mirror of
https://github.com/GoogleContainerTools/kaniko
synced 2026-10-17 20:16:15 +02:00
Move and fix GetContainerRuntime check from bpfd proc (#1996)
* Moved genuinetools/bpfd proc * Removed unused code from util/proc, added genuinetools/bpfd proc test, fixed naming * refactor: adjust bpfd container runtime detection * Moved util/proc.go to util/proc/proc.go, added boilerplate Co-authored-by: ejose19 <8742215+ejose19@users.noreply.github.com>
This commit is contained in:
Igor Scheller
-21
@@ -1,21 +0,0 @@
|
||||
The MIT License (MIT)
|
||||
|
||||
Copyright (c) 2018 The Genuinetools Authors
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
-557
@@ -1,557 +0,0 @@
|
||||
// Package proc provides tools for inspecting proc.
|
||||
package proc
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"regexp"
|
||||
"strconv"
|
||||
"strings"
|
||||
"syscall"
|
||||
|
||||
"github.com/syndtr/gocapability/capability"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
// ContainerRuntime is the type for the various container runtime strings.
|
||||
type ContainerRuntime string
|
||||
|
||||
// SeccompMode is the type for the various seccomp mode strings.
|
||||
type SeccompMode string
|
||||
|
||||
const (
|
||||
// RuntimeDocker is the string for the docker runtime.
|
||||
RuntimeDocker ContainerRuntime = "docker"
|
||||
// RuntimeRkt is the string for the rkt runtime.
|
||||
RuntimeRkt ContainerRuntime = "rkt"
|
||||
// RuntimeNspawn is the string for the systemd-nspawn runtime.
|
||||
RuntimeNspawn ContainerRuntime = "systemd-nspawn"
|
||||
// RuntimeLXC is the string for the lxc runtime.
|
||||
RuntimeLXC ContainerRuntime = "lxc"
|
||||
// RuntimeLXCLibvirt is the string for the lxc-libvirt runtime.
|
||||
RuntimeLXCLibvirt ContainerRuntime = "lxc-libvirt"
|
||||
// RuntimeOpenVZ is the string for the openvz runtime.
|
||||
RuntimeOpenVZ ContainerRuntime = "openvz"
|
||||
// RuntimeKubernetes is the string for the kubernetes runtime.
|
||||
RuntimeKubernetes ContainerRuntime = "kube"
|
||||
// RuntimeGarden is the string for the garden runtime.
|
||||
RuntimeGarden ContainerRuntime = "garden"
|
||||
// RuntimePodman is the string for the podman runtime.
|
||||
RuntimePodman ContainerRuntime = "podman"
|
||||
// RuntimeGVisor is the string for the gVisor (runsc) runtime.
|
||||
RuntimeGVisor ContainerRuntime = "gvisor"
|
||||
// RuntimeFirejail is the string for the firejail runtime.
|
||||
RuntimeFirejail ContainerRuntime = "firejail"
|
||||
// RuntimeWSL is the string for the Windows Subsystem for Linux runtime.
|
||||
RuntimeWSL ContainerRuntime = "wsl"
|
||||
// RuntimeNotFound is the string for when no container runtime is found.
|
||||
RuntimeNotFound ContainerRuntime = "not-found"
|
||||
|
||||
// SeccompModeDisabled is equivalent to "0" in the /proc/{pid}/status file.
|
||||
SeccompModeDisabled SeccompMode = "disabled"
|
||||
// SeccompModeStrict is equivalent to "1" in the /proc/{pid}/status file.
|
||||
SeccompModeStrict SeccompMode = "strict"
|
||||
// SeccompModeFiltering is equivalent to "2" in the /proc/{pid}/status file.
