mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

tests/int/mounts: only check non-shadowed mounts

Browse Source 
This fixes a bogus failure in "ro cgroup" test cases when running as
rootless.

The test finds the following mount that is not read-only:

> cgroup2 /sys/fs/cgroup/unified cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate 0 0

This happens because:

1. runc spec --rootless adds an rbind /sys mounts, so we have all the
   /sys/fs/cgroup/XXX mounts inside the container;

2. Those /sys/fs/cgroup/XXX mounts are shadowed by the /sys/fs/cgroup
   tmpfs mount created by mountCgroupV1().

This means that this mount is shadowed, inaccessible, and it can not be
unshadowed, thus it should not be checked.

The fix is to check whether the directory exists, to exclude such
shadowed mounts.

NOTE that item 2 comes from commit ff692f289b60e19b3079cb; before it, we
had the whole hierarchy of host /sys/fs/cgroup visible (though not
writable -- because rootless) from inside of any rootless container.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2023-03-30 14:45:14 -07:00
parent a37109ce02
commit 370e3be202
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/mounts.bats
+1 -1
View File
@@ -83,7 +83,7 @@ function teardown() {
function test_ro_cgroup_mount() {
local lines status
# shellcheck disable=SC2016
update_config '.process.args |= ["sh", "-euc", "for f in `grep /sys/fs/cgroup /proc/mounts | awk \"{print \\\\$2}\"| uniq`; do grep -w $f /proc/mounts | tail -n1; done"]'
update_config '.process.args |= ["sh", "-euc", "for f in `grep /sys/fs/cgroup /proc/mounts | awk \"{print \\\\$2}\"| uniq`; do test -e $f && grep -w $f /proc/mounts | tail -n1; done"]'
runc run test_busybox
[ "$status" -eq 0 ]
[ "${#lines[@]}" -ne 0 ]