From 9135d99c947a144ba0ccbc0b0f90d8f7032d1d31 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Mon, 28 Sep 2020 17:15:44 -0700 Subject: [PATCH] libct/int/newTemplateConfig: add userns param It seems that a few tests add a cgroup mount in case userns is not set. Let's do it inside newTemplateConfig() for all tests. Signed-off-by: Kir Kolyshkin --- libcontainer/integration/checkpoint_test.go | 21 ++------ libcontainer/integration/exec_test.go | 60 ++++++++------------- libcontainer/integration/execin_test.go | 18 +++---- libcontainer/integration/template_test.go | 17 +++++- 4 files changed, 51 insertions(+), 65 deletions(-) diff --git a/libcontainer/integration/checkpoint_test.go b/libcontainer/integration/checkpoint_test.go index b22f48b9b..86b876664 100644 --- a/libcontainer/integration/checkpoint_test.go +++ b/libcontainer/integration/checkpoint_test.go @@ -11,9 +11,6 @@ import ( "testing" "github.com/opencontainers/runc/libcontainer" - "github.com/opencontainers/runc/libcontainer/configs" - - "golang.org/x/sys/unix" ) func showFile(t *testing.T, fname string) error { @@ -76,20 +73,10 @@ func testCheckpoint(t *testing.T, userns bool) { } defer remove(rootfs) - config := newTemplateConfig(&tParam{rootfs: rootfs}) - - if userns { - config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER}) - } else { - config.Mounts = append(config.Mounts, &configs.Mount{ - Destination: "/sys/fs/cgroup", - Device: "cgroup", - Flags: defaultMountFlags | unix.MS_RDONLY, - }) - } - + config := newTemplateConfig(&tParam{ + rootfs: rootfs, + userns: userns, + }) factory, err := libcontainer.New(root, libcontainer.Cgroupfs) if err != nil { diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go index 935a6c2c3..23ac876ca 100644 --- a/libcontainer/integration/exec_test.go +++ b/libcontainer/integration/exec_test.go @@ -40,12 +40,10 @@ func testExecPS(t *testing.T, userns bool) { rootfs, err := newRootfs() ok(t, err) defer remove(rootfs) - config := newTemplateConfig(&tParam{rootfs: rootfs}) - if userns { - config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER}) - } + config := newTemplateConfig(&tParam{ + rootfs: rootfs, + userns: userns, + }) buffers, exitCode, err := runContainer(config, "", "ps", "-o", "pid,user,comm") if err != nil { @@ -182,12 +180,10 @@ func testRlimit(t *testing.T, userns bool) { ok(t, err) defer remove(rootfs) - config := newTemplateConfig(&tParam{rootfs: rootfs}) - if userns { - config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER}) - } + config := newTemplateConfig(&tParam{ + rootfs: rootfs, + userns: userns, + }) // ensure limit is lower than what the config requests to test that in a user namespace // the Setrlimit call happens early enough that we still have permissions to raise the limit. @@ -766,11 +762,6 @@ func testCgroupResourcesUnified(t *testing.T, systemd bool) { config.Cgroups.Resources.Memory = 536870912 // 512M config.Cgroups.Resources.MemorySwap = 536870912 // 512M, i.e. no swap config.Namespaces.Add(configs.NEWCGROUP, "") - config.Mounts = append(config.Mounts, &configs.Mount{ - Destination: "/sys/fs/cgroup", - Device: "cgroup", - Flags: defaultMountFlags | unix.MS_RDONLY, - }) if systemd { config.Cgroups.Parent = "system.slice" } @@ -1101,13 +1092,6 @@ func TestMountCgroupRO(t *testing.T) { ok(t, err) defer remove(rootfs) config := newTemplateConfig(&tParam{rootfs: rootfs}) - - config.Mounts = append(config.Mounts, &configs.Mount{ - Destination: "/sys/fs/cgroup", - Device: "cgroup", - Flags: defaultMountFlags | unix.MS_RDONLY, - }) - buffers, exitCode, err := runContainer(config, "", "mount") if err != nil { t.Fatalf("%s: %s", buffers, err) @@ -1150,12 +1134,13 @@ func TestMountCgroupRW(t *testing.T) { ok(t, err) defer remove(rootfs) config := newTemplateConfig(&tParam{rootfs: rootfs}) - - config.Mounts = append(config.Mounts, &configs.Mount{ - Destination: "/sys/fs/cgroup", - Device: "cgroup", - Flags: defaultMountFlags, - }) + // clear the RO flag from cgroup mount + for _, m := range config.Mounts { + if m.Device == "cgroup" { + m.Flags = defaultMountFlags + break + } + } buffers, exitCode, err := runContainer(config, "", "mount") if err != nil { @@ -1772,10 +1757,10 @@ func TestInitJoinNetworkAndUser(t *testing.T) { defer remove(rootfs) // Execute a long-running container - config1 := newTemplateConfig(&tParam{rootfs: rootfs}) - config1.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config1.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config1.Namespaces = append(config1.Namespaces, configs.Namespace{Type: configs.NEWUSER}) + config1 := newTemplateConfig(&tParam{ + rootfs: rootfs, + userns: true, + }) container1, err := newContainer(config1) ok(t, err) defer container1.Destroy() @@ -1805,9 +1790,10 @@ func TestInitJoinNetworkAndUser(t *testing.T) { ok(t, err) defer remove(rootfs2) - config2 := newTemplateConfig(&tParam{rootfs: rootfs2}) - config2.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config2.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} + config2 := newTemplateConfig(&tParam{ + rootfs: rootfs2, + userns: true, + }) config2.Namespaces.Add(configs.NEWNET, netns1) config2.Namespaces.Add(configs.NEWUSER, userns1) config2.Cgroups.Path = "integration/test2" diff --git a/libcontainer/integration/execin_test.go b/libcontainer/integration/execin_test.go index 4215f0b92..583faa29f 100644 --- a/libcontainer/integration/execin_test.go +++ b/libcontainer/integration/execin_test.go @@ -91,12 +91,10 @@ func testExecInRlimit(t *testing.T, userns bool) { ok(t, err) defer remove(rootfs) - config := newTemplateConfig(&tParam{rootfs: rootfs}) - if userns { - config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER}) - } + config := newTemplateConfig(&tParam{ + rootfs: rootfs, + userns: userns, + }) container, err := newContainer(config) ok(t, err) @@ -557,10 +555,10 @@ func TestExecInUserns(t *testing.T) { rootfs, err := newRootfs() ok(t, err) defer remove(rootfs) - config := newTemplateConfig(&tParam{rootfs: rootfs}) - config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} - config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER}) + config := newTemplateConfig(&tParam{ + rootfs: rootfs, + userns: true, + }) container, err := newContainer(config) ok(t, err) defer container.Destroy() diff --git a/libcontainer/integration/template_test.go b/libcontainer/integration/template_test.go index af82a29f4..ac7f1797a 100644 --- a/libcontainer/integration/template_test.go +++ b/libcontainer/integration/template_test.go @@ -18,6 +18,7 @@ const defaultMountFlags = unix.MS_NOEXEC | unix.MS_NOSUID | unix.MS_NODEV type tParam struct { rootfs string + userns bool } // newTemplateConfig returns a base template for running a container @@ -29,7 +30,7 @@ func newTemplateConfig(p *tParam) *configs.Config { for _, device := range specconv.AllowedDevices { allowedDevices = append(allowedDevices, &device.DeviceRule) } - return &configs.Config{ + config := &configs.Config{ Rootfs: p.rootfs, Capabilities: &configs.Capabilities{ Bounding: []string{ @@ -195,4 +196,18 @@ func newTemplateConfig(p *tParam) *configs.Config { }, }, } + + if p.userns { + config.UidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} + config.GidMappings = []configs.IDMap{{HostID: 0, ContainerID: 0, Size: 1000}} + config.Namespaces = append(config.Namespaces, configs.Namespace{Type: configs.NEWUSER}) + } else { + config.Mounts = append(config.Mounts, &configs.Mount{ + Destination: "/sys/fs/cgroup", + Device: "cgroup", + Flags: defaultMountFlags | unix.MS_RDONLY, + }) + } + + return config }