|
||||
SeccompModeFiltering SeccompMode = "filtering"
|
||||
|
||||
apparmorUnconfined = "unconfined"
|
||||
|
||||
uint32Max = 4294967295
|
||||
|
||||
cgroupContainerID = ":(/docker/|/kube.*/.*/|/kube.*/.*/.*/.*/|/system.slice/docker-|/machine.slice/machine-rkt-|/machine.slice/machine-|/lxc/|/lxc-libvirt/|/garden/|/podman/)([[:alnum:]\\-]{1,64})(.scope|$)"
|
||||
statusFileValue = ":(.*)"
|
||||
)
|
||||
|
||||
var (
|
||||
// ContainerRuntimes contains all the container runtimes.
|
||||
ContainerRuntimes = []ContainerRuntime{
|
||||
RuntimeDocker,
|
||||
RuntimeRkt,
|
||||
RuntimeNspawn,
|
||||
RuntimeLXC,
|
||||
RuntimeLXCLibvirt,
|
||||
RuntimeOpenVZ,
|
||||
RuntimeKubernetes,
|
||||
RuntimeGarden,
|
||||
RuntimePodman,
|
||||
RuntimeGVisor,
|
||||
RuntimeFirejail,
|
||||
RuntimeWSL,
|
||||
}
|
||||
|
||||
seccompModes = map[string]SeccompMode{
|
||||
"0": SeccompModeDisabled,
|
||||
"1": SeccompModeStrict,
|
||||
"2": SeccompModeFiltering,
|
||||
}
|
||||
|
||||
cgroupContainerIDRegex = regexp.MustCompile(cgroupContainerID)
|
||||
statusFileValueRegex = regexp.MustCompile(statusFileValue)
|
||||
)
|
||||
|
||||
// GetContainerRuntime returns the container runtime the process is running in.
|
||||
// If pid is less than one, it returns the runtime for "self".
|
||||
func GetContainerRuntime(tgid, pid int) ContainerRuntime {
|
||||
file := "/proc/self/cgroup"
|
||||
if pid > 0 {
|
||||
if tgid > 0 {
|
||||
file = fmt.Sprintf("/proc/%d/task/%d/cgroup", tgid, pid)
|
||||
} else {
|
||||
file = fmt.Sprintf("/proc/%d/cgroup", pid)
|
||||
}
|
||||
}
|
||||
|
||||
// read the cgroups file
|
||||
a := readFileString(file)
|
||||
runtime := getContainerRuntime(a)
|
||||
if runtime != RuntimeNotFound {
|
||||
return runtime
|
||||
}
|
||||
|
||||
// /proc/vz exists in container and outside of the container, /proc/bc only outside of the container.
|
||||
if fileExists("/proc/vz") && !fileExists("/proc/bc") {
|
||||
return RuntimeOpenVZ
|
||||
}
|
||||
|
||||
// /__runsc_containers__ directory is present in gVisor containers.
|
||||
if fileExists("/__runsc_containers__") {
|
||||
return RuntimeGVisor
|
||||
}
|
||||
|
||||
// firejail runs with `firejail` as pid 1.
|
||||
// As firejail binary cannot be run with argv[0] != "firejail"
|
||||
// it's okay to rely on cmdline.
|
||||
a = readFileString("/proc/1/cmdline")
|
||||
runtime = getContainerRuntime(a)
|
||||
if runtime != RuntimeNotFound {
|
||||
return runtime
|
||||
}
|
||||
|
||||
// WSL has /proc/version_signature starting with "Microsoft".
|
||||
a = readFileString("/proc/version_signature")
|
||||
if strings.HasPrefix(a, "Microsoft") {
|
||||
return RuntimeWSL
|
||||
}
|
||||
|
||||
a = os.Getenv("container")
|
||||
runtime = getContainerRuntime(a)
|
||||
if runtime != RuntimeNotFound {
|
||||
return runtime
|
||||
}
|
||||
|
||||
// PID 1 might have dropped this information into a file in /run.
