From ab4eb6849033ec2c21baead3e076d7682a9576e7 Mon Sep 17 00:00:00 2001
From: baude <bbaude@redhat.com>
Date: Thu, 1 Oct 2020 15:18:11 -0500
Subject: [PATCH] fix compat api privileged and entrypoint code

when adding /dev to a privileged container using the compatibility API, we need to make sure we dont pass on devices that are simply symlinks.  this was already being done by specgen but not on the compat. side.

the entrypoint code that was recently rewritten for the compatibility layer was also failing due to the odd inputs that docker is willing to accept in its json, specifically [] vs "".  in the case of the latter, this was being made into a []string with a len of one but no content.  this would then be used to prefix the command to run in the container and would fail.  For example " ls" vs "ls".

Signed-off-by: baude <bbaude@redhat.com>
---
 pkg/spec/config_linux.go |  3 +++
 pkg/spec/spec.go         | 19 ++++++++++++++-----
 2 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/pkg/spec/config_linux.go b/pkg/spec/config_linux.go
index d03663f12d..319cce61fa 100644
--- a/pkg/spec/config_linux.go
+++ b/pkg/spec/config_linux.go
@@ -200,6 +200,9 @@ func getDevices(path string) ([]*configs.Device, error) {
 			}
 		case f.Name() == "console":
 			continue
+		case f.Mode()&os.ModeSymlink != 0:
+			// do not add symlink'd devices to privileged devices
+			continue
 		}
 		device, err := devices.DeviceFromPath(filepath.Join(path, f.Name()), "rwm")
 		if err != nil {
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go
index 42228540c4..81620997f7 100644
--- a/pkg/spec/spec.go
+++ b/pkg/spec/spec.go
@@ -182,14 +182,23 @@ func (config *CreateConfig) createConfigToOCISpec(runtime *libpod.Runtime, userM
 	g.SetProcessCwd(config.WorkDir)
 
 	ProcessArgs := make([]string, 0)
-	if len(config.Entrypoint) > 0 {
-		ProcessArgs = config.Entrypoint
+	// We need to iterate the input for entrypoint because it is a []string
+	// but "" is a legit json input, which translates into a []string with an
+	// empty position.  This messes up the eventual command being executed
+	// in the container
+	for _, a := range config.Entrypoint {
+		if len(a) > 0 {
+			ProcessArgs = append(ProcessArgs, a)
+		}
 	}
-	if len(config.Command) > 0 {
-		ProcessArgs = append(ProcessArgs, config.Command...)
+	// Same issue as explained above for config.Entrypoint.
+	for _, a := range config.Command {
+		if len(a) > 0 {
+			ProcessArgs = append(ProcessArgs, a)
+		}
 	}
-	g.SetProcessArgs(ProcessArgs)
 
+	g.SetProcessArgs(ProcessArgs)
 	g.SetProcessTerminal(config.Tty)
 
 	for key, val := range config.Annotations {