runc exec: fail if cgroup is frozen

Currently, if a container is paused (or its cgroup is frozen), runc exec
just hangs, and it is not obvious why.

Refuse to exec in a frozen container. Add a test case.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

exec.go

@@ -116,8 +116,8 @@ func execProcess(context *cli.Context) (int, error) {
 	if err != nil {
 		return -1, err
 	}
-	if status == libcontainer.Stopped {
-		return -1, errors.New("cannot exec a container that has stopped")
+	if status == libcontainer.Stopped || status == libcontainer.Paused {
+		return -1, fmt.Errorf("cannot exec in a %s container", status)
 	}
 	path := context.String("process")
 	if path == "" && len(context.Args()) == 1 {

tests/integration/cgroups.bats

@@ -282,3 +282,22 @@ function setup() {
 	[ "$status" -eq 0 ]
 	[ "$(wc -l <<<"$output")" -eq 1 ]
 }
+
+@test "runc exec should refuse a frozen cgroup" {
+	if [[ "$ROOTLESS" -ne 0 ]]; then
+		requires rootless_cgroup
+	fi
+	requires cgroups_freezer
+
+	set_cgroups_path
+
+	runc run -d --console-socket "$CONSOLE_SOCKET" ct1
+	[ "$status" -eq 0 ]
+	runc pause ct1
+	[ "$status" -eq 0 ]
+
+	# Exec should not timeout or succeed.
+	runc exec ct1 echo ok
+	[ "$status" -eq 255 ]
+	[[ "$output" == *"container cgroup is frozen"* ]]
+}