) string {
-	if mountLabel != "" {
-		switch src {
-		case "":
-			src = fmt.Sprintf("context=%q", mountLabel)
-		default:
-			src = fmt.Sprintf("%s,context=%q", src, mountLabel)
-		}
-	}
-	return src
-}

vendor/github.com/opencontainers/selinux/go-selinux/label/label_linux.go

@@ -1,196 +0,0 @@
-package label
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"os/user"
-	"strings"
-
-	"github.com/opencontainers/selinux/go-selinux"
-)
-
-// Valid Label Options
-var validOptions = map[string]bool{
-	"disable":  true,
-	"type":     true,
-	"filetype": true,
-	"user":     true,
-	"role":     true,
-	"level":    true,
-}
-
-var ErrIncompatibleLabel = errors.New("Bad SELinux option z and Z can not be used together")
-
-// InitLabels returns the process label and file labels to be used within
-// the container.  A list of options can be passed into this function to alter
-// the labels.  The labels returned will include a random MCS String, that is
-// guaranteed to be unique.
-// If the disabled flag is passed in, the process label will not be set, but the mount label will be set
-// to the container_file label with the maximum category. This label is not usable by any confined label.
-func InitLabels(options []string) (plabel string, mlabel string, retErr error) {
-	if !selinux.GetEnabled() {
-		return "", "", nil
-	}
-	processLabel, mountLabel := selinux.ContainerLabels()
-	if processLabel != "" {
-		defer func() {
-			if retErr != nil {
-				selinux.ReleaseLabel(mountLabel)
-			}
-		}()
-		pcon, err := selinux.NewContext(processLabel)
-		if err != nil {
-			return "", "", err
-		}
-		mcsLevel := pcon["level"]
-		mcon, err := selinux.NewContext(mountLabel)
-		if err != nil {
-			return "", "", err
-		}
-		for _, opt := range options {
-			if opt == "disable" {
-				selinux.ReleaseLabel(mountLabel)
-				return "", selinux.PrivContainerMountLabel(), nil
-			}
-			if i := strings.Index(opt, ":"); i == -1 {
-				return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type, filetype' followed by ':' and a value", opt)
-			}
-			con := strings.SplitN(opt, ":", 2)
-			if !validOptions[con[0]] {
-				return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type, filetype'", con[0])
-			}
-			if con[0] == "filetype" {
-				mcon["type"] = con[1]
-				continue
-			}
-			pcon[con[0]] = con[1]
-			if con[0] == "level" || con[0] == "user" {
-				mcon[con[0]] = con[1]
-			}
-		}
-		if pcon.Get() != processLabel {
-			if pcon["level"] != mcsLevel {
-				selinux.ReleaseLabel(processLabel)
-			}
-			processLabel = pcon.Get()
-			selinux.ReserveLabel(processLabel)
-		}
-		mountLabel = mcon.Get()
-	}
-	return processLabel, mountLabel, nil
-}
-
-// Deprecated: The GenLabels function is only to be used during the transition
-// to the official API. Use InitLabels(strings.Fields(options)) instead.
-func GenLabels(options string) (string, string, error) {
-	return InitLabels(strings.Fields(options))
-}
-
-// SetFileLabel modifies the "path" label to the specified file label
-func SetFileLabel(path string, fileLabel string) error {
-	if !selinux.GetEnabled() || fileLabel == "" {
-		return nil
-	}
-	return selinux.SetFileLabel(path, fileLabel)
-}
-
-// SetFileCreateLabel tells the kernel the label for all files to be created
-func SetFileCreateLabel(fileLabel string) error {
-	if !selinux.GetEnabled() {
-		return nil
-	}
-	return selinux.SetFSCreateLabel(fileLabel)
-}
-
-// Relabel changes the label of path and all the entries beneath the path.
-// It changes the MCS label to s0 if shared is true.
-// This will allow all containers to share the content.
-//
-// The path itself is guaranteed to be relabeled last.
-func Relabel(path string, fileLabel string, shared bool) error {
-	if !selinux.GetEnabled() || fileLabel == "" {
-		return nil
-	}
-
-	exclude_paths := map[string]bool{
-		"/":           true,
-		"/bin":        true,
-		"/boot":       true,
-		"/dev":        true,
-		"/etc":        true,
-		"/etc/passwd": true,
-		"/etc/pki":    true,
-		"/etc/shadow": true,
-		"/home":       true,
-		"/lib":        true,
-		"/lib64":      true,
-		"/media":      true,
-		"/opt":        true,
-		"/proc":       true,
-		"/root":       true,
-		"/run":        true,
-		"/sbin":       true,
-		"/srv":        true,
-		"/sys":        true,
-		"/tmp":        true,
-		"/usr":        true,
-		"/var":        true,
-		"/var/lib":    true,
-		"/var/log":    true,
-	}
-
-	if home := os.Getenv("HOME"); home != "" {
-		exclude_paths[home] = true
-	}
-
-	if sudoUser := os.Getenv("SUDO_USER"); sudoUser != "" {
-		if usr, err := user.Lookup(sudoUser); err == nil {
-			exclude_paths[usr.HomeDir] = true
-		}
-	}
-
-	if path != "/" {
-		path = strings.TrimSuffix(path, "/")
-	}
-	if exclude_paths[path] {
-		return fmt.Errorf("SELinux relabeling of %s is not allowed", path)
-	}
-
-	if shared {
-		c, err := selinux.NewContext(fileLabel)
-		if err != nil {
-			return err
-		}
-
-		c["level"] = "s0"
-		fileLabel = c.Get()
-	}
-	if err := selinux.Chcon(path, fileLabel, true); err != nil {
-		return err
-	}
-	return nil
-}
-
-// DisableSecOpt returns a security opt that can disable labeling
-// support for future container processes
-// Deprecated: use selinux.DisableSecOpt
-var DisableSecOpt = selinux.DisableSecOpt
-
-// Validate checks that the label does not include unexpected options
-func Validate(label string) error {
-	if strings.Contains(label, "z") && strings.Contains(label, "Z") {
-		return ErrIncompatibleLabel
-	}
-	return nil
-}
-
-// RelabelNeeded checks whether the user requested a relabel
-func RelabelNeeded(label string) bool {
-	return strings.Contains(label, "z") || strings.Contains(label, "Z")
-}
-
-// IsShared checks that the label includes a "shared" mark
-func IsShared(label string) bool {
-	return strings.Contains(label, "z")
-}

