From 370e3be202fb3e2f1e3a05f98c59ae8042b4ad97 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 30 Mar 2023 14:45:14 -0700 Subject: [PATCH] tests/int/mounts: only check non-shadowed mounts This fixes a bogus failure in "ro cgroup" test cases when running as rootless. The test finds the following mount that is not read-only: > cgroup2 /sys/fs/cgroup/unified cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate 0 0 This happens because: 1. runc spec --rootless adds an rbind /sys mounts, so we have all the /sys/fs/cgroup/XXX mounts inside the container; 2. Those /sys/fs/cgroup/XXX mounts are shadowed by the /sys/fs/cgroup tmpfs mount created by mountCgroupV1(). This means that this mount is shadowed, inaccessible, and it can not be unshadowed, thus it should not be checked. The fix is to check whether the directory exists, to exclude such shadowed mounts. NOTE that item 2 comes from commit ff692f289b60e19b3079cb; before it, we had the whole hierarchy of host /sys/fs/cgroup visible (though not writable -- because rootless) from inside of any rootless container. Signed-off-by: Kir Kolyshkin --- tests/integration/mounts.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/integration/mounts.bats b/tests/integration/mounts.bats index 9ecf87ccf..d94b412e9 100644 --- a/tests/integration/mounts.bats +++ b/tests/integration/mounts.bats @@ -83,7 +83,7 @@ function teardown() { function test_ro_cgroup_mount() { local lines status # shellcheck disable=SC2016 - update_config '.process.args |= ["sh", "-euc", "for f in `grep /sys/fs/cgroup /proc/mounts | awk \"{print \\\\$2}\"| uniq`; do grep -w $f /proc/mounts | tail -n1; done"]' + update_config '.process.args |= ["sh", "-euc", "for f in `grep /sys/fs/cgroup /proc/mounts | awk \"{print \\\\$2}\"| uniq`; do test -e $f && grep -w $f /proc/mounts | tail -n1; done"]' runc run test_busybox [ "$status" -eq 0 ] [ "${#lines[@]}" -ne 0 ]