From a37109ce02c54d07e0d1f1cb348627f9675d84df Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 30 Mar 2023 14:33:04 -0700 Subject: [PATCH 1/2] tests/int/mount: fix issues with ro cgroup test Fix the following issues with the "ro /sys/fs/cgroup" test: 1. Disable bogus SC2016 warning from shellcheck. 2. Split the test into two -- with and without cgroupns. This is done because not all systems have cgroupns available (so the "+cgroupns" test will be skipped). 3. This splitting resulted in a few more bogus shellcheck warnings that we have to suppress -- due to a known bug in shellcheck (see [1]). 4. s/mount/mounts/ in the test name, because in case of cgroup v1 there are multiple mounts. [1] https://github.com/koalaman/shellcheck/issues/2431 Signed-off-by: Kir Kolyshkin --- tests/integration/mounts.bats | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/tests/integration/mounts.bats b/tests/integration/mounts.bats index 1e72c5b14..9ecf87ccf 100644 --- a/tests/integration/mounts.bats +++ b/tests/integration/mounts.bats @@ -64,19 +64,28 @@ function teardown() { [ "$status" -eq 0 ] } +@test "runc run [ro /sys/fs/cgroup mounts]" { + # Without cgroup namespace. + update_config '.linux.namespaces -= [{"type": "cgroup"}]' + test_ro_cgroup_mount +} + +# shellcheck disable=SC2030 +@test "runc run [ro /sys/fs/cgroup mounts + cgroupns]" { + requires cgroupns + # With cgroup namespace. + update_config '.linux.namespaces |= if index({"type": "cgroup"}) then . else . + [{"type": "cgroup"}] end' + test_ro_cgroup_mount +} + # https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc -@test "runc run [ro /sys/fs/cgroup mount]" { - # With cgroup namespace +# shellcheck disable=SC2031 +function test_ro_cgroup_mount() { + local lines status + # shellcheck disable=SC2016 update_config '.process.args |= ["sh", "-euc", "for f in `grep /sys/fs/cgroup /proc/mounts | awk \"{print \\\\$2}\"| uniq`; do grep -w $f /proc/mounts | tail -n1; done"]' runc run test_busybox [ "$status" -eq 0 ] [ "${#lines[@]}" -ne 0 ] for line in "${lines[@]}"; do [[ "${line}" == *'ro,'* ]]; done - - # Without cgroup namespace - update_config '.linux.namespaces -= [{"type": "cgroup"}]' - runc run test_busybox - [ "$status" -eq 0 ] - [ "${#lines[@]}" -ne 0 ] - for line in "${lines[@]}"; do [[ "${line}" == *'ro,'* ]]; done } From 370e3be202fb3e2f1e3a05f98c59ae8042b4ad97 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 30 Mar 2023 14:45:14 -0700 Subject: [PATCH 2/2] tests/int/mounts: only check non-shadowed mounts This fixes a bogus failure in "ro cgroup" test cases when running as rootless. The test finds the following mount that is not read-only: > cgroup2 /sys/fs/cgroup/unified cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate 0 0 This happens because: 1. runc spec --rootless adds an rbind /sys mounts, so we have all the /sys/fs/cgroup/XXX mounts inside the container; 2. Those /sys/fs/cgroup/XXX mounts are shadowed by the /sys/fs/cgroup tmpfs mount created by mountCgroupV1(). This means that this mount is shadowed, inaccessible, and it can not be unshadowed, thus it should not be checked. The fix is to check whether the directory exists, to exclude such shadowed mounts. NOTE that item 2 comes from commit ff692f289b60e19b3079cb; before it, we had the whole hierarchy of host /sys/fs/cgroup visible (though not writable -- because rootless) from inside of any rootless container. Signed-off-by: Kir Kolyshkin --- tests/integration/mounts.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/integration/mounts.bats b/tests/integration/mounts.bats index 9ecf87ccf..d94b412e9 100644 --- a/tests/integration/mounts.bats +++ b/tests/integration/mounts.bats @@ -83,7 +83,7 @@ function teardown() { function test_ro_cgroup_mount() { local lines status # shellcheck disable=SC2016 - update_config '.process.args |= ["sh", "-euc", "for f in `grep /sys/fs/cgroup /proc/mounts | awk \"{print \\\\$2}\"| uniq`; do grep -w $f /proc/mounts | tail -n1; done"]' + update_config '.process.args |= ["sh", "-euc", "for f in `grep /sys/fs/cgroup /proc/mounts | awk \"{print \\\\$2}\"| uniq`; do test -e $f && grep -w $f /proc/mounts | tail -n1; done"]' runc run test_busybox [ "$status" -eq 0 ] [ "${#lines[@]}" -ne 0 ]