vendor/github.com/opencontainers/selinux/go-selinux/label/label_stub.go

@@ -1,49 +0,0 @@
-// +build !linux
-
-package label
-
-// InitLabels returns the process label and file labels to be used within
-// the container.  A list of options can be passed into this function to alter
-// the labels.
-func InitLabels(options []string) (string, string, error) {
-	return "", "", nil
-}
-
-// Deprecated: The GenLabels function is only to be used during the transition
-// to the official API. Use InitLabels(strings.Fields(options)) instead.
-func GenLabels(options string) (string, string, error) {
-	return "", "", nil
-}
-
-func SetFileLabel(path string, fileLabel string) error {
-	return nil
-}
-
-func SetFileCreateLabel(fileLabel string) error {
-	return nil
-}
-
-func Relabel(path string, fileLabel string, shared bool) error {
-	return nil
-}
-
-// DisableSecOpt returns a security opt that can disable labeling
-// support for future container processes
-func DisableSecOpt() []string {
-	return nil
-}
-
-// Validate checks that the label does not include unexpected options
-func Validate(label string) error {
-	return nil
-}
-
-// RelabelNeeded checks whether the user requested a relabel
-func RelabelNeeded(label string) bool {
-	return false
-}
-
-// IsShared checks that the label includes a "shared" mark
-func IsShared(label string) bool {
-	return false
-}

vendor/github.com/opencontainers/selinux/go-selinux/rchcon.go

@@ -1,22 +0,0 @@
-// +build linux,go1.16
-
-package selinux
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-
-	"github.com/opencontainers/selinux/pkg/pwalkdir"
-)
-
-func rchcon(fpath, label string) error {
-	return pwalkdir.Walk(fpath, func(p string, _ fs.DirEntry, _ error) error {
-		e := lSetFileLabel(p, label)
-		// Walk a file tree can race with removal, so ignore ENOENT.
-		if errors.Is(e, os.ErrNotExist) {
-			return nil
-		}
-		return e
-	})
-}

vendor/github.com/opencontainers/selinux/go-selinux/rchcon_go115.go

@@ -1,21 +0,0 @@
-// +build linux,!go1.16
-
-package selinux
-
-import (
-	"errors"
-	"os"
-
-	"github.com/opencontainers/selinux/pkg/pwalk"
-)
-
-func rchcon(fpath, label string) error {
-	return pwalk.Walk(fpath, func(p string, _ os.FileInfo, _ error) error {
-		e := lSetFileLabel(p, label)
-		// Walk a file tree can race with removal, so ignore ENOENT.
-		if errors.Is(e, os.ErrNotExist) {
-			return nil
-		}
-		return e
-	})
-}

