run_oci/container_config_parser.cc - mirrors/cros/chromiumos/platform2 - Git at Google

 // Copyright 2016 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #include "run_oci/container_config_parser.h"

 #include <unistd.h>

 #include <regex>  // NOLINT(build/c++11)
 #include <string>
 #include <vector>

 #include <base/json/json_reader.h>
 #include <base/values.h>

 namespace run_oci {

 namespace {

 // Gets a uint32 from the given dictionary.
 bool ParseUint32FromDict(const base::DictionaryValue& dict, const char *name,
                          uint32_t* val_out) {
   double double_val;
   if (!dict.GetDouble(name, &double_val)) {
     return false;
   }
   *val_out = double_val;
   return true;
 }

 // Gets a uint64 from the given dictionary.
 bool ParseUint64FromDict(const base::DictionaryValue& dict, const char *name,
                          uint64_t* val_out) {
   double double_val;
   if (!dict.GetDouble(name, &double_val)) {
     return false;
   }
   *val_out = double_val;
   return true;
 }

 // Parses basic platform configuration.
 bool ParsePlatformConfig(const base::DictionaryValue& config_root_dict,
                          OciConfigPtr const& config_out) {
   // |platform_dict| stays owned by |config_root_dict|
   const base::DictionaryValue* platform_dict = nullptr;
   if (!config_root_dict.GetDictionary("platform", &platform_dict)) {
     LOG(ERROR) << "Fail to parse platform dictionary from config";
     return false;
   }

   if (!platform_dict->GetString("os", &config_out->platform.os)) {
     return false;
   }

   if (!platform_dict->GetString("arch", &config_out->platform.arch)) {
     return false;
   }

   return true;
 }

 // Parses root fs info.
 bool ParseRootFileSystemConfig(const base::DictionaryValue& config_root_dict,
                                OciConfigPtr const& config_out) {
   // |rootfs_dict| stays owned by |config_root_dict|
   const base::DictionaryValue* rootfs_dict = nullptr;
   if (!config_root_dict.GetDictionary("root", &rootfs_dict)) {
     LOG(ERROR) << "Fail to parse rootfs dictionary from config";
     return false;
   }
   if (!rootfs_dict->GetString("path", &config_out->root.path)) {
     LOG(ERROR) << "Fail to get rootfs path from config";
     return false;
   }
   rootfs_dict->GetBoolean("readonly", &config_out->root.readonly);
   return true;
 }

 // Fills |config_out| with information about the main process to run in the
 // container and the user it should be run as.
 bool ParseProcessConfig(const base::DictionaryValue& config_root_dict,
                         OciConfigPtr const& config_out) {
   // |process_dict| stays owned by |config_root_dict|
   const base::DictionaryValue* process_dict = nullptr;
   if (!config_root_dict.GetDictionary("process", &process_dict)) {
     LOG(ERROR) << "Fail to get main process from config";
     return false;
   }
   process_dict->GetBoolean("terminal", &config_out->process.terminal);
   // |user_dict| stays owned by |process_dict|
   const base::DictionaryValue* user_dict = nullptr;
   if (!process_dict->GetDictionary("user", &user_dict)) {
     LOG(ERROR) << "Failed to get user info from config";
     return false;
   }
   if (!ParseUint32FromDict(*user_dict, "uid", &config_out->process.user.uid))
     return false;
   if (!ParseUint32FromDict(*user_dict, "gid", &config_out->process.user.gid))
     return false;
   // |args_list| stays owned by |process_dict|
   const base::ListValue* args_list = nullptr;
   if (!process_dict->GetList("args", &args_list)) {
     LOG(ERROR) << "Fail to get main process args from config";
     return false;
   }
   size_t num_args = args_list->GetSize();
   for (size_t i = 0; i < num_args; ++i) {
     std::string arg;
     if (!args_list->GetString(i, &arg)) {
       LOG(ERROR) << "Fail to get process args from config";
       return false;
     }
     config_out->process.args.push_back(arg);
   }
   // |env_list| stays owned by |process_dict|
   const base::ListValue* env_list = nullptr;
   if (process_dict->GetList("env", &env_list)) {
     size_t num_env = env_list->GetSize();
     for (size_t i = 0; i < num_env; ++i) {
       std::string env;
       if (!env_list->GetString(i, &env)) {
         LOG(ERROR) << "Fail to get process env from config";
         return false;
       }
       config_out->process.env.push_back(env);
     }
   }
   if (!process_dict->GetString("cwd", &config_out->process.cwd)) {
     LOG(ERROR) << "failed to get cwd of process";
     return false;
   }

