69 lines
1.8 KiB
Go
69 lines
1.8 KiB
Go
package tentacle
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/json"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
"path/filepath"
|
|
"syscall"
|
|
)
|
|
|
|
// LoadLocalSpecs reads an explicit development launch list, not a manifest or
|
|
// installation catalog. It does not execute code or discover directories.
|
|
func LoadLocalSpecs(path string) ([]Spec, error) {
|
|
file, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NONBLOCK, 0)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
defer file.Close()
|
|
info, err := file.Stat()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if !info.Mode().IsRegular() {
|
|
return nil, fmt.Errorf("local tentacle list must be a regular file")
|
|
}
|
|
data, err := io.ReadAll(io.LimitReader(file, MaxFrameBytes+1))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if len(data) > MaxFrameBytes {
|
|
return nil, ErrLimit
|
|
}
|
|
if err := validate_json(data); err != nil {
|
|
return nil, err
|
|
}
|
|
var specs []Spec
|
|
decoder := json.NewDecoder(bytes.NewReader(data))
|
|
decoder.DisallowUnknownFields()
|
|
if err := decoder.Decode(&specs); err != nil {
|
|
return nil, err
|
|
}
|
|
if len(specs) > DefaultLimits().Processes {
|
|
return nil, ErrLimit
|
|
}
|
|
seen := make(map[string]bool)
|
|
for _, spec := range specs {
|
|
if err := validate_spec(spec); err != nil {
|
|
return nil, err
|
|
}
|
|
if seen[spec.ID] {
|
|
return nil, fmt.Errorf("duplicate local tentacle ID")
|
|
}
|
|
seen[spec.ID] = true
|
|
}
|
|
return specs, nil
|
|
}
|
|
|
|
// DelegatedParent reads an explicitly configured optional cgroup parent.
|
|
// It does not inspect init-system naming conventions or move the reader.
|
|
func DelegatedParent() (string, error) {
|
|
parent := os.Getenv("CTHULHU_TENTACLE_CGROUP_PARENT")
|
|
if !filepath.IsAbs(parent) || filepath.Clean(parent) != parent {
|
|
return "", fmt.Errorf("%w: configure CTHULHU_TENTACLE_CGROUP_PARENT with an absolute delegated cgroup v2 directory", ErrContainment)
|
|
}
|
|
return parent, nil
|
|
}
|