vendor/github.com/opencontainers/selinux/go-selinux/selinux.go

@@ -1,304 +0,0 @@
-package selinux
-
-import (
-	"errors"
-)
-
-const (
-	// Enforcing constant indicate SELinux is in enforcing mode
-	Enforcing = 1
-	// Permissive constant to indicate SELinux is in permissive mode
-	Permissive = 0
-	// Disabled constant to indicate SELinux is disabled
-	Disabled = -1
-	// maxCategory is the maximum number of categories used within containers
-	maxCategory = 1024
-	// DefaultCategoryRange is the upper bound on the category range
-	DefaultCategoryRange = uint32(maxCategory)
-)
-
-var (
-	// ErrMCSAlreadyExists is returned when trying to allocate a duplicate MCS.
-	ErrMCSAlreadyExists = errors.New("MCS label already exists")
-	// ErrEmptyPath is returned when an empty path has been specified.
-	ErrEmptyPath = errors.New("empty path")
-
-	// InvalidLabel is returned when an invalid label is specified.
-	InvalidLabel = errors.New("Invalid Label")
-
-	// ErrIncomparable is returned two levels are not comparable
-	ErrIncomparable = errors.New("incomparable levels")
-	// ErrLevelSyntax is returned when a sensitivity or category do not have correct syntax in a level
-	ErrLevelSyntax = errors.New("invalid level syntax")
-
-	// ErrContextMissing is returned if a requested context is not found in a file.
-	ErrContextMissing = errors.New("context does not have a match")
-	// ErrVerifierNil is returned when a context verifier function is nil.
-	ErrVerifierNil = errors.New("verifier function is nil")
-
-	// CategoryRange allows the upper bound on the category range to be adjusted
-	CategoryRange = DefaultCategoryRange
-
-	privContainerMountLabel string
-)
-
-// Context is a representation of the SELinux label broken into 4 parts
-type Context map[string]string
-
-// SetDisabled disables SELinux support for the package
-func SetDisabled() {
-	setDisabled()
-}
-
-// GetEnabled returns whether SELinux is currently enabled.
-func GetEnabled() bool {
-	return getEnabled()
-}
-
-// ClassIndex returns the int index for an object class in the loaded policy,
-// or -1 and an error
-func ClassIndex(class string) (int, error) {
-	return classIndex(class)
-}
-
-// SetFileLabel sets the SELinux label for this path, following symlinks,
-// or returns an error.
-func SetFileLabel(fpath string, label string) error {
-	return setFileLabel(fpath, label)
-}
-
-// LsetFileLabel sets the SELinux label for this path, not following symlinks,
-// or returns an error.
-func LsetFileLabel(fpath string, label string) error {
-	return lSetFileLabel(fpath, label)
-}
-
-// FileLabel returns the SELinux label for this path, following symlinks,
-// or returns an error.
-func FileLabel(fpath string) (string, error) {
-	return fileLabel(fpath)
-}
-
-// LfileLabel returns the SELinux label for this path, not following symlinks,
-// or returns an error.
-func LfileLabel(fpath string) (string, error) {
-	return lFileLabel(fpath)
-}
-
-// SetFSCreateLabel tells the kernel what label to use for all file system objects
-// created by this task.
-// Set the label to an empty string to return to the default label. Calls to SetFSCreateLabel
-// should be wrapped in runtime.LockOSThread()/runtime.UnlockOSThread() until file system
-// objects created by this task are finished to guarantee another goroutine does not migrate
-// to the current thread before execution is complete.
-func SetFSCreateLabel(label string) error {
-	return setFSCreateLabel(label)
-}
-
-// FSCreateLabel returns the default label the kernel which the kernel is using
-// for file system objects created by this task. "" indicates default.
-func FSCreateLabel() (string, error) {
-	return fsCreateLabel()
-}
-
-// CurrentLabel returns the SELinux label of the current process thread, or an error.
-func CurrentLabel() (string, error) {
-	return currentLabel()
-}
-
-// PidLabel returns the SELinux label of the given pid, or an error.
-func PidLabel(pid int) (string, error) {
-	return pidLabel(pid)
-}
-
-// ExecLabel returns the SELinux label that the kernel will use for any programs
-// that are executed by the current process thread, or an error.
-func ExecLabel() (string, error) {
-	return execLabel()
-}
-
-// CanonicalizeContext takes a context string and writes it to the kernel
-// the function then returns the context that the kernel will use. Use this
-// function to check if two contexts are equivalent
-func CanonicalizeContext(val string) (string, error) {
-	return canonicalizeContext(val)
-}
-
-// ComputeCreateContext requests the type transition from source to target for
-// class from the kernel.
-func ComputeCreateContext(source string, target string, class string) (string, error) {
-	return computeCreateContext(source, target, class)
-}
-
-// CalculateGlbLub computes the glb (greatest lower bound) and lub (least upper bound)
-// of a source and target range.
-// The glblub is calculated as the greater of the low sensitivities and
-// the lower of the high sensitivities and the and of each category bitset.
-func CalculateGlbLub(sourceRange, targetRange string) (string, error) {
-	return calculateGlbLub(sourceRange, targetRange)
-}
-
-// SetExecLabel sets the SELinux label that the kernel will use for any programs
-// that are executed by the current process thread, or an error. Calls to SetExecLabel
-// should  be wrapped in runtime.LockOSThread()/runtime.UnlockOSThread() until execution
-// of the program is finished to guarantee another goroutine does not migrate to the current
-// thread before execution is complete.
-func SetExecLabel(label string) error {
