3 files changed, 66 insertions, 7 deletions
diff --git a/runsc/container/BUILD b/runsc/container/BUILD
index ebe77165e..e246c38ae 100644
--- a/runsc/container/BUILD
+++ b/runsc/container/BUILD
@@ -53,6 +53,7 @@ go_test(
         "//pkg/unet",
         "//pkg/urpc",
         "//runsc/boot",
+        "//runsc/boot/platforms",
         "//runsc/specutils",
         "//runsc/test/testutil",
         "@com_github_cenkalti_backoff//:go_default_library",
diff --git a/runsc/container/container.go b/runsc/container/container.go
index bde46fb9b..8320bb2ca 100644
--- a/runsc/container/container.go
+++ b/runsc/container/container.go
@@ -206,7 +206,7 @@ func findContainerRoot(rootDir, partialID string) (string, error) {
 	}
 
 	// Now see whether id could be an abbreviation of exactly 1 of the
-	// container ids. If id is ambigious (it could match more than 1
+	// container ids. If id is ambiguous (it could match more than 1
 	// container), it is an error.
 	cRoot = ""
 	ids, err := List(rootDir)
@@ -273,7 +273,7 @@ type Args struct {
 	Attached bool
 }
 
-// Create creates the container in a new Sandbox process, unless the metadata
+// New creates the container in a new Sandbox process, unless the metadata
 // indicates that an existing Sandbox should be used. The caller must call
 // Destroy() on the container.
 func New(conf *boot.Config, args Args) (*Container, error) {
@@ -329,7 +329,7 @@ func New(conf *boot.Config, args Args) (*Container, error) {
 		log.Debugf("Creating new sandbox for container %q", args.ID)
 
 		// Create and join cgroup before processes are created to ensure they are
-		// part of the cgroup from the start (and all tneir children processes).
+		// part of the cgroup from the start (and all their children processes).
 		cg, err := cgroup.New(args.Spec)
 		if err != nil {
 			return nil, err
@@ -446,7 +446,7 @@ func (c *Container) Start(conf *boot.Config) error {
 		}
 	} else {
 		// Join cgroup to strt gofer process to ensure it's part of the cgroup from
-		// the start (and all tneir children processes).
+		// the start (and all their children processes).
 		if err := runInCgroup(c.Sandbox.Cgroup, func() error {
 			// Create the gofer process.
 			ioFiles, mountsFile, err := c.createGoferProcess(c.Spec, conf, c.BundleDir)
@@ -514,7 +514,7 @@ func Run(conf *boot.Config, args Args) (syscall.WaitStatus, error) {
 	if err != nil {
 		return 0, fmt.Errorf("creating container: %v", err)
 	}
-	// Clean up partially created container if an error ocurrs.
+	// Clean up partially created container if an error occurs.
 	// Any errors returned by Destroy() itself are ignored.
 	cu := specutils.MakeCleanup(func() {
 		c.Destroy()
diff --git a/runsc/container/container_test.go b/runsc/container/container_test.go
index e0786866b..c1d6ca7b8 100644
--- a/runsc/container/container_test.go
+++ b/runsc/container/container_test.go
@@ -17,6 +17,7 @@ package container
 import (
 	"bytes"
 	"fmt"
+	"io"
 	"io/ioutil"
 	"os"
 	"path"
@@ -36,6 +37,7 @@ import (
 	"gvisor.dev/gvisor/pkg/sentry/control"
 	"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
 	"gvisor.dev/gvisor/runsc/boot"
+	"gvisor.dev/gvisor/runsc/boot/platforms"
 	"gvisor.dev/gvisor/runsc/specutils"
 	"gvisor.dev/gvisor/runsc/test/testutil"
 )
@@ -256,7 +258,7 @@ func configs(opts ...configOption) []*boot.Config {
 			if testutil.RaceEnabled {
 				continue
 			}
-			c.Platform = boot.PlatformKVM
+			c.Platform = platforms.KVM
 		case nonExclusiveFS:
 			c.FileAccess = boot.FileAccessShared
 		default:
@@ -408,6 +410,46 @@ func TestLifecycle(t *testing.T) {
 
 // Test the we can execute the application with different path formats.
 func TestExePath(t *testing.T) {
+	// Create two directories that will be prepended to PATH.
+	firstPath, err := ioutil.TempDir(testutil.TmpDir(), "first")
+	if err != nil {
+		t.Fatal(err)
+	}
+	secondPath, err := ioutil.TempDir(testutil.TmpDir(), "second")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Create two minimal executables in the second path, two of which
+	// will be masked by files in first path.
+	for _, p := range []string{"unmasked", "masked1", "masked2"} {
+		path := filepath.Join(secondPath, p)
+		f, err := os.OpenFile(path, os.O_CREATE|os.O_EXCL|os.O_RDWR, 0777)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer f.Close()
+		if _, err := io.WriteString(f, "#!/bin/true\n"); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// Create a non-executable file in the first path which masks a healthy
+	// executable in the second.
+	nonExecutable := filepath.Join(firstPath, "masked1")
+	f2, err := os.OpenFile(nonExecutable, os.O_CREATE|os.O_EXCL, 0666)
+	if err != nil {
+		t.Fatal(err)
+	}
+	f2.Close()
+
+	// Create a non-regular file in the first path which masks a healthy
+	// executable in the second.
+	nonRegular := filepath.Join(firstPath, "masked2")
+	if err := os.Mkdir(nonRegular, 0777); err != nil {
+		t.Fatal(err)
+	}
+
 	for _, conf := range configs(overlay) {
 		t.Logf("Running test with conf: %+v", conf)
 		for _, test := range []struct {
@@ -420,8 +462,24 @@ func TestExePath(t *testing.T) {
 			{path: "thisfiledoesntexit", success: false},
 			{path: "bin/thisfiledoesntexit", success: false},
 			{path: "/bin/thisfiledoesntexit", success: false},
+
+			{path: "unmasked", success: true},
+			{path: filepath.Join(firstPath, "unmasked"), success: false},
+			{path: filepath.Join(secondPath, "unmasked"), success: true},
+
+			{path: "masked1", success: true},
+			{path: filepath.Join(firstPath, "masked1"), success: false},
+			{path: filepath.Join(secondPath, "masked1"), success: true},
+
+			{path: "masked2", success: true},
+			{path: filepath.Join(firstPath, "masked2"), success: false},
+			{path: filepath.Join(secondPath, "masked2"), success: true},
 		} {
 			spec := testutil.NewSpecWithArgs(test.path)
+			spec.Process.Env = []string{
+				fmt.Sprintf("PATH=%s:%s:%s", firstPath, secondPath, os.Getenv("PATH")),
+			}
+
 			rootDir, bundleDir, err := testutil.SetupContainer(spec, conf)
 			if err != nil {
 				t.Fatalf("exec: %s, error setting up container: %v", test.path, err)
@@ -831,7 +889,7 @@ func TestUnixDomainSockets(t *testing.T) {
 		t.Logf("Running test with conf: %+v", conf)
 
 		// UDS path is limited to 108 chars for compatibility with older systems.
-		// Use '/tmp' (instead of testutil.TmpDir) to to ensure the size limit is
+		// Use '/tmp' (instead of testutil.TmpDir) to ensure the size limit is
 		// not exceeded. Assumes '/tmp' exists in the system.
 		dir, err := ioutil.TempDir("/tmp", "uds-test")
 		if err != nil {