   return true;
 }

 // Parses the 'mounts' field.  The necessary mounts for running the container
 // are specified here.
 bool ParseMounts(const base::DictionaryValue& config_root_dict,
                  OciConfigPtr const& config_out) {
   // |config_mounts_list| stays owned by |config_root_dict|
   const base::ListValue* config_mounts_list = nullptr;
   if (!config_root_dict.GetList("mounts", &config_mounts_list)) {
     LOG(ERROR) << "Fail to get mounts from config dictionary";
     return false;
   }

   for (size_t i = 0; i < config_mounts_list->GetSize(); ++i) {
     const base::DictionaryValue* mount_dict;
     if (!config_mounts_list->GetDictionary(i, &mount_dict)) {
       LOG(ERROR) << "Fail to get mount item " << i;
       return false;
     }
     OciMount mount;
     if (!mount_dict->GetString("destination", &mount.destination)) {
       LOG(ERROR) << "Fail to get mount path for mount " << i;
       return false;
     }
     if (!mount_dict->GetString("type", &mount.type)) {
       LOG(ERROR) << "Fail to get mount type for mount " << i;
       return false;
     }
     if (!mount_dict->GetString("source", &mount.source)) {
       LOG(ERROR) << "Fail to get mount source for mount " << i;
       return false;
     }

     // |options| are owned by |mount_dict|
     const base::ListValue* options = nullptr;
     if (mount_dict->GetList("options", &options)) {
       for (size_t j = 0; j < options->GetSize(); ++j) {
         std::string this_opt;
         if (!options->GetString(j, &this_opt)) {
           LOG(ERROR) << "Fail to get option " << j << " from mount options";
           return false;
         }
         mount.options.push_back(this_opt);
       }
     }

     config_out->mounts.push_back(mount);
   }
   return true;
 }

 // Parses the linux resource list
 bool ParseResources(const base::DictionaryValue& resources_dict,
                     OciLinuxResources* resources_out) {
   // |device_list| is owned by |resources_dict|
   const base::ListValue* device_list = nullptr;
   if (!resources_dict.GetList("devices", &device_list)) {
     // The device list is optional.
     return true;
   }
   size_t num_devices = device_list->GetSize();
   for (size_t i = 0; i < num_devices; ++i) {
     OciLinuxCgroupDevice device;

     const base::DictionaryValue* dev;
     if (!device_list->GetDictionary(i, &dev)) {
       LOG(ERROR) << "Fail to get device " << i;
       return false;
     }

     if (!dev->GetBoolean("allow", &device.allow)) {
       LOG(ERROR) << "Fail to get allow value for device " << i;
       return false;
     }
     if (!dev->GetString("access", &device.access))
       device.access = "rwm";  // Optional, default to all perms.
     if (!dev->GetString("type", &device.type))
       device.type = "a";  // Optional, default to both a means all.
     if (!ParseUint32FromDict(*dev, "major", &device.major))
       device.major = -1;  // Optional, -1 will map to all devices.
     if (!ParseUint32FromDict(*dev, "minor", &device.minor))
       device.minor = -1;  // Optional, -1 will map to all devices.

     resources_out->devices.push_back(device);
   }

   return true;
 }

 // Parse the list of device nodes that the container needs to run.
 bool ParseDeviceList(const base::DictionaryValue& linux_dict,
                      OciConfigPtr const& config_out) {
   // |device_list| is owned by |linux_dict|
   const base::ListValue* device_list = nullptr;
   if (!linux_dict.GetList("devices", &device_list)) {
     // The device list is optional.
     return true;
   }
   size_t num_devices = device_list->GetSize();
   for (size_t i = 0; i < num_devices; ++i) {
     OciLinuxDevice device;

     const base::DictionaryValue* dev;
     if (!device_list->GetDictionary(i, &dev)) {
       LOG(ERROR) << "Fail to get device " << i;
       return false;
     }
     std::string path;
     if (!dev->GetString("path", &device.path)) {
       LOG(ERROR) << "Fail to get path for dev";
       return false;
     }
     if (!dev->GetString("type", &device.type)) {
       LOG(ERROR) << "Fail to get type for " << device.path;
       return false;
     }
     if (!ParseUint32FromDict(*dev, "major", &device.major))
       return false;
     if (!ParseUint32FromDict(*dev, "minor", &device.minor))
       return false;
     if (!ParseUint32FromDict(*dev, "fileMode", &device.fileMode))
       return false;
     if (!ParseUint32FromDict(*dev, "uid", &device.uid))
       return false;
     if (!ParseUint32FromDict(*dev, "gid", &device.gid))
       return false;

