PR feedback

Signed-off-by: Maksim An <maksiman@microsoft.com>

cmd/hooks/wait-paths/main.go

@@ -38,8 +38,7 @@ func main() {
  }
  app.Action = run
  if err := app.Run(os.Args); err != nil {
- logrus.Errorf("%s", err)
- os.Exit(1)
+ logrus.Fatalf("%s\n", err)
  }
  os.Exit(0)
 }

internal/devices/drivers.go

@@ -46,7 +46,7 @@ func InstallKernelDriver(ctx context.Context, vm *uvm.UtilityVM, driver string)
  }
  return closer, execPnPInstallDriver(ctx, vm, uvmPath)
  }
- uvmPathForShare := fmt.Sprintf(guestpath.LCOWGlobalMountPrefix, vm.UVMMountCounter())
+ uvmPathForShare := fmt.Sprintf(guestpath.LCOWGlobalMountPrefixFmt, vm.UVMMountCounter())
  scsiCloser, err := vm.AddSCSI(ctx, driver, uvmPathForShare, true, false, []string{}, uvm.VMAccessTypeIndividual)
  if err != nil {
  return closer, fmt.Errorf("failed to add SCSI disk to utility VM for path %+v: %s", driver, err)

internal/guestpath/paths.go

@@ -12,13 +12,13 @@ const (
  SandboxMountPrefix = "sandbox://"
  // HugePagesMountPrefix is mount prefix used in container spec to mark a huge-pages mount
  HugePagesMountPrefix = "hugepages://"
- // LCOWMountPathPrefix is the path format in the LCOW UVM where non global mounts, such
+ // LCOWMountPathPrefixFmt is the path format in the LCOW UVM where non global mounts, such
  // as Plan9 mounts are added
- LCOWMountPathPrefix = "/mounts/m%d"
- // LCOWGlobalMountPrefix is the path format in the LCOW UVM where global mounts are added
- LCOWGlobalMountPrefix = "/run/mounts/m%d"
- // WCOWGlobalMountPrefix is the path prefix format in the WCOW UVM where mounts are added
- WCOWGlobalMountPrefix = "C:\\mounts\\m%d"
+ LCOWMountPathPrefixFmt = "/mounts/m%d"
+ // LCOWGlobalMountPrefixFmt is the path format in the LCOW UVM where global mounts are added
+ LCOWGlobalMountPrefixFmt = "/run/mounts/m%d"
+ // WCOWGlobalMountPrefixFmt is the path prefix format in the WCOW UVM where mounts are added
+ WCOWGlobalMountPrefixFmt = "C:\\mounts\\m%d"
  // RootfsPath is part of the container's rootfs path
  RootfsPath = "rootfs"
 )

internal/hcsoci/resources_lcow.go

@@ -67,7 +67,7 @@ func allocateLinuxResources(ctx context.Context, coi *createOptionsInternal, r *
 
  if coi.HostingSystem != nil {
  hostPath := mount.Source
- uvmPathForShare := path.Join(containerRootInUVM, fmt.Sprintf(guestpath.LCOWMountPathPrefix, i))
+ uvmPathForShare := path.Join(containerRootInUVM, fmt.Sprintf(guestpath.LCOWMountPathPrefixFmt, i))
  uvmPathForFile := uvmPathForShare
 
  readOnly := false
@@ -81,7 +81,7 @@ func allocateLinuxResources(ctx context.Context, coi *createOptionsInternal, r *
  l := log.G(ctx).WithField("mount", fmt.Sprintf("%+v", mount))
  if mount.Type == "physical-disk" {
  l.Debug("hcsshim::allocateLinuxResources Hot-adding SCSI physical disk for OCI mount")
- uvmPathForShare = fmt.Sprintf(guestpath.LCOWGlobalMountPrefix, coi.HostingSystem.UVMMountCounter())
+ uvmPathForShare = fmt.Sprintf(guestpath.LCOWGlobalMountPrefixFmt, coi.HostingSystem.UVMMountCounter())
  scsiMount, err := coi.HostingSystem.AddSCSIPhysicalDisk(ctx, hostPath, uvmPathForShare, readOnly, mount.Options)
  if err != nil {
  return errors.Wrapf(err, "adding SCSI physical disk mount %+v", mount)
@@ -92,7 +92,7 @@ func allocateLinuxResources(ctx context.Context, coi *createOptionsInternal, r *
  coi.Spec.Mounts[i].Type = "none"
  } else if mount.Type == "virtual-disk" {
  l.Debug("hcsshim::allocateLinuxResources Hot-adding SCSI virtual disk for OCI mount")
- uvmPathForShare = fmt.Sprintf(guestpath.LCOWGlobalMountPrefix, coi.HostingSystem.UVMMountCounter())
+ uvmPathForShare = fmt.Sprintf(guestpath.LCOWGlobalMountPrefixFmt, coi.HostingSystem.UVMMountCounter())
 
