mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 22:37:14 +08:00
Kir Kolyshkin
5dd92fd9b4
This fixes using runc with podman on my system (Fedora 34).
> $ podman --runtime `pwd`/runc run --rm --memory 4M fedora echo it works
> Error: unable to start container process: error adding seccomp filter rule for syscall bdflush: permission denied: OCI permission denied
The problem is, libseccomp returns EPERM when a redundant rule (i.e. the
rule with the same action as the default one) is added, and podman (on
my machine) sets the following rules in config.json:
<....>
"seccomp": {
"defaultAction": "SCMP_ACT_ERRNO",
"architectures": [
"SCMP_ARCH_X86_64",
"SCMP_ARCH_X86",
"SCMP_ARCH_X32"
],
"syscalls": [
{
"names": [
"bdflush",
"io_pgetevents",
<....>
],
"action": "SCMP_ACT_ERRNO",
"errnoRet": 1
},
<....>
(Note that defaultErrnoRet is not set, but it defaults to 1).
With this commit, it works:
> $ podman --runtime `pwd`/runc run --memory 4M fedora echo it works
> it works
Add an integration test (that fails without the fix).
Similar crun commit:
* https://github.com/containers/crun/commit/08229f3fb904c5ea19a7d9
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
91 lines
1.9 KiB
Bash
91 lines
1.9 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
function setup() {
|
|
setup_hello
|
|
}
|
|
|
|
function teardown() {
|
|
teardown_bundle
|
|
}
|
|
|
|
@test "runc run" {
|
|
# run hello-world
|
|
runc run test_hello
|
|
[ "$status" -eq 0 ]
|
|
|
|
# check expected output
|
|
[[ "${output}" == *"Hello"* ]]
|
|
}
|
|
|
|
@test "runc run ({u,g}id != 0)" {
|
|
# cannot start containers as another user in rootless setup without idmap
|
|
[[ "$ROOTLESS" -ne 0 ]] && requires rootless_idmap
|
|
|
|
# replace "uid": 0 with "uid": 1000
|
|
# and do a similar thing for gid.
|
|
update_config ' (.. | select(.uid? == 0)) .uid |= 1000
|
|
| (.. | select(.gid? == 0)) .gid |= 100'
|
|
|
|
# run hello-world
|
|
runc run test_hello
|
|
[ "$status" -eq 0 ]
|
|
|
|
# check expected output
|
|
[[ "${output}" == *"Hello"* ]]
|
|
}
|
|
|
|
@test "runc run with rootfs set to ." {
|
|
cp config.json rootfs/.
|
|
rm config.json
|
|
cd rootfs
|
|
update_config '(.. | select(. == "rootfs")) |= "."'
|
|
|
|
# run hello-world
|
|
runc run test_hello
|
|
[ "$status" -eq 0 ]
|
|
[[ "${output}" == *"Hello"* ]]
|
|
}
|
|
|
|
@test "runc run --pid-file" {
|
|
# run hello-world
|
|
runc run --pid-file pid.txt test_hello
|
|
[ "$status" -eq 0 ]
|
|
[[ "${output}" == *"Hello"* ]]
|
|
|
|
# check pid.txt was generated
|
|
[ -e pid.txt ]
|
|
|
|
[[ "$(cat pid.txt)" =~ [0-9]+ ]]
|
|
}
|
|
|
|
# https://github.com/opencontainers/runc/pull/2897
|
|
@test "runc run [rootless with host pidns]" {
|
|
requires rootless_no_features
|
|
|
|
# Remove pid namespace, and replace /proc mount
|
|
# with a bind mount from the host.
|
|
update_config ' .linux.namespaces -= [{"type": "pid"}]
|
|
| .mounts |= map((select(.type == "proc")
|
|
| .type = "none"
|
|
| .source = "/proc"
|
|
| .options = ["rbind", "nosuid", "nodev", "noexec"]
|
|
) // .)'
|
|
|
|
runc run test_hello
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "runc run [redundant seccomp rules]" {
|
|
update_config ' .linux.seccomp = {
|
|
"defaultAction": "SCMP_ACT_ALLOW",
|
|
"syscalls": [{
|
|
"names": ["bdflush"],
|
|
"action": "SCMP_ACT_ALLOW",
|
|
}]
|
|
}'
|
|
runc run test_hello
|
|
[ "$status" -eq 0 ]
|
|
}
|