     config_out->linux_config.devices.push_back(device);
   }

   return true;
 }

 // Parses the list of ID mappings and fills |mappings_out| with them.
 bool ParseLinuxIdMappings(const base::ListValue* id_map_list,
                           std::vector<OciLinuxNamespaceMapping>* mappings_out) {
   for (size_t i = 0; i < id_map_list->GetSize(); ++i) {
     OciLinuxNamespaceMapping new_map;
     const base::DictionaryValue* map;
     if (!id_map_list->GetDictionary(i, &map)) {
       LOG(ERROR) << "Fail to get id map " << i;
       return false;
     }
     if (!ParseUint32FromDict(*map, "hostID", &new_map.hostID))
       return false;
     if (!ParseUint32FromDict(*map, "containerID", &new_map.containerID))
       return false;
     if (!ParseUint32FromDict(*map, "size", &new_map.size))
       return false;
     mappings_out->push_back(new_map);
   }
   return true;
 }

 // Parses seccomp syscall args.
 bool ParseSeccompArgs(const base::DictionaryValue& syscall_dict,
                       OciSeccompSyscall* syscall_out) {
   const base::ListValue* args = nullptr;
   if (syscall_dict.GetList("args", &args)) {
     for (size_t i = 0; i < args->GetSize(); ++i) {
       const base::DictionaryValue* args_dict = nullptr;
       if (!args->GetDictionary(i, &args_dict)) {
         LOG(ERROR) << "Failed to pars args dict for " << syscall_out->name;
         return false;
       }
       OciSeccompArg this_arg;
       if (!ParseUint32FromDict(*args_dict, "index", &this_arg.index))
         return false;
       if (!ParseUint64FromDict(*args_dict, "value", &this_arg.value))
         return false;
       if (!ParseUint64FromDict(*args_dict, "value2", &this_arg.value2))
         return false;
       if (!args_dict->GetString("op", &this_arg.op)) {
         LOG(ERROR) << "Failed to parse op for arg " << this_arg.index
                    << " of " << syscall_out->name;
         return false;
       }
       syscall_out->args.push_back(this_arg);
     }
   }
   return true;
 }

 // Parses the seccomp node if it is present.
 bool ParseSeccompInfo(const base::DictionaryValue& seccomp_dict,
                       OciSeccomp* seccomp_out) {
   if (!seccomp_dict.GetString("defaultAction",
                               &seccomp_out->defaultAction))
     return false;

   // Gets the list of architectures.
   const base::ListValue* architectures = nullptr;
   if (!seccomp_dict.GetList("architectures", &architectures)) {
     LOG(ERROR) << "Fail to read seccomp architectures";
     return false;
   }
   for (size_t i = 0; i < architectures->GetSize(); ++i) {
     std::string this_arch;
     if (!architectures->GetString(i, &this_arch)) {
       LOG(ERROR) << "Fail to parse seccomp architecture list";
       return false;
     }
     seccomp_out->architectures.push_back(this_arch);
   }

   // Gets the list of syscalls.
   const base::ListValue* syscalls = nullptr;
   if (!seccomp_dict.GetList("syscalls", &syscalls)) {
     LOG(ERROR) << "Fail to read seccomp syscalls";
     return false;
   }
   for (size_t i = 0; i < syscalls->GetSize(); ++i) {
     const base::DictionaryValue* syscall_dict = nullptr;
     if (!syscalls->GetDictionary(i, &syscall_dict)) {
       LOG(ERROR) << "Fail to parse seccomp syscalls list";
       return false;
     }
     OciSeccompSyscall this_syscall;
     if (!syscall_dict->GetString("name", &this_syscall.name)) {
       LOG(ERROR) << "Fail to parse syscall name " << i;
       return false;
     }
     if (!syscall_dict->GetString("action", &this_syscall.action)) {
       LOG(ERROR) << "Fail to parse syscall action for " << this_syscall.name;
       return false;
     }
     if (!ParseSeccompArgs(*syscall_dict, &this_syscall))
       return false;
     seccomp_out->syscalls.push_back(this_syscall);
   }

   return true;
 }

 // Parses the linux node which has information about setting up a user
 // namespace, and the list of devices for the container.
 bool ParseLinuxConfigDict(const base::DictionaryValue& runtime_root_dict,
                           OciConfigPtr const& config_out) {
   // |linux_dict| is owned by |runtime_root_dict|
   const base::DictionaryValue* linux_dict = nullptr;
   if (!runtime_root_dict.GetDictionary("linux", &linux_dict)) {
     LOG(ERROR) << "Fail to get linux dictionary from the runtime dictionary";
     return false;
   }