|
||||
// Read from /run/systemd/container since it is better than accessing /proc/1/environ,
|
||||
// which needs CAP_SYS_PTRACE
|
||||
a = readFileString("/run/systemd/container")
|
||||
runtime = getContainerRuntime(a)
|
||||
if runtime != RuntimeNotFound {
|
||||
return runtime
|
||||
}
|
||||
|
||||
return RuntimeNotFound
|
||||
}
|
||||
|
||||
func getContainerRuntime(input string) ContainerRuntime {
|
||||
if len(strings.TrimSpace(input)) < 1 {
|
||||
return RuntimeNotFound
|
||||
}
|
||||
|
||||
for _, runtime := range ContainerRuntimes {
|
||||
if strings.Contains(input, string(runtime)) {
|
||||
return runtime
|
||||
}
|
||||
}
|
||||
|
||||
return RuntimeNotFound
|
||||
}
|
||||
|
||||
// GetContainerID returns the container ID for a process if it's running in a container.
|
||||
// If pid is less than one, it returns the container ID for "self".
|
||||
func GetContainerID(tgid, pid int) string {
|
||||
file := "/proc/self/cgroup"
|
||||
if pid > 0 {
|
||||
if tgid > 0 {
|
||||
file = fmt.Sprintf("/proc/%d/task/%d/cgroup", tgid, pid)
|
||||
} else {
|
||||
file = fmt.Sprintf("/proc/%d/cgroup", pid)
|
||||
}
|
||||
}
|
||||
|
||||
return getContainerID(readFileString(file))
|
||||
}
|
||||
|
||||
func getContainerID(input string) string {
|
||||
if len(strings.TrimSpace(input)) < 1 {
|
||||
return ""
|
||||
}
|
||||
|
||||
// rkt encodes the dashes as ascii, replace them.
|
||||
input = strings.Replace(input, `\x2d`, "-", -1)
|
||||
|
||||
lines := strings.Split(input, "\n")
|
||||
for _, line := range lines {
|
||||
matches := cgroupContainerIDRegex.FindStringSubmatch(line)
|
||||
if len(matches) > 2 {
|
||||
return matches[2]
|
||||
}
|
||||
}
|
||||
|
||||
return ""
|
||||
}
|
||||
|
||||
// GetAppArmorProfile determines the AppArmor profile for a process.
|
||||
// If pid is less than one, it returns the AppArmor profile for "self".
|
||||
func GetAppArmorProfile(pid int) string {
|
||||
file := "/proc/self/attr/current"
|
||||
if pid > 0 {
|
||||
file = fmt.Sprintf("/proc/%d/attr/current", pid)
|
||||
}
|
||||
|
||||
f := readFileString(file)
|
||||
if f == "" {
|
||||
return apparmorUnconfined
|
||||
}
|
||||
return f
|
||||
}
|
||||
|
||||
// UserMapping holds the values for a {uid,gid}_map.
|
||||
type UserMapping struct {
|
||||
ContainerID int64
|
||||
HostID int64
|
||||
Range int64
|
||||
}
|
||||
|
||||
// GetUserNamespaceInfo determines if the process is running in a UserNamespace
|
||||
// and returns the mappings if true.
|
||||
// If pid is less than one, it returns the user namespace info for "self".
