2016-02-08 20:07:04 +00:00
|
|
|
// +build !windows
|
|
|
|
|
|
|
|
package main
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"io/ioutil"
|
|
|
|
"os"
|
|
|
|
"os/exec"
|
2016-09-05 10:02:13 +00:00
|
|
|
"path"
|
2016-02-08 20:07:04 +00:00
|
|
|
"path/filepath"
|
|
|
|
"strconv"
|
|
|
|
"strings"
|
2019-09-09 21:06:12 +00:00
|
|
|
"testing"
|
2016-02-08 20:07:04 +00:00
|
|
|
|
2016-09-05 10:02:13 +00:00
|
|
|
"github.com/docker/docker/pkg/stringid"
|
2016-02-08 20:07:04 +00:00
|
|
|
"github.com/docker/docker/pkg/system"
|
2020-02-07 13:39:24 +00:00
|
|
|
"gotest.tools/v3/assert"
|
2016-02-08 20:07:04 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// user namespaces test: run daemon with remapped root setting
|
|
|
|
// 1. validate uid/gid maps are set properly
|
|
|
|
// 2. verify that files created are owned by remapped root
|
2019-09-09 21:05:55 +00:00
|
|
|
func (s *DockerDaemonSuite) TestDaemonUserNamespaceRootSetting(c *testing.T) {
|
2019-07-19 08:53:42 +00:00
|
|
|
testRequires(c, UserNamespaceInKernel)
|
2016-02-08 20:07:04 +00:00
|
|
|
|
2016-12-09 22:20:14 +00:00
|
|
|
s.d.StartWithBusybox(c, "--userns-remap", "default")
|
2016-02-08 20:07:04 +00:00
|
|
|
|
|
|
|
tmpDir, err := ioutil.TempDir("", "userns")
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err)
|
2016-02-08 20:07:04 +00:00
|
|
|
|
|
|
|
defer os.RemoveAll(tmpDir)
|
|
|
|
|
2016-09-05 10:02:13 +00:00
|
|
|
// Set a non-existent path
|
|
|
|
tmpDirNotExists := path.Join(os.TempDir(), "userns"+stringid.GenerateRandomID())
|
|
|
|
defer os.RemoveAll(tmpDirNotExists)
|
|
|
|
|
2016-02-08 20:07:04 +00:00
|
|
|
// we need to find the uid and gid of the remapped root from the daemon's root dir info
|
2016-12-09 09:17:53 +00:00
|
|
|
uidgid := strings.Split(filepath.Base(s.d.Root), ".")
|
2019-09-09 21:08:22 +00:00
|
|
|
assert.Equal(c, len(uidgid), 2, fmt.Sprintf("Should have gotten uid/gid strings from root dirname: %s", filepath.Base(s.d.Root)))
|
2016-02-08 20:07:04 +00:00
|
|
|
uid, err := strconv.Atoi(uidgid[0])
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err, "Can't parse uid")
|
2016-02-08 20:07:04 +00:00
|
|
|
gid, err := strconv.Atoi(uidgid[1])
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err, "Can't parse gid")
|
2016-02-08 20:07:04 +00:00
|
|
|
|
2016-02-08 14:23:24 +00:00
|
|
|
// writable by the remapped root UID/GID pair
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, os.Chown(tmpDir, uid, gid))
|
2016-02-08 20:07:04 +00:00
|
|
|
|
2019-09-09 23:41:57 +00:00
|
|
|
out, err := s.d.Cmd("run", "-d", "--name", "userns", "-v", tmpDir+":/goofy", "-v", tmpDirNotExists+":/donald", "busybox", "sh", "-c", "touch /goofy/testfile; exec top")
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err, "Output: %s", out)
|
|
|
|
|
2016-02-08 14:23:24 +00:00
|
|
|
user := s.findUser(c, "userns")
|
2019-09-09 21:05:56 +00:00
|
|
|
assert.Equal(c, uidgid[0], user)
|
2016-02-08 20:07:04 +00:00
|
|
|
|
2016-09-05 10:02:13 +00:00
|
|
|
// check that the created directory is owned by remapped uid:gid
|
|
|
|