   // |uid_map_list| is owned by |linux_dict|
   const base::ListValue* uid_map_list = nullptr;
   if (!linux_dict->GetList("uidMappings", &uid_map_list)) {
     LOG(ERROR) << "Fail to get uid mappings list";
     return false;
   }
   ParseLinuxIdMappings(uid_map_list, &config_out->linux_config.uidMappings);

   // |gid_map_list| is owned by |linux_dict|
   const base::ListValue* gid_map_list = nullptr;
   if (!linux_dict->GetList("gidMappings", &gid_map_list)) {
     LOG(ERROR) << "Fail to get gid mappings list";
     return false;
   }
   ParseLinuxIdMappings(gid_map_list, &config_out->linux_config.gidMappings);

   if (!ParseDeviceList(*linux_dict, config_out))
     return false;

   const base::DictionaryValue* resources_dict = nullptr;
   if (linux_dict->GetDictionary("resources", &resources_dict)) {
     if (!ParseResources(*resources_dict, &config_out->linux_config.resources))
       return false;
   }

   const base::DictionaryValue* seccomp_dict = nullptr;
   if (linux_dict->GetDictionary("seccomp", &seccomp_dict)) {
     if (!ParseSeccompInfo(*seccomp_dict, &config_out->linux_config.seccomp))
       return false;
   }

   return true;
 }

 bool HostnameValid(const std::string& hostname) {
   if (hostname.length() > 255)
     return false;

   const std::regex name("^[0-9a-zA-Z]([0-9a-zA-Z-]*[0-9a-zA-Z])?$");
   if (!std::regex_match(hostname, name))
     return false;

   const std::regex double_dash("--");
   if (std::regex_match(hostname, double_dash))
     return false;

   return true;
 }

 // Parses the configuration file for the container.  The config file specifies
 // basic filesystem info and details about the process to be run.  namespace,
 // cgroup, and syscall configurations are also specified
 bool ParseConfigDict(const base::DictionaryValue& config_root_dict,
                      OciConfigPtr const& config_out) {
   if (!config_root_dict.GetString("ociVersion", &config_out->ociVersion)) {
     LOG(ERROR) << "Failed to parse ociVersion";
     return false;
   }
   if (!config_root_dict.GetString("hostname", &config_out->hostname)) {
     LOG(ERROR) << "Failed to parse hostname";
     return false;
   }
   if (!HostnameValid(config_out->hostname)) {
     LOG(ERROR) << "Invalid hostname " << config_out->hostname;
     return false;
   }

   // Platform info
   if (!ParsePlatformConfig(config_root_dict, config_out)) {
     return false;
   }

   // Root fs info
   if (!ParseRootFileSystemConfig(config_root_dict, config_out)) {
     return false;
   }

   // Process info
   if (!ParseProcessConfig(config_root_dict, config_out)) {
     return false;
   }

   // Get a list of mount points and mounts.
   if (!ParseMounts(config_root_dict, config_out)) {
     LOG(ERROR) << "Failed to parse mounts";
     return false;
   }

   // Parse linux node.
   if (!ParseLinuxConfigDict(config_root_dict, config_out)) {
     LOG(ERROR) << "Failed to parse the linux node";
     return false;
   }

   return true;
 }

 }  // anonymous namespace

 bool ParseContainerConfig(const std::string& config_json_data,
                           OciConfigPtr const& config_out) {
   std::unique_ptr<const base::Value> config_root_val =
       base::JSONReader::Read(config_json_data);
   if (!config_root_val) {
     LOG(ERROR) << "Fail to parse config.json";
     return false;
   }
   const base::DictionaryValue* config_dict = nullptr;
   if (!config_root_val->GetAsDictionary(&config_dict)) {
     LOG(ERROR) << "Fail to parse root dictionary from config.json";
     return false;
   }
   if (!ParseConfigDict(*config_dict, config_out)) {
     return false;
   }

   return true;
 }

 }  // namespace run_oci
	// Copyright 2016 The Chromium OS Authors. All rights reserved.
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#include "run_oci/container_config_parser.h"