-	return setExecLabel(label)
-}
-
-// SetTaskLabel sets the SELinux label for the current thread, or an error.
-// This requires the dyntransition permission. Calls to SetTaskLabel should
-// be wrapped in runtime.LockOSThread()/runtime.UnlockOSThread() to guarantee
-// the current thread does not run in a new mislabeled thread.
-func SetTaskLabel(label string) error {
-	return setTaskLabel(label)
-}
-
-// SetSocketLabel takes a process label and tells the kernel to assign the
-// label to the next socket that gets created. Calls to SetSocketLabel
-// should be wrapped in runtime.LockOSThread()/runtime.UnlockOSThread() until
-// the the socket is created to guarantee another goroutine does not migrate
-// to the current thread before execution is complete.
-func SetSocketLabel(label string) error {
-	return setSocketLabel(label)
-}
-
-// SocketLabel retrieves the current socket label setting
-func SocketLabel() (string, error) {
-	return socketLabel()
-}
-
-// PeerLabel retrieves the label of the client on the other side of a socket
-func PeerLabel(fd uintptr) (string, error) {
-	return peerLabel(fd)
-}
-
-// SetKeyLabel takes a process label and tells the kernel to assign the
-// label to the next kernel keyring that gets created. Calls to SetKeyLabel
-// should be wrapped in runtime.LockOSThread()/runtime.UnlockOSThread() until
-// the kernel keyring is created to guarantee another goroutine does not migrate
-// to the current thread before execution is complete.
-func SetKeyLabel(label string) error {
-	return setKeyLabel(label)
-}
-
-// KeyLabel retrieves the current kernel keyring label setting
-func KeyLabel() (string, error) {
-	return keyLabel()
-}
-
-// Get returns the Context as a string
-func (c Context) Get() string {
-	return c.get()
-}
-
-// NewContext creates a new Context struct from the specified label
-func NewContext(label string) (Context, error) {
-	return newContext(label)
-}
-
-// ClearLabels clears all reserved labels
-func ClearLabels() {
-	clearLabels()
-}
-
-// ReserveLabel reserves the MLS/MCS level component of the specified label
-func ReserveLabel(label string) {
-	reserveLabel(label)
-}
-
-// EnforceMode returns the current SELinux mode Enforcing, Permissive, Disabled
-func EnforceMode() int {
-	return enforceMode()
-}
-
-// SetEnforceMode sets the current SELinux mode Enforcing, Permissive.
-// Disabled is not valid, since this needs to be set at boot time.
-func SetEnforceMode(mode int) error {
-	return setEnforceMode(mode)
-}
-
-// DefaultEnforceMode returns the systems default SELinux mode Enforcing,
-// Permissive or Disabled. Note this is is just the default at boot time.
-// EnforceMode tells you the systems current mode.
-func DefaultEnforceMode() int {
-	return defaultEnforceMode()
-}
-
-// ReleaseLabel un-reserves the MLS/MCS Level field of the specified label,
-// allowing it to be used by another process.
-func ReleaseLabel(label string) {
-	releaseLabel(label)
-}
-
-// ROFileLabel returns the specified SELinux readonly file label
-func ROFileLabel() string {
-	return roFileLabel()
-}
-
-// KVMContainerLabels returns the default processLabel and mountLabel to be used
-// for kvm containers by the calling process.
-func KVMContainerLabels() (string, string) {
-	return kvmContainerLabels()
-}
-
-// InitContainerLabels returns the default processLabel and file labels to be
-// used for containers running an init system like systemd by the calling process.
-func InitContainerLabels() (string, string) {
-	return initContainerLabels()
-}
-
-// ContainerLabels returns an allocated processLabel and fileLabel to be used for
-// container labeling by the calling process.
-func ContainerLabels() (processLabel string, fileLabel string) {
-	return containerLabels()
-}
-
-// SecurityCheckContext validates that the SELinux label is understood by the kernel
-func SecurityCheckContext(val string) error {
-	return securityCheckContext(val)
-}
-
-// CopyLevel returns a label with the MLS/MCS level from src label replaced on
-// the dest label.
-func CopyLevel(src, dest string) (string, error) {
-	return copyLevel(src, dest)
-}
-
-// Chcon changes the fpath file object to the SELinux label label.
-// If fpath is a directory and recurse is true, then Chcon walks the
-// directory tree setting the label.
-//
-// The fpath itself is guaranteed to be relabeled last.
-func Chcon(fpath string, label string, recurse bool) error {
-	return chcon(fpath, label, recurse)
-}
-
-// DupSecOpt takes an SELinux process label and returns security options that
-// can be used to set the SELinux Type and Level for future container processes.
-func DupSecOpt(src string) ([]string, error) {
-	return dupSecOpt(src)
-}
-
-// DisableSecOpt returns a security opt that can be used to disable SELinux
-// labeling support for future container processes.
-func DisableSecOpt() []string {
-	return disableSecOpt()
-}
-
-// GetDefaultContextWithLevel gets a single context for the specified SELinux user
-// identity that is reachable from the specified scon context. The context is based
-// on the per-user /etc/selinux/{SELINUXTYPE}/contexts/users/<username> if it exists,
-// and falls back to the global /etc/selinux/{SELINUXTYPE}/contexts/default_contexts
-// file.
-func GetDefaultContextWithLevel(user, level, scon string) (string, error) {
-	return getDefaultContextWithLevel(user, level, scon)
-}
-
-// PrivContainerMountLabel returns mount label for privileged containers
-func PrivContainerMountLabel() string {
-	// Make sure label is initialized.
-	_ = label("")
-	return privContainerMountLabel
-}

