-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
tests/integration: Add tests for idmap mounts
Co-authored-by: Francis Laniel <flaniel@linux.microsoft.com> Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
- Loading branch information
Showing
5 changed files
with
248 additions
and
3 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "log" | ||
| "os" | ||
| "os/exec" | ||
| "syscall" | ||
|
|
||
| "golang.org/x/sys/unix" | ||
| ) | ||
|
|
||
| func main() { | ||
| if len(os.Args) < 2 { | ||
| log.Fatalf("usage: %s path_to_mount_set_attr", os.Args[0]) | ||
| } | ||
|
|
||
| src := os.Args[1] | ||
| treeFD, err := unix.OpenTree(-1, src, uint(unix.OPEN_TREE_CLONE|unix.OPEN_TREE_CLOEXEC|unix.AT_EMPTY_PATH|unix.AT_RECURSIVE)) | ||
| if err != nil { | ||
| log.Fatalf("error calling open_tree %q: %v", src, err) | ||
| } | ||
| defer unix.Close(treeFD) | ||
|
|
||
| cmd := exec.Command("/usr/bin/sleep", "5") | ||
| cmd.SysProcAttr = &syscall.SysProcAttr{ | ||
| Cloneflags: syscall.CLONE_NEWUSER, | ||
| UidMappings: []syscall.SysProcIDMap{{ContainerID: 0, HostID: 65536, Size: 65536}}, | ||
| GidMappings: []syscall.SysProcIDMap{{ContainerID: 0, HostID: 65536, Size: 65536}}, | ||
| } | ||
| if err := cmd.Start(); err != nil { | ||
| log.Fatalf("failed to run the helper binary: %v", err) | ||
| } | ||
|
|
||
| path := fmt.Sprintf("/proc/%d/ns/user", cmd.Process.Pid) | ||
| var userNsFile *os.File | ||
| if userNsFile, err = os.Open(path); err != nil { | ||
| log.Fatalf("unable to get user ns file descriptor: %v", err) | ||
| return | ||
| } | ||
| defer userNsFile.Close() | ||
|
|
||
| attr := unix.MountAttr{ | ||
| Attr_set: unix.MOUNT_ATTR_IDMAP, | ||
| Userns_fd: uint64(userNsFile.Fd()), | ||
| } | ||
| if err := unix.MountSetattr(treeFD, "", unix.AT_EMPTY_PATH|unix.AT_RECURSIVE, &attr); err != nil { | ||
| log.Fatalf("error calling mount_setattr: %v", err) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,153 @@ | ||
| #!/usr/bin/env bats | ||
|
|
||
| load helpers | ||
|
|
||
| function setup() { | ||
| requires root | ||
| requires_kernel 5.12 | ||
| requires_idmap_fs /tmp | ||
|
|
||
| setup_debian | ||
|
|
||
| # Prepare source folders for bind mount | ||
| mkdir -p source-{1,2}/ | ||
| touch source-{1,2}/foo.txt | ||
|
|
||
| # Use other owner for source-2 | ||
| chown 1:1 source-2/foo.txt | ||
|
|
||
| mkdir -p rootfs/{proc,sys,tmp} | ||
| mkdir -p rootfs/tmp/mount-{1,2} | ||
| mkdir -p rootfs/mnt/bind-mount-{1,2} | ||
|
|
||
| update_config ' .linux.namespaces += [{"type": "user"}] | ||
| | .linux.uidMappings += [{"hostID": 100000, "containerID": 0, "size": 65536}] | ||
| | .linux.gidMappings += [{"hostID": 100000, "containerID": 0, "size": 65536}] | ||
| | .process.args += ["-c", "stat -c =%u=%g= /tmp/mount-1/foo.txt"] | ||
| | .mounts += [ | ||
| { | ||
| "source": "source-1/", | ||
| "destination": "/tmp/mount-1", | ||
| "options": ["bind"], | ||
| "uidMappings": [ { | ||
| "containerID": 0, | ||
| "hostID": 100000, | ||
| "size": 65536 | ||
| } | ||
| ], | ||
| "gidMappings": [ { | ||
| "containerID": 0, | ||
| "hostID": 100000, | ||
| "size": 65536 | ||
| } | ||
| ] | ||
| } | ||
| ] ' | ||
| } | ||
|
|