	#include <unistd.h>

	#include <regex> // NOLINT(build/c++11)
	#include <string>
	#include <vector>

	#include <base/json/json_reader.h>
	#include <base/values.h>

	namespace run_oci {

	namespace {

	// Gets a uint32 from the given dictionary.
	bool ParseUint32FromDict(const base::DictionaryValue& dict, const char *name,
	uint32_t* val_out) {
	double double_val;
	if (!dict.GetDouble(name, &double_val)) {
	return false;
	}
	*val_out = double_val;
	return true;
	}

	// Gets a uint64 from the given dictionary.
	bool ParseUint64FromDict(const base::DictionaryValue& dict, const char *name,
	uint64_t* val_out) {
	double double_val;
	if (!dict.GetDouble(name, &double_val)) {
	return false;
	}
	*val_out = double_val;
	return true;
	}

	// Parses basic platform configuration.
	bool ParsePlatformConfig(const base::DictionaryValue& config_root_dict,
	OciConfigPtr const& config_out) {
	// \|platform_dict\| stays owned by \|config_root_dict\|
	const base::DictionaryValue* platform_dict = nullptr;
	if (!config_root_dict.GetDictionary("platform", &platform_dict)) {
	LOG(ERROR) << "Fail to parse platform dictionary from config";
	return false;
	}

	if (!platform_dict->GetString("os", &config_out->platform.os)) {
	return false;
	}

	if (!platform_dict->GetString("arch", &config_out->platform.arch)) {
	return false;
	}

	return true;
	}

	// Parses root fs info.
	bool ParseRootFileSystemConfig(const base::DictionaryValue& config_root_dict,
	OciConfigPtr const& config_out) {
	// \|rootfs_dict\| stays owned by \|config_root_dict\|
	const base::DictionaryValue* rootfs_dict = nullptr;
	if (!config_root_dict.GetDictionary("root", &rootfs_dict)) {
	LOG(ERROR) << "Fail to parse rootfs dictionary from config";
	return false;
	}
	if (!rootfs_dict->GetString("path", &config_out->root.path)) {
	LOG(ERROR) << "Fail to get rootfs path from config";
	return false;
	}
	rootfs_dict->GetBoolean("readonly", &config_out->root.readonly);
	return true;
	}

	// Fills \|config_out\| with information about the main process to run in the
	// container and the user it should be run as.
	bool ParseProcessConfig(const base::DictionaryValue& config_root_dict,
	OciConfigPtr const& config_out) {
	// \|process_dict\| stays owned by \|config_root_dict\|
	const base::DictionaryValue* process_dict = nullptr;
	if (!config_root_dict.GetDictionary("process", &process_dict)) {
	LOG(ERROR) << "Fail to get main process from config";
	return false;
	}
	process_dict->GetBoolean("terminal", &config_out->process.terminal);
	// \|user_dict\| stays owned by \|process_dict\|
	const base::DictionaryValue* user_dict = nullptr;
	if (!process_dict->GetDictionary("user", &user_dict)) {
	LOG(ERROR) << "Failed to get user info from config";
	return false;
	}
	if (!ParseUint32FromDict(*user_dict, "uid", &config_out->process.user.uid))
	return false;
	if (!ParseUint32FromDict(*user_dict, "gid", &config_out->process.user.gid))
	return false;
	// \|args_list\| stays owned by \|process_dict\|
	const base::ListValue* args_list = nullptr;
	if (!process_dict->GetList("args", &args_list)) {
	LOG(ERROR) << "Fail to get main process args from config";
	return false;
	}
	size_t num_args = args_list->GetSize();
	for (size_t i = 0; i < num_args; ++i) {
	std::string arg;
	if (!args_list->GetString(i, &arg)) {
	LOG(ERROR) << "Fail to get process args from config";
	return false;
	}
	config_out->process.args.push_back(arg);
	}
	// \|env_list\| stays owned by \|process_dict\|
	const base::ListValue* env_list = nullptr;
	if (process_dict->GetList("env", &env_list)) {
	size_t num_env = env_list->GetSize();
	for (size_t i = 0; i < num_env; ++i) {
	std::string env;
	if (!env_list->GetString(i, &env)) {
	LOG(ERROR) << "Fail to get process env from config";
	return false;
	}
	config_out->process.env.push_back(env);
	}
	}
	if (!process_dict->GetString("cwd", &config_out->process.cwd)) {
	LOG(ERROR) << "failed to get cwd of process";
	return false;
	}