vendor/github.com/opencontainers/selinux/go-selinux/selinux_stub.go

@@ -1,164 +0,0 @@
-// +build !linux
-
-package selinux
-
-func setDisabled() {
-}
-
-func getEnabled() bool {
-	return false
-}
-
-func classIndex(class string) (int, error) {
-	return -1, nil
-}
-
-func setFileLabel(fpath string, label string) error {
-	return nil
-}
-
-func lSetFileLabel(fpath string, label string) error {
-	return nil
-}
-
-func fileLabel(fpath string) (string, error) {
-	return "", nil
-}
-
-func lFileLabel(fpath string) (string, error) {
-	return "", nil
-}
-
-func setFSCreateLabel(label string) error {
-	return nil
-}
-
-func fsCreateLabel() (string, error) {
-	return "", nil
-}
-
-func currentLabel() (string, error) {
-	return "", nil
-}
-
-func pidLabel(pid int) (string, error) {
-	return "", nil
-}
-
-func execLabel() (string, error) {
-	return "", nil
-}
-
-func canonicalizeContext(val string) (string, error) {
-	return "", nil
-}
-
-func computeCreateContext(source string, target string, class string) (string, error) {
-	return "", nil
-}
-
-func calculateGlbLub(sourceRange, targetRange string) (string, error) {
-	return "", nil
-}
-
-func setExecLabel(label string) error {
-	return nil
-}
-
-func setTaskLabel(label string) error {
-	return nil
-}
-
-func setSocketLabel(label string) error {
-	return nil
-}
-
-func socketLabel() (string, error) {
-	return "", nil
-}
-
-func peerLabel(fd uintptr) (string, error) {
-	return "", nil
-}
-
-func setKeyLabel(label string) error {
-	return nil
-}
-
-func keyLabel() (string, error) {
-	return "", nil
-}
-
-func (c Context) get() string {
-	return ""
-}
-
-func newContext(label string) (Context, error) {
-	c := make(Context)
-	return c, nil
-}
-
-func clearLabels() {
-}
-
-func reserveLabel(label string) {
-}
-
-func enforceMode() int {
-	return Disabled
-}
-
-func setEnforceMode(mode int) error {
-	return nil
-}
-
-func defaultEnforceMode() int {
-	return Disabled
-}
-
-func releaseLabel(label string) {
-}
-
-func roFileLabel() string {
-	return ""
-}
-
-func kvmContainerLabels() (string, string) {
-	return "", ""
-}
-
-func initContainerLabels() (string, string) {
-	return "", ""
-}
-
-func containerLabels() (processLabel string, fileLabel string) {
-	return "", ""
-}
-
-func securityCheckContext(val string) error {
-	return nil
-}
-
-func copyLevel(src, dest string) (string, error) {
-	return "", nil
-}
-
-func chcon(fpath string, label string, recurse bool) error {
-	return nil
-}
-
-func dupSecOpt(src string) ([]string, error) {
-	return nil, nil
-}
-
-func disableSecOpt() []string {
-	return []string{"disable"}
-}
-
-func getDefaultContextWithLevel(user, level, scon string) (string, error) {
-	return "", nil
-}
-
-func label(_ string) string {
-	return ""
-}