|
||||
func GetUserNamespaceInfo(pid int) (bool, []UserMapping) {
|
||||
file := "/proc/self/uid_map"
|
||||
if pid > 0 {
|
||||
file = fmt.Sprintf("/proc/%d/uid_map", pid)
|
||||
}
|
||||
|
||||
f := readFileString(file)
|
||||
if len(f) < 0 {
|
||||
// user namespace is uninitialized
|
||||
return true, nil
|
||||
}
|
||||
|
||||
userNs, mappings, err := readUserMappings(f)
|
||||
if err != nil {
|
||||
return false, nil
|
||||
}
|
||||
|
||||
return userNs, mappings
|
||||
}
|
||||
|
||||
func readUserMappings(f string) (iuserNS bool, mappings []UserMapping, err error) {
|
||||
parts := strings.Split(f, " ")
|
||||
parts = deleteEmpty(parts)
|
||||
if len(parts) < 3 {
|
||||
return false, nil, nil
|
||||
}
|
||||
|
||||
for i := 0; i < len(parts); i += 3 {
|
||||
nsu, hu, r := parts[i], parts[i+1], parts[i+2]
|
||||
mapping := UserMapping{}
|
||||
|
||||
mapping.ContainerID, err = strconv.ParseInt(nsu, 10, 0)
|
||||
if err != nil {
|
||||
return false, nil, nil
|
||||
}
|
||||
mapping.HostID, err = strconv.ParseInt(hu, 10, 0)
|
||||
if err != nil {
|
||||
return false, nil, nil
|
||||
}
|
||||
mapping.Range, err = strconv.ParseInt(r, 10, 0)
|
||||
if err != nil {
|
||||
return false, nil, nil
|
||||
}
|
||||
|
||||
if mapping.ContainerID == 0 && mapping.HostID == 0 && mapping.Range == uint32Max {
|
||||
return false, nil, nil
|
||||
}
|
||||
|
||||
mappings = append(mappings, mapping)
|
||||
}
|
||||
|
||||
return true, mappings, nil
|
||||
}
|
||||
|
||||
// GetCapabilities returns the allowed capabilities for the process.
|
||||
// If pid is less than one, it returns the capabilities for "self".
|
||||
func GetCapabilities(pid int) (map[string][]string, error) {
|
||||
allCaps := capability.List()
|
||||
|
||||
caps, err := capability.NewPid(pid)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
allowedCaps := map[string][]string{}
|
||||
allowedCaps["EFFECTIVE | PERMITTED | INHERITABLE"] = []string{}
|
||||
allowedCaps["BOUNDING"] = []string{}
|
||||
allowedCaps["AMBIENT"] = []string{}
|
||||
|
||||
for _, cap := range allCaps {
|
||||
if caps.Get(capability.CAPS, cap) {
|
||||
allowedCaps["EFFECTIVE | PERMITTED | INHERITABLE"] = append(allowedCaps["EFFECTIVE | PERMITTED | INHERITABLE"], cap.String())
|
||||
}
|
||||
if caps.Get(capability.BOUNDING, cap) {
|
||||
allowedCaps["BOUNDING"] = append(allowedCaps["BOUNDING"], cap.String())
|
||||
}
|
||||
if caps.Get(capability.AMBIENT, cap) {
|
||||
allowedCaps["AMBIENT"] = append(allowedCaps["AMBIENT"], cap.String())
|
||||
}
|
||||
}
|
||||
|
||||
return allowedCaps, nil
|
||||
}
|
||||
|
||||
// GetUIDGID returns the uid and gid for a process.
|
||||
// If pid is less than one, it returns the seccomp enforcing mode for "self".
|
||||
func GetUIDGID(tgid, pid int) (uint32, uint32, error) {
|
||||
file := "/proc/self/status"
|
||||
if pid > 0 {
|
||||
if tgid > 0 {
|
||||
file = fmt.Sprintf("/proc/%d/task/%d/status", tgid, pid)
|
||||
} else {
|
||||
file = fmt.Sprintf("/proc/%d/status", pid)
|
||||
}
|
||||
}
|
||||
|
||||
return getUIDGID(readFileString(file))
|
||||
}
|
||||
|
||||
func getUIDGID(input string) (uint32, uint32, error) {
|
||||
// Split status file string by line
|
||||
statusMappings := strings.Split(input, "\n")
|
||||
statusMappings = deleteEmpty(statusMappings)
|
||||
|
||||
var uid, gid string
|
||||
for _, line := range statusMappings {
|
||||
if strings.Contains(line, "Uid:") {
|
||||
matches := statusFileValueRegex.FindStringSubmatch(line)
|
||||
if len(matches) > 1 {
|
||||
uid = matches[1]
|
||||
continue
|
||||
}
|
||||
}
|
||||
if strings.Contains(line, "Gid:") {
|
||||
matches := statusFileValueRegex.FindStringSubmatch(line)
|
||||
if len(matches) > 1 {
|
||||
gid = matches[1]
|
||||
continue
|
||||
}
|
||||
}
|
||||
if len(uid) > 0 && len(gid) > 0 {
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if len(uid) < 1 && len(gid) < 1 {
|
||||
return 0, 0, nil
|
||||
}
|
||||
|
||||
u, err := strconv.Atoi(strings.Split(strings.Split(strings.TrimSpace(uid), " ")[0], "\t")[0])
|
||||
if err != nil {
|
||||
return 0, 0, err
|
||||
}
|
||||
g, err := strconv.Atoi(strings.Split(strings.Split(strings.TrimSpace(gid), " ")[0], "\t")[0])
|
||||
if err != nil {
|
||||
return 0, 0, err
|
||||
}
|
||||
|
||||
return uint32(u), uint32(g), nil
|
||||
}
|
||||
|
||||
// GetSeccompEnforcingMode returns the seccomp enforcing level (disabled, filtering, strict)
|
||||
// for a process.