	return true;
	}

	// Parses the 'mounts' field. The necessary mounts for running the container
	// are specified here.
	bool ParseMounts(const base::DictionaryValue& config_root_dict,
	OciConfigPtr const& config_out) {
	// \|config_mounts_list\| stays owned by \|config_root_dict\|
	const base::ListValue* config_mounts_list = nullptr;
	if (!config_root_dict.GetList("mounts", &config_mounts_list)) {
	LOG(ERROR) << "Fail to get mounts from config dictionary";
	return false;
	}

	for (size_t i = 0; i < config_mounts_list->GetSize(); ++i) {
	const base::DictionaryValue* mount_dict;
	if (!config_mounts_list->GetDictionary(i, &mount_dict)) {
	LOG(ERROR) << "Fail to get mount item " << i;
	return false;
	}
	OciMount mount;
	if (!mount_dict->GetString("destination", &mount.destination)) {
	LOG(ERROR) << "Fail to get mount path for mount " << i;
	return false;
	}
	if (!mount_dict->GetString("type", &mount.type)) {
	LOG(ERROR) << "Fail to get mount type for mount " << i;
	return false;
	}
	if (!mount_dict->GetString("source", &mount.source)) {
	LOG(ERROR) << "Fail to get mount source for mount " << i;
	return false;
	}

	// \|options\| are owned by \|mount_dict\|
	const base::ListValue* options = nullptr;
	if (mount_dict->GetList("options", &options)) {
	for (size_t j = 0; j < options->GetSize(); ++j) {
	std::string this_opt;
	if (!options->GetString(j, &this_opt)) {
	LOG(ERROR) << "Fail to get option " << j << " from mount options";
	return false;
	}
	mount.options.push_back(this_opt);
	}
	}

	config_out->mounts.push_back(mount);
	}
	return true;
	}

	// Parses the linux resource list
	bool ParseResources(const base::DictionaryValue& resources_dict,
	OciLinuxResources* resources_out) {
	// \|device_list\| is owned by \|resources_dict\|
	const base::ListValue* device_list = nullptr;
	if (!resources_dict.GetList("devices", &device_list)) {
	// The device list is optional.
	return true;
	}
	size_t num_devices = device_list->GetSize();
	for (size_t i = 0; i < num_devices; ++i) {
	OciLinuxCgroupDevice device;

	const base::DictionaryValue* dev;
	if (!device_list->GetDictionary(i, &dev)) {
	LOG(ERROR) << "Fail to get device " << i;
	return false;
	}

	if (!dev->GetBoolean("allow", &device.allow)) {
	LOG(ERROR) << "Fail to get allow value for device " << i;
	return false;
	}
	if (!dev->GetString("access", &device.access))
	device.access = "rwm"; // Optional, default to all perms.
	if (!dev->GetString("type", &device.type))
	device.type = "a"; // Optional, default to both a means all.
	if (!ParseUint32FromDict(*dev, "major", &device.major))
	device.major = -1; // Optional, -1 will map to all devices.
	if (!ParseUint32FromDict(*dev, "minor", &device.minor))
	device.minor = -1; // Optional, -1 will map to all devices.

	resources_out->devices.push_back(device);
	}

	return true;
	}

	// Parse the list of device nodes that the container needs to run.
	bool ParseDeviceList(const base::DictionaryValue& linux_dict,
	OciConfigPtr const& config_out) {
	// \|device_list\| is owned by \|linux_dict\|
	const base::ListValue* device_list = nullptr;
	if (!linux_dict.GetList("devices", &device_list)) {
	// The device list is optional.
	return true;
	}
	size_t num_devices = device_list->GetSize();
	for (size_t i = 0; i < num_devices; ++i) {
	OciLinuxDevice device;

	const base::DictionaryValue* dev;
	if (!device_list->GetDictionary(i, &dev)) {
	LOG(ERROR) << "Fail to get device " << i;
	return false;
	}
	std::string path;
	if (!dev->GetString("path", &device.path)) {
	LOG(ERROR) << "Fail to get path for dev";
	return false;
	}
	if (!dev->GetString("type", &device.type)) {
	LOG(ERROR) << "Fail to get type for " << device.path;
	return false;
	}
	if (!ParseUint32FromDict(*dev, "major", &device.major))
	return false;
	if (!ParseUint32FromDict(*dev, "minor", &device.minor))
	return false;
	if (!ParseUint32FromDict(*dev, "fileMode", &device.fileMode))
	return false;
	if (!ParseUint32FromDict(*dev, "uid", &device.uid))
	return false;
	if (!ParseUint32FromDict(*dev, "gid", &device.gid))
	return false;

