openbmc/build/tmp/deploy/sdk/witherspoon-2019-08-08/sysroots/armv6-openbmc-linux-gnueabi/usr/src/debug/systemd/1_242+AUTOINC+db2e367bfc-r0/git/src/nspawn/nspawn-oci.c
static int oci_unexpected(const char* name, JsonVariant* v,
                          JsonDispatchFlags flags, void* userdata)
{
    return json_log(v, flags, SYNTHETIC_ERRNO(EINVAL),
                    "Unexpected OCI element '%s' of type '%s'.", name,
                    json_variant_type_to_string(json_variant_type(v)));
}
/* TODO:
 * OCI runtime tool implementation
 * hooks
 *
 * Spec issues:
 *
 * How is RLIM_INFINITY supposed to be encoded?
 * configured effective caps is bullshit, as execv() corrupts it anyway
 * pipes bind mounted is *very* different from pipes newly created, comments
 * regarding bind mount or not are bogus annotation values structured? or
 * string? configurable file system namespace path, but then also root path?
 * wtf? apply sysctl inside of the container? or outside? how is unlimited pids
 * tasks limit to be encoded? what are the defaults for caps if not specified?
 * what are the default uid/gid mappings if one is missing but the other set, or
 * when user ns is on but no namespace configured the source field of "mounts"
 * is really weird, as it cannot realistically be relative to the bundle, since
 * we never know if that's what the fs wants spec contradicts itself on the
 * mount "type" field, as the example uses "bind" as type, but it's not listed
 * in /proc/filesystem, and is something made up by /bin/mount if type of mount
 * is left out, what shall be assumed? "bind"? readonly mounts is entirely
 * redundant? should escaping be applied when joining mount options with ","?
 * devices cgroup support is bogus, "allow" and "deny" on the kernel level is
 * about adding/removing entries, not about access spec needs to say that "rwm"
 * devices cgroup combination can't be the empty string cgrouspv1 crap: kernel,
 * kernelTCP, swapiness, disableOOMKiller, swap, devices, leafWeight general: it
 * shouldn't leak lower level abstractions this obviously unmanagable cgroups
 * stuff: realtimeRuntime/realtimePeriod needs to say what happense when some
 * option is not specified, i.e. which defautls apply no architecture? no
 * personality? seccomp example and logic is simply broken: there's no constant
 * "SCMP_ACT_ERRNO". spec should say what to do with unknown props /bin/mount
 * regarding NFS and FUSE required? what does terminal=false mean? sysctl inside
 * or outside? whitelisting?
 *
 * Unsupported:
 *
 * apparmorProfile
 * selinuxLabel + mountLabel
 * hugepageLimits
 * network
 * rdma
 * intelRdt
 * swappiness, disableOOMKiller, kernel, kernelTCP, leafWeight (because it's
 * dead, cgroupsv2 can't do it and hence systemd neither)
 *
 * Non-slice cgroup paths
 * Propagation that is not slave + shared
 * more than one uid/gid mapping, mappings with a container base != 0, or
 * non-matching uid/gid mappings device cgroups access = false items that are
 * not catchall device cgroups matches where minor is specified, but major
 * isn't. similar where major is specified but char/block is not. also, any
 * match that only has a type set that has less than "rwm" set. also, any entry
 * that has none of rwm set.
 *
 */
OCI runtime tool implementation
hooks

Spec issues.





apparmorProfile
selinuxLabel + mountLabel
hugepageLimits
network
rdma
intelRdt
swappiness, disableOOMKiller, kernel, kernelTCP, leafWeight (because it's
dead, cgroupsv2 can't do it and hence systemd neither)

Non-slice cgroup paths
Propagation that is not slave + shared
more than one uid/gid mapping, mappings with a container base != 0, or
non-matching uid/gid mappings device cgroups access = false items that are
not catchall device cgroups matches where minor is specified, but major
isn't. similar where major is specified but char/block is not. also, any
match that only has a type set that has less than "rwm" set. also, any entry
that has none of rwm set.
OCI runtime tool implementation hooks Spec issues . apparmorProfile selinuxLabel + mountLabel hugepageLimits network rdma intelRdt swappiness disableOOMKiller kernel kernelTCP leafWeight ( because it ' s dead cgroupsv2 can ' t do it and hence systemd neither ) Non - slice cgroup paths Propagation that is not slave + shared more than one uid / gid mapping mappings with a container base ! = 0 or non - matching uid / gid mappings device cgroups access = false items that are not catchall device cgroups matches where minor is specified but major isn ' t . similar where major is specified but char / block is not . also any match that only has a type set that has less than " rwm " set . also any entry that has none of rwm set .
static int oci_unexpected(const char* name, JsonVariant* v,
                          JsonDispatchFlags flags, void* userdata)
{
    return json_log(v, flags, SYNTHETIC_ERRNO(EINVAL),
                    "Unexpected OCI element '%s' of type '%s'.", name,
                    json_variant_type_to_string(json_variant_type(v)));
}
static int oci_unexpected ( const char * name , JsonVariant * v , JsonDispatchFlags flags , void * userdata ) { return json_log ( v , flags , SYNTHETIC_ERRNO ( EINVAL ) , " " , name , json_variant_type_to_string ( json_variant_type ( v ) ) ) ; }
TODO:
 OCI runtime tool implementation
 hooks
TODO : OCI runtime tool implementation hooks