vendor/github.com/opencontainers/selinux/go-selinux/xattrs_linux.go

@@ -1,71 +0,0 @@
-package selinux
-
-import (
-	"golang.org/x/sys/unix"
-)
-
-// lgetxattr returns a []byte slice containing the value of
-// an extended attribute attr set for path.
-func lgetxattr(path, attr string) ([]byte, error) {
-	// Start with a 128 length byte array
-	dest := make([]byte, 128)
-	sz, errno := doLgetxattr(path, attr, dest)
-	for errno == unix.ERANGE { //nolint:errorlint // unix errors are bare
-		// Buffer too small, use zero-sized buffer to get the actual size
-		sz, errno = doLgetxattr(path, attr, []byte{})
-		if errno != nil {
-			return nil, errno
-		}
-
-		dest = make([]byte, sz)
-		sz, errno = doLgetxattr(path, attr, dest)
-	}
-	if errno != nil {
-		return nil, errno
-	}
-
-	return dest[:sz], nil
-}
-
-// doLgetxattr is a wrapper that retries on EINTR
-func doLgetxattr(path, attr string, dest []byte) (int, error) {
-	for {
-		sz, err := unix.Lgetxattr(path, attr, dest)
-		if err != unix.EINTR { //nolint:errorlint // unix errors are bare
-			return sz, err
-		}
-	}
-}
-
-// getxattr returns a []byte slice containing the value of
-// an extended attribute attr set for path.
-func getxattr(path, attr string) ([]byte, error) {
-	// Start with a 128 length byte array
-	dest := make([]byte, 128)
-	sz, errno := dogetxattr(path, attr, dest)
-	for errno == unix.ERANGE { //nolint:errorlint // unix errors are bare
-		// Buffer too small, use zero-sized buffer to get the actual size
-		sz, errno = dogetxattr(path, attr, []byte{})
-		if errno != nil {
-			return nil, errno
-		}
-
-		dest = make([]byte, sz)
-		sz, errno = dogetxattr(path, attr, dest)
-	}
-	if errno != nil {
-		return nil, errno
-	}
-
-	return dest[:sz], nil
-}
-
-// dogetxattr is a wrapper that retries on EINTR
-func dogetxattr(path, attr string, dest []byte) (int, error) {
-	for {
-		sz, err := unix.Getxattr(path, attr, dest)
-		if err != unix.EINTR { //nolint:errorlint // unix errors are bare
-			return sz, err
-		}
-	}
-}

vendor/github.com/opencontainers/selinux/pkg/pwalk/README.md

@@ -1,48 +0,0 @@
-## pwalk: parallel implementation of filepath.Walk
-
-This is a wrapper for [filepath.Walk](https://pkg.go.dev/path/filepath?tab=doc#Walk)
-which may speed it up by calling multiple callback functions (WalkFunc) in parallel,
-utilizing goroutines.
-
-By default, it utilizes 2\*runtime.NumCPU() goroutines for callbacks.
-This can be changed by using WalkN function which has the additional
-parameter, specifying the number of goroutines (concurrency).
-
-### pwalk vs pwalkdir
-
-This package is deprecated in favor of
-[pwalkdir](https://pkg.go.dev/github.com/opencontainers/selinux/pkg/pwalkdir),
-which is faster, but requires at least Go 1.16.
-
-### Caveats
-
-Please note the following limitations of this code:
-
-* Unlike filepath.Walk, the order of calls is non-deterministic;
-
-* Only primitive error handling is supported:
-
-  * filepath.SkipDir is not supported;
-
-  * no errors are ever passed to WalkFunc;
-
-  * once any error is returned from any WalkFunc instance, no more new calls
-    to WalkFunc are made, and the error is returned to the caller of Walk;
-
-  * if more than one walkFunc instance will return an error, only one
-    of such errors will be propagated and returned by Walk, others
-    will be silently discarded.
-
-### Documentation
-
-For the official documentation, see
-https://pkg.go.dev/github.com/opencontainers/selinux/pkg/pwalk?tab=doc
-
-### Benchmarks
-
-For a WalkFunc that consists solely of the return statement, this
-implementation is about 10% slower than the standard library's
-filepath.Walk.
-
-Otherwise (if a WalkFunc is doing something) this is usually faster,
-except when the WalkN(..., 1) is used.