	config_out->linux_config.devices.push_back(device);
	}

	return true;
	}

	// Parses the list of ID mappings and fills \|mappings_out\| with them.
	bool ParseLinuxIdMappings(const base::ListValue* id_map_list,
	std::vector<OciLinuxNamespaceMapping>* mappings_out) {
	for (size_t i = 0; i < id_map_list->GetSize(); ++i) {
	OciLinuxNamespaceMapping new_map;
	const base::DictionaryValue* map;
	if (!id_map_list->GetDictionary(i, &map)) {
	LOG(ERROR) << "Fail to get id map " << i;
	return false;
	}
	if (!ParseUint32FromDict(*map, "hostID", &new_map.hostID))
	return false;
	if (!ParseUint32FromDict(*map, "containerID", &new_map.containerID))
	return false;
	if (!ParseUint32FromDict(*map, "size", &new_map.size))
	return false;
	mappings_out->push_back(new_map);
	}
	return true;
	}

	// Parses seccomp syscall args.
	bool ParseSeccompArgs(const base::DictionaryValue& syscall_dict,
	OciSeccompSyscall* syscall_out) {
	const base::ListValue* args = nullptr;
	if (syscall_dict.GetList("args", &args)) {
	for (size_t i = 0; i < args->GetSize(); ++i) {
	const base::DictionaryValue* args_dict = nullptr;
	if (!args->GetDictionary(i, &args_dict)) {
	LOG(ERROR) << "Failed to pars args dict for " << syscall_out->name;
	return false;
	}
	OciSeccompArg this_arg;
	if (!ParseUint32FromDict(*args_dict, "index", &this_arg.index))
	return false;
	if (!ParseUint64FromDict(*args_dict, "value", &this_arg.value))
	return false;
	if (!ParseUint64FromDict(*args_dict, "value2", &this_arg.value2))
	return false;
	if (!args_dict->GetString("op", &this_arg.op)) {
	LOG(ERROR) << "Failed to parse op for arg " << this_arg.index
	<< " of " << syscall_out->name;
	return false;
	}
	syscall_out->args.push_back(this_arg);
	}
	}
	return true;
	}

	// Parses the seccomp node if it is present.
	bool ParseSeccompInfo(const base::DictionaryValue& seccomp_dict,
	OciSeccomp* seccomp_out) {
	if (!seccomp_dict.GetString("defaultAction",
	&seccomp_out->defaultAction))
	return false;

	// Gets the list of architectures.
	const base::ListValue* architectures = nullptr;
	if (!seccomp_dict.GetList("architectures", &architectures)) {
	LOG(ERROR) << "Fail to read seccomp architectures";
	return false;
	}
	for (size_t i = 0; i < architectures->GetSize(); ++i) {
	std::string this_arch;
	if (!architectures->GetString(i, &this_arch)) {
	LOG(ERROR) << "Fail to parse seccomp architecture list";
	return false;
	}
	seccomp_out->architectures.push_back(this_arch);
	}

	// Gets the list of syscalls.
	const base::ListValue* syscalls = nullptr;
	if (!seccomp_dict.GetList("syscalls", &syscalls)) {
	LOG(ERROR) << "Fail to read seccomp syscalls";
	return false;
	}
	for (size_t i = 0; i < syscalls->GetSize(); ++i) {
	const base::DictionaryValue* syscall_dict = nullptr;
	if (!syscalls->GetDictionary(i, &syscall_dict)) {
	LOG(ERROR) << "Fail to parse seccomp syscalls list";
	return false;
	}
	OciSeccompSyscall this_syscall;
	if (!syscall_dict->GetString("name", &this_syscall.name)) {
	LOG(ERROR) << "Fail to parse syscall name " << i;
	return false;
	}
	if (!syscall_dict->GetString("action", &this_syscall.action)) {
	LOG(ERROR) << "Fail to parse syscall action for " << this_syscall.name;
	return false;
	}
	if (!ParseSeccompArgs(*syscall_dict, &this_syscall))
	return false;
	seccomp_out->syscalls.push_back(this_syscall);
	}

	return true;
	}

	// Parses the linux node which has information about setting up a user
	// namespace, and the list of devices for the container.
	bool ParseLinuxConfigDict(const base::DictionaryValue& runtime_root_dict,
	OciConfigPtr const& config_out) {
	// \|linux_dict\| is owned by \|runtime_root_dict\|
	const base::DictionaryValue* linux_dict = nullptr;
	if (!runtime_root_dict.GetDictionary("linux", &linux_dict)) {
	LOG(ERROR) << "Fail to get linux dictionary from the runtime dictionary";
	return false;
	}

