fix(cgroups.plugin): do not add network devices if cgroup proc is in the host net ns (#12788)

This commit is contained in:
Ilya Mashchenko 2022-05-02 16:37:09 +03:00 committed by GitHub
parent cba0dca1f6
commit db9b85a9cb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 27 additions and 0 deletions

View File

@ -27,6 +27,14 @@ struct iface {
struct iface *next;
};
unsigned int calc_num_ifaces(struct iface *root) {
unsigned int num = 0;
for (struct iface *h = root; h; h = h->next) {
num++;
}
return num;
}
unsigned int read_iface_iflink(const char *prefix, const char *iface) {
if(!prefix) prefix = "";
@ -447,6 +455,25 @@ void detect_veth_interfaces(pid_t pid) {
goto cleanup;
}
unsigned int host_dev_num = calc_num_ifaces(host);
unsigned int cgroup_dev_num = calc_num_ifaces(cgroup);
// host ifaces == guest ifaces => we are still in the host namespace
// and we can't really identify which ifaces belong to the cgroup (e.g. Proxmox VM).
if (host_dev_num == cgroup_dev_num) {
unsigned int m = 0;
for (h = host; h; h = h->next) {
for (c = cgroup; c; c = c->next) {
if (h->ifindex == c->ifindex && h->iflink == c->iflink) {
m++;
break;
}
}
}
if (host_dev_num == m) {
goto cleanup;
}
}
for(h = host; h ; h = h->next) {
if(iface_is_eligible(h)) {
for (c = cgroup; c; c = c->next) {