vendor/github.com/opencontainers/selinux/pkg/pwalk/pwalk.go

@@ -1,115 +0,0 @@
-package pwalk
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-	"runtime"
-	"sync"
-)
-
-type WalkFunc = filepath.WalkFunc
-
-// Walk is a wrapper for filepath.Walk which can call multiple walkFn
-// in parallel, allowing to handle each item concurrently. A maximum of
-// twice the runtime.NumCPU() walkFn will be called at any one time.
-// If you want to change the maximum, use WalkN instead.
-//
-// The order of calls is non-deterministic.
-//
-// Note that this implementation only supports primitive error handling:
-//
-// - no errors are ever passed to walkFn;
-//
-// - once a walkFn returns any error, all further processing stops
-// and the error is returned to the caller of Walk;
-//
-// - filepath.SkipDir is not supported;
-//
-// - if more than one walkFn instance will return an error, only one
-// of such errors will be propagated and returned by Walk, others
-// will be silently discarded.
-func Walk(root string, walkFn WalkFunc) error {
-	return WalkN(root, walkFn, runtime.NumCPU()*2)
-}
-
-// WalkN is a wrapper for filepath.Walk which can call multiple walkFn
-// in parallel, allowing to handle each item concurrently. A maximum of
-// num walkFn will be called at any one time.
-//
-// Please see Walk documentation for caveats of using this function.
-func WalkN(root string, walkFn WalkFunc, num int) error {
-	// make sure limit is sensible
-	if num < 1 {
-		return fmt.Errorf("walk(%q): num must be > 0", root)
-	}
-
-	files := make(chan *walkArgs, 2*num)
-	errCh := make(chan error, 1) // get the first error, ignore others
-
-	// Start walking a tree asap
-	var (
-		err error
-		wg  sync.WaitGroup
-
-		rootLen   = len(root)
-		rootEntry *walkArgs
-	)
-	wg.Add(1)
-	go func() {
-		err = filepath.Walk(root, func(p string, info os.FileInfo, err error) error {
-			if err != nil {
-				close(files)
-				return err
-			}
-			if len(p) == rootLen {
-				// Root entry is processed separately below.
-				rootEntry = &walkArgs{path: p, info: &info}
-				return nil
-			}
-			// add a file to the queue unless a callback sent an error
-			select {
-			case e := <-errCh:
-				close(files)
-				return e
-			default:
-				files <- &walkArgs{path: p, info: &info}
-				return nil
-			}
-		})
-		if err == nil {
-			close(files)
-		}
-		wg.Done()
-	}()
-
-	wg.Add(num)
-	for i := 0; i < num; i++ {
-		go func() {
-			for file := range files {
-				if e := walkFn(file.path, *file.info, nil); e != nil {
-					select {
-					case errCh <- e: // sent ok
-					default: // buffer full
-					}
-				}
-			}
-			wg.Done()
-		}()
-	}
-
-	wg.Wait()
-
-	if err == nil {
-		err = walkFn(rootEntry.path, *rootEntry.info, nil)
-	}
-
-	return err
-}
-
-// walkArgs holds the arguments that were passed to the Walk or WalkN
-// functions.
-type walkArgs struct {
-	path string
-	info *os.FileInfo
-}

