mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Peter Hunt
6ce2d63a5d
Alas, the EPERM on chdir saga continues... Unfortunately, the there were two releases between when https://github.com/opencontainers/runc/commit/5e0e67d76cc99d76c8228d48f38f37034503f315 was released and when the workaround https://github.com/opencontainers/runc/pull/2712 was added. Between this, folks started relying on the ability to have a workdir that the container user doesn't have access to. Since this case was previously valid, we should continue support for it. Now, we retry the chdir: Once at the top of the function (to catch cases where the runc user has access, but container user does not) and once after we setup user (to catch cases where the container user has access, and the runc user does not) Add a test case for this as well. Signed-off-by: Peter Hunt <pehunt@redhat.com>
75 lines
1.8 KiB
Bash
75 lines
1.8 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
function setup() {
|
|
setup_busybox
|
|
}
|
|
|
|
function teardown() {
|
|
teardown_bundle
|
|
}
|
|
|
|
# Test case for https://github.com/opencontainers/runc/pull/2086
|
|
@test "runc exec --user with no access to cwd" {
|
|
requires root
|
|
|
|
chown 42 rootfs/root
|
|
chmod 700 rootfs/root
|
|
|
|
update_config ' .process.cwd = "/root"
|
|
| .process.user.uid = 42
|
|
| .process.args |= ["sleep", "1h"]'
|
|
|
|
runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
|
|
[ "$status" -eq 0 ]
|
|
|
|
runc exec --user 0 test_busybox true
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
# Verify a cwd owned by the container user can be chdir'd to,
|
|
# even if runc doesn't have the privilege to do so.
|
|
@test "runc create sets up user before chdir to cwd if needed" {
|
|
requires rootless rootless_idmap
|
|
|
|
# Some setup for this test (AUX_DIR and AUX_UID) is done
|
|
# by rootless.sh. Check that setup is done...
|
|
if [[ ! -d "$AUX_DIR" || -z "$AUX_UID" ]]; then
|
|
skip "bad/unset AUX_DIR/AUX_UID"
|
|
fi
|
|
# ... and is correct, i.e. the current user
|
|
# does not have permission to access AUX_DIR.
|
|
if ls -l "$AUX_DIR" 2>/dev/null; then
|
|
skip "bad AUX_DIR permissions"
|
|
fi
|
|
|
|
update_config ' .mounts += [{
|
|
source: "'"$AUX_DIR"'",
|
|
destination: "'"$AUX_DIR"'",
|
|
options: ["bind"]
|
|
}]
|
|
| .process.user.uid = '"$AUX_UID"'
|
|
| .process.cwd = "'"$AUX_DIR"'"
|
|
| .process.args |= ["ls", "'"$AUX_DIR"'"]'
|
|
|
|
runc run test_busybox
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
# Verify a cwd not owned by the container user can be chdir'd to,
|
|
# if runc does have the privilege to do so.
|
|
@test "runc create can chdir if runc has access" {
|
|
requires root
|
|
|
|
mkdir -p rootfs/home/nonroot
|
|
chmod 700 rootfs/home/nonroot
|
|
|
|
update_config ' .process.cwd = "/root"
|
|
| .process.user.uid = 42
|
|
| .process.args |= ["ls", "/tmp"]'
|
|
|
|
runc run test_busybox
|
|
[ "$status" -eq 0 ]
|
|
}
|