-
Notifications
You must be signed in to change notification settings - Fork 41.3k
[TOB-K8S-027] Fix Incorrect isKernelPid check #81086
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[TOB-K8S-027] Fix Incorrect isKernelPid check #81086
Conversation
isKernelPid should explicitly check the error returned from os.Readlink and return true only if the error value is ENOENT. Without this fix, if Readlink returned say ENAMETOOLONG or EACESS, we would still count the process as a kernel process (which is not true).
/sig node |
/sig node |
/test pull-kubernetes-integration |
/retest |
1 similar comment
/retest |
/test pull-kubernetes-integration |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
Thanks for fixing this :)
P.S. As a side note... this security review is pretty cool - thanks for tackling the outcomes so quickly :)
@@ -888,7 +888,7 @@ func ensureSystemCgroups(rootCgroupPath string, manager *fs.Manager) error { | |||
func isKernelPid(pid int) bool { | |||
// Kernel threads have no associated executable. | |||
_, err := os.Readlink(fmt.Sprintf("/proc/%d/exe", pid)) | |||
return err != nil | |||
return err != nil && os.IsNotExist(err) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Q: If it is a situation in which (for example) the file name is too long (i.e. an ENAMETOOLONG
error), do we want to return that it isn't a kernel pid or do we want to return some other form of error message?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's hard to imagine a kernel PID would belong to a process spawned in a too long path so imho not returning an error is fine here.
/lgtm |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dims, yujuhong The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
isKernelPid should explicitly check the error returned from os.Readlink and return true
only if the error value is ENOENT. Without this fix, if Readlink
returned say ENAMETOOLONG or EACESS, we would still count the process as
a kernel process (which is not true).
What type of PR is this?
/kind bug
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes #81144
Special notes for your reviewer:
Does this PR introduce a user-facing change?:
Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.: