mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Kir Kolyshkin
370e3be202
This fixes a bogus failure in "ro cgroup" test cases when running as rootless. The test finds the following mount that is not read-only: > cgroup2 /sys/fs/cgroup/unified cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate 0 0 This happens because: 1. runc spec --rootless adds an rbind /sys mounts, so we have all the /sys/fs/cgroup/XXX mounts inside the container; 2. Those /sys/fs/cgroup/XXX mounts are shadowed by the /sys/fs/cgroup tmpfs mount created by mountCgroupV1(). This means that this mount is shadowed, inaccessible, and it can not be unshadowed, thus it should not be checked. The fix is to check whether the directory exists, to exclude such shadowed mounts. NOTE that item 2 comes from commit ff692f289b60e19b3079cb; before it, we had the whole hierarchy of host /sys/fs/cgroup visible (though not writable -- because rootless) from inside of any rootless container. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
92 lines
2.4 KiB
Bash
92 lines
2.4 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
function setup() {
|
|
setup_busybox
|
|
}
|
|
|
|
function teardown() {
|
|
teardown_bundle
|
|
}
|
|
|
|
@test "runc run [bind mount]" {
|
|
update_config ' .mounts += [{
|
|
source: ".",
|
|
destination: "/tmp/bind",
|
|
options: ["bind"]
|
|
}]
|
|
| .process.args |= ["ls", "/tmp/bind/config.json"]'
|
|
|
|
runc run test_busybox
|
|
[ "$status" -eq 0 ]
|
|
[[ "${lines[0]}" == *'/tmp/bind/config.json'* ]]
|
|
}
|
|
|
|
# https://github.com/opencontainers/runc/issues/2246
|
|
@test "runc run [ro tmpfs mount]" {
|
|
update_config ' .mounts += [{
|
|
source: "tmpfs",
|
|
destination: "/mnt",
|
|
type: "tmpfs",
|
|
options: ["ro", "nodev", "nosuid", "mode=755"]
|
|
}]
|
|
| .process.args |= ["grep", "^tmpfs /mnt", "/proc/mounts"]'
|
|
|
|
runc run test_busybox
|
|
[ "$status" -eq 0 ]
|
|
[[ "${lines[0]}" == *'ro,'* ]]
|
|
}
|
|
|
|
# https://github.com/opencontainers/runc/issues/3248
|
|
@test "runc run [ro /dev mount]" {
|
|
update_config ' .mounts |= map((select(.destination == "/dev") | .options += ["ro"]) // .)
|
|
| .process.args |= ["grep", "^tmpfs /dev", "/proc/mounts"]'
|
|
|
|
runc run test_busybox
|
|
[ "$status" -eq 0 ]
|
|
[[ "${lines[0]}" == *'ro,'* ]]
|
|
}
|
|
|
|
# https://github.com/opencontainers/runc/issues/2683
|
|
@test "runc run [tmpfs mount with absolute symlink]" {
|
|
# in container, /conf -> /real/conf
|
|
mkdir -p rootfs/real/conf
|
|
ln -s /real/conf rootfs/conf
|
|
update_config ' .mounts += [{
|
|
type: "tmpfs",
|
|
source: "tmpfs",
|
|
destination: "/conf/stack",
|
|
options: ["ro", "nodev", "nosuid"]
|
|
}]
|
|
| .process.args |= ["true"]'
|
|
runc run test_busybox
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "runc run [ro /sys/fs/cgroup mounts]" {
|
|
# Without cgroup namespace.
|
|
update_config '.linux.namespaces -= [{"type": "cgroup"}]'
|
|
test_ro_cgroup_mount
|
|
}
|
|
|
|
# shellcheck disable=SC2030
|
|
@test "runc run [ro /sys/fs/cgroup mounts + cgroupns]" {
|
|
requires cgroupns
|
|
# With cgroup namespace.
|
|
update_config '.linux.namespaces |= if index({"type": "cgroup"}) then . else . + [{"type": "cgroup"}] end'
|
|
test_ro_cgroup_mount
|
|
}
|
|
|
|
# https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc
|
|
# shellcheck disable=SC2031
|
|
function test_ro_cgroup_mount() {
|
|
local lines status
|
|
# shellcheck disable=SC2016
|
|
update_config '.process.args |= ["sh", "-euc", "for f in `grep /sys/fs/cgroup /proc/mounts | awk \"{print \\\\$2}\"| uniq`; do test -e $f && grep -w $f /proc/mounts | tail -n1; done"]'
|
|
runc run test_busybox
|
|
[ "$status" -eq 0 ]
|
|
[ "${#lines[@]}" -ne 0 ]
|
|
for line in "${lines[@]}"; do [[ "${line}" == *'ro,'* ]]; done
|
|
}
|