  // if the scsi device is already attached then we take the uvm path that the function below returns
  // that is where it was previously mounted in UVM

internal/hcsoci/resources_wcow.go

@@ -142,7 +142,7 @@ func setupMounts(ctx context.Context, coi *createOptionsInternal, r *resources.R
  }
 
  if coi.HostingSystem != nil && schemaversion.IsV21(coi.actualSchemaVersion) {
- uvmPath := fmt.Sprintf(guestpath.WCOWGlobalMountPrefix, coi.HostingSystem.UVMMountCounter())
+ uvmPath := fmt.Sprintf(guestpath.WCOWGlobalMountPrefixFmt, coi.HostingSystem.UVMMountCounter())
  readOnly := false
  for _, o := range mount.Options {
  if strings.ToLower(o) == "ro" {

internal/layers/layers.go

@@ -291,7 +291,7 @@ func addLCOWLayer(ctx context.Context, vm *uvm.UtilityVM, layerPath string) (uvm
  }
 
  options := []string{"ro"}
- uvmPath = fmt.Sprintf(guestpath.LCOWGlobalMountPrefix, vm.UVMMountCounter())
+ uvmPath = fmt.Sprintf(guestpath.LCOWGlobalMountPrefixFmt, vm.UVMMountCounter())
  sm, err := vm.AddSCSI(ctx, layerPath, uvmPath, true, false, options, uvm.VMAccessTypeNoop)
  if err != nil {
  return "", fmt.Errorf("failed to add SCSI layer: %s", err)

pkg/securitypolicy/securitypolicyenforcer.go

@@ -6,16 +6,16 @@ import (
  "os"
  "path/filepath"
  "regexp"
- "runtime"
  "strconv"
  "strings"
  "sync"
 
+ "github.com/google/go-cmp/cmp"
+ oci "github.com/opencontainers/runtime-spec/specs-go"
+
  "github.com/Microsoft/hcsshim/internal/guestpath"
  "github.com/Microsoft/hcsshim/internal/hooks"
  "github.com/Microsoft/hcsshim/pkg/annotations"
- "github.com/google/go-cmp/cmp"
- oci "github.com/opencontainers/runtime-spec/specs-go"
 )
 
 type SecurityPolicyEnforcer interface {
@@ -470,15 +470,10 @@ func possibleIndexesForID(containerID string, mapping map[int]map[string]struct{
  return possibles
 }
 
-func getContainerRootInUVM(id string) string {
- switch runtime.GOOS {
- case "windows":
- return filepath.Join(guestpath.WCOWRootPrefixInUVM, id)
- default:
- return filepath.Join(guestpath.LCOWRootPrefixInUVM, id)
- }
-}
-
+// EnforceExpectedMountsPolicy for StandardSecurityPolicyEnforcer injects a
+// hooks.CreateRuntime hook into container spec and the hook ensures that
+// the expected mounts appear prior container start. At the moment enforcement
+// is expected to take place inside LCOW UVM.
 func (pe *StandardSecurityPolicyEnforcer) EnforceExpectedMountsPolicy(containerID string, spec *oci.Spec) error {
  pe.mutex.Lock()
  defer pe.mutex.Unlock()
@@ -517,7 +512,7 @@ func (pe *StandardSecurityPolicyEnforcer) EnforceExpectedMountsPolicy(containerI
  wp := ""
  if strings.HasPrefix(mount, guestpath.SandboxMountPrefix) {
  sandboxPath := strings.TrimPrefix(mount, guestpath.SandboxMountPrefix)
- wp = filepath.Join(getContainerRootInUVM(sandboxID), "sandboxMounts", sandboxPath)
+ wp = filepath.Join(guestpath.LCOWRootPrefixInUVM, "sandboxMounts", sandboxPath)
  } else {
  // Find the corresponding sandbox mount and resolve the path inside UVM.
  for _, m := range spec.Mounts {