|
||||
// If pid is less than one, it returns the seccomp enforcing mode for "self".
|
||||
func GetSeccompEnforcingMode(pid int) SeccompMode {
|
||||
file := "/proc/self/status"
|
||||
if pid > 0 {
|
||||
file = fmt.Sprintf("/proc/%d/status", pid)
|
||||
}
|
||||
|
||||
return getSeccompEnforcingMode(readFileString(file))
|
||||
}
|
||||
|
||||
func getSeccompEnforcingMode(input string) SeccompMode {
|
||||
mode := getStatusEntry(input, "Seccomp:")
|
||||
sm, ok := seccompModes[mode]
|
||||
if ok {
|
||||
return sm
|
||||
}
|
||||
|
||||
// Pre linux 3.8, check if Seccomp is supported, via CONFIG_SECCOMP.
|
||||
if err := unix.Prctl(unix.PR_GET_SECCOMP, 0, 0, 0, 0); err != unix.EINVAL {
|
||||
// Make sure the kernel has CONFIG_SECCOMP_FILTER.
|
||||
if err := unix.Prctl(unix.PR_SET_SECCOMP, unix.SECCOMP_MODE_FILTER, 0, 0, 0); err != unix.EINVAL {
|
||||
return SeccompModeStrict
|
||||
}
|
||||
}
|
||||
|
||||
return SeccompModeDisabled
|
||||
}
|
||||
|
||||
// GetNoNewPrivileges returns if no_new_privileges is set
|
||||
// for a process.
|
||||
// If pid is less than one, it returns if set for "self".
|
||||
func GetNoNewPrivileges(pid int) bool {
|
||||
file := "/proc/self/status"
|
||||
if pid > 0 {
|
||||
file = fmt.Sprintf("/proc/%d/status", pid)
|
||||
}
|
||||
|
||||
return getNoNewPrivileges(readFileString(file))
|
||||
}
|
||||
|
||||
func getNoNewPrivileges(input string) bool {
|
||||
return getStatusEntry(input, "NoNewPrivs:") == "1"
|
||||
}
|
||||
|
||||
// GetCmdline returns the cmdline for a process.
|
||||
// If pid is less than one, it returns the cmdline for "self".
|
||||
func GetCmdline(pid int) []string {
|
||||
file := "/proc/self/cmdline"
|
||||
if pid > 0 {
|
||||
file = fmt.Sprintf("/proc/%d/cmdline", pid)
|
||||
}
|
||||
|
||||
return parseProcFile(readFile(file))
|
||||
}
|
||||
|
||||
// GetEnviron returns the environ for a process.
|
||||
// If pid is less than one, it returns the environ for "self".
|
||||
func GetEnviron(pid int) []string {
|
||||
file := "/proc/self/environ"
|
||||
if pid > 0 {
|
||||
file = fmt.Sprintf("/proc/%d/environ", pid)
|
||||
}
|
||||
|
||||
return parseProcFile(readFile(file))
|
||||
}
|
||||
|
||||
// GetCwd returns the current working directory for the process.