||
| function teardown() { | ||
| teardown_bundle | ||
| } | ||
|
|
||
| @test "simple idmap mount" { | ||
| runc run test_debian | ||
| [ "$status" -eq 0 ] | ||
| [[ "$output" == *"=0=0="* ]] | ||
| } | ||
|
|
||
| @test "idmap mount with propagation flag" { | ||
| update_config ' .process.args = ["sh", "-c", "findmnt -o PROPAGATION /tmp/mount-1"]' | ||
| # Add the shared option to the idmap mount | ||
| update_config ' .mounts |= map((select(.source == "source-1/") | .options += ["shared"]) // .)' | ||
|
|
||
| runc run test_debian | ||
| [ "$status" -eq 0 ] | ||
| [[ "$output" == *"shared"* ]] | ||
| } | ||
|
|
||
| @test "idmap mount with bind mount" { | ||
| update_config ' .mounts += [ | ||
| { | ||
| "source": "source-2/", | ||
| "destination": "/tmp/mount-2", | ||
| "options": ["bind"] | ||
| } | ||
| ] ' | ||
|
|
||
| runc run test_debian | ||
| [ "$status" -eq 0 ] | ||
| [[ "$output" == *"=0=0="* ]] | ||
| } | ||
|
|
||
| @test "two idmap mounts with two bind mounts" { | ||
| update_config ' .process.args = ["sh", "-c", "stat -c =%u=%g= /tmp/mount-1/foo.txt /tmp/mount-2/foo.txt"] | ||
| | .mounts += [ | ||
| { | ||
| "source": "source-1/", | ||
| "destination": "/mnt/bind-mount-1", | ||
| "options": ["bind"] | ||
| }, | ||
| { | ||
| "source": "source-2/", | ||
| "destination": "/mnt/bind-mount-2", | ||
| "options": ["bind"] | ||
| }, | ||
| { | ||
| "source": "source-2/", | ||
| "destination": "/tmp/mount-2", | ||
| "options": ["bind"], | ||
| "uidMappings": [ { | ||
| "containerID": 0, | ||
| "hostID": 100000, | ||
| "size": 65536 | ||
| } | ||
| ], | ||
| "gidMappings": [ { | ||
| "containerID": 0, | ||
| "hostID": 100000, | ||
| "size": 65536 | ||
| } | ||
| ] | ||
| } | ||
| ] ' | ||
|
|
||
| runc run test_debian | ||
| [ "$status" -eq 0 ] | ||
| [[ "$output" == *"=0=0="* ]] | ||
| # source-2/ is owned by 1:1, so we expect this with the idmap mount too. | ||
| [[ "$output" == *"=1=1="* ]] | ||
| } | ||
|
|
||
| @test "idmap mount without gidMappings fails" { | ||
| update_config ' .mounts |= map((select(.source == "source-1/") | del(.gidMappings) ) // .)' | ||
|
|
||
| runc run test_debian | ||
| [ "$status" -eq 1 ] | ||
| [[ "${output}" == *"invalid mount"* ]] | ||
| } | ||
|
|
||
| @test "idmap mount without uidMappings fails" { | ||
| update_config ' .mounts |= map((select(.source == "source-1/") | del(.uidMappings) ) // .)' | ||
|
|
||
| runc run test_debian | ||
| [ "$status" -eq 1 ] | ||
| [[ "${output}" == *"invalid mount"* ]] | ||
| } | ||
|
|
||
| @test "idmap mount without bind fails" { | ||
| update_config ' .mounts |= map((select(.source == "source-1/") | .options = [""]) // .)' | ||
|
|
||
| runc run test_debian | ||
| [ "$status" -eq 1 ] | ||
| [[ "${output}" == *"invalid mount"* ]] | ||
| } | ||
|
|
||
| @test "idmap mount with different mapping than userns fails" { | ||
| # Let's modify the containerID to be 1, instead of 0 as it is in the | ||
| # userns config. | ||
| update_config ' .mounts |= map((select(.source == "source-1/") | .uidMappings[0]["containerID"] = 1 ) // .)' | ||
|
|
||
| runc run test_debian | ||
| [ "$status" -eq 1 ] | ||
| [[ "${output}" == *"invalid mount"* ]] | ||
| } |