mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Kir Kolyshkin
7324496f1a
Some test directories are created using mktemp -d, and so they have permissions set to 0700 and are thus inaccessible to a user inside userns. This was workarounded for $ROOT in userns.bats before. Now, when we have updated Cirrus CI config to use Fedora 35 (rather than 34), userns tests fail: > runc run failed: unable to start container process: error during > container init: error preparing rootfs: mount > /tmp/bats-run-4pCERd/runc.f66gCC/bundle/rootfs:/tmp/bats-run-4pCERd/runc.f66gCC/bundle/rootfs, > flags: 0x5000: permission denied Fedora 34 image used kernel v5.11, while Fedora 35 has v5.15. Apparently, the newer kernel also checks that the parent directories are accessible by the user before doing mount. Move the old workaround from userns.bats to helpers.bats, drop the r bit (not needed), and add $BATS_RUN_TMPDIR (also created by mktemp -d) to fix userns.bats test failures under Fedora 35. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
67 lines
2.3 KiB
Bash
67 lines
2.3 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
function setup() {
|
|
setup_busybox
|
|
|
|
# Prepare source folders for bind mount
|
|
mkdir -p source-{accessible,inaccessible-1,inaccessible-2}/dir
|
|
touch source-{accessible,inaccessible-1,inaccessible-2}/dir/foo.txt
|
|
|
|
# Permissions only to the owner, it is inaccessible to group/others
|
|
chmod 700 source-inaccessible-{1,2}
|
|
|
|
mkdir -p rootfs/{proc,sys,tmp}
|
|
mkdir -p rootfs/tmp/mount-{1,2}
|
|
|
|
if [ "$ROOTLESS" -eq 0 ]; then
|
|
update_config ' .linux.namespaces += [{"type": "user"}]
|
|
| .linux.uidMappings += [{"hostID": 100000, "containerID": 0, "size": 65534}]
|
|
| .linux.gidMappings += [{"hostID": 100000, "containerID": 0, "size": 65534}] '
|
|
fi
|
|
}
|
|
|
|
function teardown() {
|
|
teardown_bundle
|
|
}
|
|
|
|
@test "userns with simple mount" {
|
|
update_config ' .process.args += ["-c", "stat /tmp/mount-1/foo.txt"]
|
|
| .mounts += [{"source": "source-accessible/dir", "destination": "/tmp/mount-1", "options": ["bind"]}] '
|
|
|
|
runc run test_busybox
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
# We had bugs where 1 mount worked but not 2+, test with 2 as it is a more
|
|
# general case.
|
|
@test "userns with 2 inaccessible mounts" {
|
|
update_config ' .process.args += ["-c", "stat /tmp/mount-1/foo.txt /tmp/mount-2/foo.txt"]
|
|
| .mounts += [ { "source": "source-inaccessible-1/dir", "destination": "/tmp/mount-1", "options": ["bind"] },
|
|
{ "source": "source-inaccessible-2/dir", "destination": "/tmp/mount-2", "options": ["bind"] }
|
|
]'
|
|
|
|
# When not running rootless, this should work: while
|
|
# "source-inaccessible-1" can't be read by the uid in the userns, the fd
|
|
# is opened before changing to the userns and sent over via SCM_RIGHTs
|
|
# (with env var _LIBCONTAINER_MOUNT_FDS). Idem for
|
|
# source-inaccessible-2.
|
|
# On rootless, the owner is the same so it is accessible.
|
|
runc run test_busybox
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
# exec + bindmounts + user ns is a special case in the code. Test that it works.
|
|
@test "userns with inaccessible mount + exec" {
|
|
update_config ' .mounts += [ { "source": "source-inaccessible-1/dir", "destination": "/tmp/mount-1", "options": ["bind"] },
|
|
{ "source": "source-inaccessible-2/dir", "destination": "/tmp/mount-2", "options": ["bind"] }
|
|
]'
|
|
|
|
runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
|
|
[ "$status" -eq 0 ]
|
|
|
|
runc exec test_busybox stat /tmp/mount-1/foo.txt /tmp/mount-2/foo.txt
|
|
[ "$status" -eq 0 ]
|
|
}
|