vendor/github.com/opencontainers/selinux/pkg/pwalkdir/README.md

@@ -1,54 +0,0 @@
-## pwalkdir: parallel implementation of filepath.WalkDir
-
-This is a wrapper for [filepath.WalkDir](https://pkg.go.dev/path/filepath#WalkDir)
-which may speed it up by calling multiple callback functions (WalkDirFunc)
-in parallel, utilizing goroutines.
-
-By default, it utilizes 2\*runtime.NumCPU() goroutines for callbacks.
-This can be changed by using WalkN function which has the additional
-parameter, specifying the number of goroutines (concurrency).
-
-### pwalk vs pwalkdir
-
-This package is very similar to
-[pwalk](https://pkg.go.dev/github.com/opencontainers/selinux/pkg/pwalkdir),
-but utilizes `filepath.WalkDir` (added to Go 1.16), which does not call stat(2)
-on every entry and is therefore faster (up to 3x, depending on usage scenario).
-
-Users who are OK with requiring Go 1.16+ should switch to this
-implementation.
-
-### Caveats
-
-Please note the following limitations of this code:
-
-* Unlike filepath.WalkDir, the order of calls is non-deterministic;
-
-* Only primitive error handling is supported:
-
-  * fs.SkipDir is not supported;
-
-  * no errors are ever passed to WalkDirFunc;
-
-  * once any error is returned from any walkDirFunc instance, no more calls
-    to WalkDirFunc are made, and the error is returned to the caller of WalkDir;
-
-  * if more than one WalkDirFunc instance will return an error, only one
-    of such errors will be propagated to and returned by WalkDir, others
-    will be silently discarded.
-
-### Documentation
-
-For the official documentation, see
-https://pkg.go.dev/github.com/opencontainers/selinux/pkg/pwalkdir
-
-### Benchmarks
-
-For a WalkDirFunc that consists solely of the return statement, this
-implementation is about 15% slower than the standard library's
-filepath.WalkDir.
-
-Otherwise (if a WalkDirFunc is actually doing something) this is usually
-faster, except when the WalkDirN(..., 1) is used. Run `go test -bench .`
-to see how different operations can benefit from it, as well as how the
-level of paralellism affects the speed.

vendor/github.com/opencontainers/selinux/pkg/pwalkdir/pwalkdir.go

@@ -1,116 +0,0 @@
-//go:build go1.16
-// +build go1.16
-
-package pwalkdir
-
-import (
-	"fmt"
-	"io/fs"
-	"path/filepath"
-	"runtime"
-	"sync"
-)
-
-// Walk is a wrapper for filepath.WalkDir which can call multiple walkFn
-// in parallel, allowing to handle each item concurrently. A maximum of
-// twice the runtime.NumCPU() walkFn will be called at any one time.
-// If you want to change the maximum, use WalkN instead.
-//
-// The order of calls is non-deterministic.
-//
-// Note that this implementation only supports primitive error handling:
-//
-// - no errors are ever passed to walkFn;
-//
-// - once a walkFn returns any error, all further processing stops
-// and the error is returned to the caller of Walk;
-//
-// - filepath.SkipDir is not supported;
-//
-// - if more than one walkFn instance will return an error, only one
-// of such errors will be propagated and returned by Walk, others
-// will be silently discarded.
-func Walk(root string, walkFn fs.WalkDirFunc) error {
-	return WalkN(root, walkFn, runtime.NumCPU()*2)
-}
-
-// WalkN is a wrapper for filepath.WalkDir which can call multiple walkFn
-// in parallel, allowing to handle each item concurrently. A maximum of
-// num walkFn will be called at any one time.
-//
-// Please see Walk documentation for caveats of using this function.
-func WalkN(root string, walkFn fs.WalkDirFunc, num int) error {
-	// make sure limit is sensible
-	if num < 1 {
-		return fmt.Errorf("walk(%q): num must be > 0", root)
-	}
-
-	files := make(chan *walkArgs, 2*num)
-	errCh := make(chan error, 1) // Get the first error, ignore others.
-
-	// Start walking a tree asap.
-	var (
-		err error
-		wg  sync.WaitGroup
-
-		rootLen   = len(root)
-		rootEntry *walkArgs
-	)
-	wg.Add(1)
-	go func() {
-		err = filepath.WalkDir(root, func(p string, entry fs.DirEntry, err error) error {
-			if err != nil {
-				close(files)
-				return err
-			}
-			if len(p) == rootLen {
-				// Root entry is processed separately below.
-				rootEntry = &walkArgs{path: p, entry: entry}
-				return nil
-			}
-			// Add a file to the queue unless a callback sent an error.
-			select {
-			case e := <-errCh:
-				close(files)
-				return e
-			default:
-				files <- &walkArgs{path: p, entry: entry}
-				return nil
-			}
-		})
-		if err == nil {
-			close(files)
-		}
-		wg.Done()
-	}()
-
-	wg.Add(num)
-	for i := 0; i < num; i++ {
-		go func() {
-			for file := range files {
-				if e := walkFn(file.path, file.entry, nil); e != nil {
-					select {
-					case errCh <- e: // sent ok
-					default: // buffer full
-					}
-				}
-			}
-			wg.Done()
-		}()
-	}
-
-	wg.Wait()
-
-	if err == nil {
-		err = walkFn(rootEntry.path, rootEntry.entry, nil)
-	}
-
-	return err
-}
-
-// walkArgs holds the arguments that were passed to the Walk or WalkN
-// functions.
-type walkArgs struct {
-	path  string
-	entry fs.DirEntry
-}