	// \|uid_map_list\| is owned by \|linux_dict\|
	const base::ListValue* uid_map_list = nullptr;
	if (!linux_dict->GetList("uidMappings", &uid_map_list)) {
	LOG(ERROR) << "Fail to get uid mappings list";
	return false;
	}
	ParseLinuxIdMappings(uid_map_list, &config_out->linux_config.uidMappings);

	// \|gid_map_list\| is owned by \|linux_dict\|
	const base::ListValue* gid_map_list = nullptr;
	if (!linux_dict->GetList("gidMappings", &gid_map_list)) {
	LOG(ERROR) << "Fail to get gid mappings list";
	return false;
	}
	ParseLinuxIdMappings(gid_map_list, &config_out->linux_config.gidMappings);

	if (!ParseDeviceList(*linux_dict, config_out))
	return false;

	const base::DictionaryValue* resources_dict = nullptr;
	if (linux_dict->GetDictionary("resources", &resources_dict)) {
	if (!ParseResources(*resources_dict, &config_out->linux_config.resources))
	return false;
	}

	const base::DictionaryValue* seccomp_dict = nullptr;
	if (linux_dict->GetDictionary("seccomp", &seccomp_dict)) {
	if (!ParseSeccompInfo(*seccomp_dict, &config_out->linux_config.seccomp))
	return false;
	}

	return true;
	}

	bool HostnameValid(const std::string& hostname) {
	if (hostname.length() > 255)
	return false;

	const std::regex name("^[0-9a-zA-Z]([0-9a-zA-Z-]*[0-9a-zA-Z])?$");
	if (!std::regex_match(hostname, name))
	return false;

	const std::regex double_dash("--");
	if (std::regex_match(hostname, double_dash))
	return false;

	return true;
	}

	// Parses the configuration file for the container. The config file specifies
	// basic filesystem info and details about the process to be run. namespace,
	// cgroup, and syscall configurations are also specified
	bool ParseConfigDict(const base::DictionaryValue& config_root_dict,
	OciConfigPtr const& config_out) {
	if (!config_root_dict.GetString("ociVersion", &config_out->ociVersion)) {
	LOG(ERROR) << "Failed to parse ociVersion";
	return false;
	}
	if (!config_root_dict.GetString("hostname", &config_out->hostname)) {
	LOG(ERROR) << "Failed to parse hostname";
	return false;
	}
	if (!HostnameValid(config_out->hostname)) {
	LOG(ERROR) << "Invalid hostname " << config_out->hostname;
	return false;
	}

	// Platform info
	if (!ParsePlatformConfig(config_root_dict, config_out)) {
	return false;
	}

	// Root fs info
	if (!ParseRootFileSystemConfig(config_root_dict, config_out)) {
	return false;
	}

	// Process info
	if (!ParseProcessConfig(config_root_dict, config_out)) {
	return false;
	}

	// Get a list of mount points and mounts.
	if (!ParseMounts(config_root_dict, config_out)) {
	LOG(ERROR) << "Failed to parse mounts";
	return false;
	}

	// Parse linux node.
	if (!ParseLinuxConfigDict(config_root_dict, config_out)) {
	LOG(ERROR) << "Failed to parse the linux node";
	return false;
	}

	return true;
	}

	} // anonymous namespace

	bool ParseContainerConfig(const std::string& config_json_data,
	OciConfigPtr const& config_out) {
	std::unique_ptr<const base::Value> config_root_val =
	base::JSONReader::Read(config_json_data);
	if (!config_root_val) {
	LOG(ERROR) << "Fail to parse config.json";
	return false;
	}
	const base::DictionaryValue* config_dict = nullptr;
	if (!config_root_val->GetAsDictionary(&config_dict)) {
	LOG(ERROR) << "Fail to parse root dictionary from config.json";
	return false;
	}
	if (!ParseConfigDict(*config_dict, config_out)) {
	return false;
	}

	return true;
	}

	} // namespace run_oci