From 054c9599c6149833d775992777a8a821f69d35f0 Mon Sep 17 00:00:00 2001 From: Arpit Jain Date: Fri, 24 Jul 2026 01:42:30 +0900 Subject: [PATCH] Guard against nil Root in apparmor check CheckProcess dereferences v.spec.Root.Path when a process sets apparmorProfile, but root is optional in the runtime spec. A config with process.apparmorProfile and no root makes oci-runtime-tool validate panic with a nil pointer dereference. The sibling executable-in-rootfs check on the Args path already guards this with v.spec.Root != nil; apply the same guard here so the apparmor check is skipped when there is no root to resolve the profile path against. Adds a CheckProcess case covering apparmorProfile with no root. Signed-off-by: Arpit Jain --- validate/validate.go | 2 +- validate/validate_test.go | 14 ++++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/validate/validate.go b/validate/validate.go index 82e7b49b..1706fc5f 100644 --- a/validate/validate.go +++ b/validate/validate.go @@ -375,7 +375,7 @@ func (v *Validator) CheckProcess() (errs error) { errs = multierror.Append(errs, v.CheckCapabilities()) } - if len(process.ApparmorProfile) > 0 { + if len(process.ApparmorProfile) > 0 && v.spec.Root != nil { profilePath := filepath.Join(v.bundlePath, v.spec.Root.Path, "/etc/apparmor.d", process.ApparmorProfile) _, err := os.Stat(profilePath) if err != nil { diff --git a/validate/validate_test.go b/validate/validate_test.go index ac24845e..a8a80f63 100644 --- a/validate/validate_test.go +++ b/validate/validate_test.go @@ -490,6 +490,20 @@ func TestCheckProcess(t *testing.T) { platform: "solaris", expected: specerror.PosixProcRlimitsTypeValueError, }, + { + // Root is optional in the runtime spec; an apparmorProfile + // with no root must not panic the validator. + val: rspec.Spec{ + Version: "1.0.0", + Process: &rspec.Process{ + Args: []string{"sh"}, + Cwd: "/", + ApparmorProfile: "docker-default", + }, + }, + platform: "linux", + expected: specerror.NonError, + }, } for _, c := range cases { v, err := NewValidator(&c.val, ".", false, c.platform)