statNotExists, err := system.Stat(tmpDirNotExists)
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err)
|
2019-09-09 21:08:22 +00:00
|
|
|
assert.Equal(c, statNotExists.UID(), uint32(uid), "Created directory not owned by remapped root UID")
|
|
|
|
assert.Equal(c, statNotExists.GID(), uint32(gid), "Created directory not owned by remapped root GID")
|
2016-09-05 10:02:13 +00:00
|
|
|
|
2016-06-23 16:24:28 +00:00
|
|
|
pid, err := s.d.Cmd("inspect", "--format={{.State.Pid}}", "userns")
|
2019-09-11 10:57:29 +00:00
|
|
|
assert.Assert(c, err == nil, "Could not inspect running container: out: %q", pid)
|
2016-02-08 20:07:04 +00:00
|
|
|
// check the uid and gid maps for the PID to ensure root is remapped
|
|
|
|
// (cmd = cat /proc/<pid>/uid_map | grep -E '0\s+9999\s+1')
|
2018-07-09 17:40:34 +00:00
|
|
|
_, err = RunCommandPipelineWithOutput(
|
2016-02-08 20:07:04 +00:00
|
|
|
exec.Command("cat", "/proc/"+strings.TrimSpace(pid)+"/uid_map"),
|
|
|
|
exec.Command("grep", "-E", fmt.Sprintf("0[[:space:]]+%d[[:space:]]+", uid)))
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err)
|
2016-02-08 20:07:04 +00:00
|
|
|
|
2018-07-09 17:40:34 +00:00
|
|
|
_, err = RunCommandPipelineWithOutput(
|
2016-02-08 20:07:04 +00:00
|
|
|
exec.Command("cat", "/proc/"+strings.TrimSpace(pid)+"/gid_map"),
|
|
|
|
exec.Command("grep", "-E", fmt.Sprintf("0[[:space:]]+%d[[:space:]]+", gid)))
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err)
|
2016-02-08 20:07:04 +00:00
|
|
|
|
|
|
|
// check that the touched file is owned by remapped uid:gid
|
|
|
|
stat, err := system.Stat(filepath.Join(tmpDir, "testfile"))
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err)
|
2019-09-09 21:08:22 +00:00
|
|
|
assert.Equal(c, stat.UID(), uint32(uid), "Touched file not owned by remapped root UID")
|
|
|
|
assert.Equal(c, stat.GID(), uint32(gid), "Touched file not owned by remapped root GID")
|
2016-02-08 14:23:24 +00:00
|
|
|
|
|
|
|
// use host usernamespace
|
2019-09-09 23:41:57 +00:00
|
|
|
out, err = s.d.Cmd("run", "-d", "--name", "userns_skip", "--userns", "host", "busybox", "sh", "-c", "touch /goofy/testfile; exec top")
|
2019-09-11 10:57:29 +00:00
|
|
|
assert.Assert(c, err == nil, "Output: %s", out)
|
2016-02-08 14:23:24 +00:00
|
|
|
user = s.findUser(c, "userns_skip")
|
|
|
|
// userns are skipped, user is root
|
2019-09-09 21:05:56 +00:00
|
|
|
assert.Equal(c, user, "root")
|
2016-02-08 14:23:24 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// findUser finds the uid or name of the user of the first process that runs in a container
|
2019-09-09 21:05:55 +00:00
|
|
|
func (s *DockerDaemonSuite) findUser(c *testing.T, container string) string {
|
2016-02-08 14:23:24 +00:00
|
|
|
out, err := s.d.Cmd("top", container)
|
2019-09-11 10:57:29 +00:00
|
|
|
assert.Assert(c, err == nil, "Output: %s", out)
|
2016-02-08 14:23:24 +00:00
|
|
|
rows := strings.Split(out, "\n")
|
|
|
|
if len(rows) < 2 {
|
|
|
|
// No process rows founds
|
|
|
|
c.FailNow()
|
|
|
|
}
|
|
|
|
return strings.Fields(rows[1])[0]
|
2016-02-08 20:07:04 +00:00
|
|
|
}
|