|
||||
// If pid is less than one, it returns the current working directory for "self".
|
||||
func GetCwd(pid int) string {
|
||||
file := "/proc/self/cwd"
|
||||
if pid > 0 {
|
||||
file = fmt.Sprintf("/proc/%d/cwd", pid)
|
||||
}
|
||||
|
||||
cwd, err := os.Readlink(file)
|
||||
if err != nil {
|
||||
if os.IsPermission(err) {
|
||||
// Ignore the permission errors or the logs are noisy.
|
||||
return ""
|
||||
}
|
||||
// Ignore errors in general.
|
||||
return ""
|
||||
}
|
||||
|
||||
return cwd
|
||||
}
|
||||
|
||||
// TODO: make this function more efficient and read the file line by line.
|
||||
func getStatusEntry(input, find string) string {
|
||||
// Split status file string by line
|
||||
statusMappings := strings.Split(input, "\n")
|
||||
statusMappings = deleteEmpty(statusMappings)
|
||||
|
||||
for _, line := range statusMappings {
|
||||
if strings.Contains(line, find) {
|
||||
matches := statusFileValueRegex.FindStringSubmatch(line)
|
||||
if len(matches) > 1 {
|
||||
return strings.TrimSpace(matches[1])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return ""
|
||||
}
|
||||
|
||||
func fileExists(file string) bool {
|
||||
if _, err := os.Stat(file); !os.IsNotExist(err) {
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func readFile(file string) []byte {
|
||||
if !fileExists(file) {
|
||||
return nil
|
||||
}
|
||||
|
||||
b, _ := ioutil.ReadFile(file)
|
||||
return b
|
||||
}
|
||||
|
||||
func readFileString(file string) string {
|
||||
b := readFile(file)
|
||||
if b == nil {
|
||||
return ""
|
||||
}
|
||||
return strings.TrimSpace(string(b))
|
||||
}
|
||||
|
||||
func deleteEmpty(s []string) []string {
|
||||
var r []string
|
||||
for _, str := range s {
|
||||
if strings.TrimSpace(str) != "" {
|
||||
r = append(r, strings.TrimSpace(str))
|
||||
}
|
||||
}
|
||||
return r
|
||||
}
|
||||
|
||||
func parseProcFile(data []byte) []string {
|
||||
if len(data) < 1 {
|
||||
return nil
|
||||
}
|
||||
if data[len(data)-1] == 0 {
|
||||
data = data[:len(data)-1]
|
||||
}
|
||||
parts := bytes.Split(data, []byte{0})
|
||||
var strParts []string
|
||||
for _, p := range parts {
|
||||
strParts = append(strParts, string(p))
|
||||
}
|
||||
|
||||
return strParts
|
||||
}
|
||||
|
||||
// IsValidContainerRuntime checks if a string is a valid container runtime.
|
||||
func IsValidContainerRuntime(s string) bool {
|
||||
for _, b := range ContainerRuntimes {
|
||||
if string(b) == s {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// HasNamespace determines if a container is using a particular namespace or the
|
||||
// host namespace.
|
||||
// The device number of an unnamespaced /proc/1/ns/{ns} is 4 and anything else is
|
||||
// higher.
|
||||
// Only works from inside a container.
|
||||
func HasNamespace(ns string) (bool, error) {
|
||||
file := fmt.Sprintf("/proc/1/ns/%s", ns)
|
||||
|
||||
// Use Lstat to not follow the symlink.
|
||||
var info syscall.Stat_t
|
||||
if err := syscall.Lstat(file, &info); err != nil {
|
||||
return false, &os.PathError{Op: "lstat", Path: file, Err: err}
|
||||
}
|
||||
|
||||
// Get the device number. If it is higher than 4 it is in a namespace.
|
||||
if info.Dev > 4 {
|
||||
return true, nil
|
||||
}
|
||||
|
||||
return false, nil
|
||||
}
|
||||
Reference in New Issue
Block a user