2016-08-31 19:31:06 +00:00
|
|
|
package main
|
|
|
|
|
|
|
|
import (
|
2016-10-21 12:34:37 +00:00
|
|
|
"fmt"
|
2016-08-31 19:31:06 +00:00
|
|
|
"io/ioutil"
|
|
|
|
"os"
|
|
|
|
"os/exec"
|
|
|
|
"path/filepath"
|
|
|
|
"runtime"
|
|
|
|
"strings"
|
|
|
|
|
2018-04-16 08:48:58 +00:00
|
|
|
"github.com/docker/docker/internal/test/fixtures/load"
|
2016-08-31 19:31:06 +00:00
|
|
|
"github.com/go-check/check"
|
2019-04-04 13:23:19 +00:00
|
|
|
"gotest.tools/assert"
|
2016-08-31 19:31:06 +00:00
|
|
|
)
|
|
|
|
|
2016-12-25 19:28:38 +00:00
|
|
|
type testingT interface {
|
|
|
|
logT
|
|
|
|
Fatalf(string, ...interface{})
|
|
|
|
}
|
|
|
|
|
|
|
|
type logT interface {
|
|
|
|
Logf(string, ...interface{})
|
|
|
|
}
|
|
|
|
|
2016-08-31 19:31:06 +00:00
|
|
|
func ensureSyscallTest(c *check.C) {
|
2019-03-12 07:37:31 +00:00
|
|
|
defer testEnv.ProtectImage(c, "syscall-test:latest")
|
|
|
|
|
|
|
|
// If the image already exists, there's nothing left to do.
|
|
|
|
if testEnv.HasExistingImage(c, "syscall-test:latest") {
|
2016-08-31 19:31:06 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// if no match, must build in docker, which is significantly slower
|
|
|
|
// (slower mostly because of the vfs graphdriver)
|
2018-01-15 14:32:06 +00:00
|
|
|
if testEnv.OSType != runtime.GOOS {
|
2016-08-31 19:31:06 +00:00
|
|
|
ensureSyscallTestBuild(c)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
tmp, err := ioutil.TempDir("", "syscall-test-build")
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err, "couldn't create temp dir")
|
2016-08-31 19:31:06 +00:00
|
|
|
defer os.RemoveAll(tmp)
|
|
|
|
|
|
|
|
gcc, err := exec.LookPath("gcc")
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err, "could not find gcc")
|
2016-08-31 19:31:06 +00:00
|
|
|
|
2017-05-09 13:21:19 +00:00
|
|
|
tests := []string{"userns", "ns", "acct", "setuid", "setgid", "socket", "raw"}
|
2016-10-21 12:34:37 +00:00
|
|
|
for _, test := range tests {
|
|
|
|
out, err := exec.Command(gcc, "-g", "-Wall", "-static", fmt.Sprintf("../contrib/syscall-test/%s.c", test), "-o", fmt.Sprintf("%s/%s-test", tmp, test)).CombinedOutput()
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err, string(out))
|
2016-10-21 12:34:37 +00:00
|
|
|
}
|
2016-08-31 19:31:06 +00:00
|
|
|
|
|
|
|
if runtime.GOOS == "linux" && runtime.GOARCH == "amd64" {
|
TestRunSeccompProfileAllow32Bit: fix
Since the update to Debian Stretch, this test fails. The reason is dynamic
binary, which requires i386 ld.so for loading (and apparently it is no longer
installed by default):
> root@09d4b173c3dc:/go/src/github.com/docker/docker# file exit32-test
> exit32-test: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, BuildID[sha1]=a0d3d6cb59788453b983f65f8dc6ac52920147b6, stripped
> root@09d4b173c3dc:/go/src/github.com/docker/docker# ls -l /lib/ld-linux.so.2
> ls: cannot access '/lib/ld-linux.so.2': No such file or directory
To fix, just add -static.
Interestingly, ldd can'f figure it out.
> root@a324f8edfcaa:/go/src/github.com/docker/docker# ldd exit32-test
> not a dynamic executable
Other tools (e.g. objdump) also show it's a dynamic binary.
While at it, remove the extra "id" argument (a copy-paste error I
guess).
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2017-08-21 14:52:43 +00:00
|
|
|
out, err := exec.Command(gcc, "-s", "-m32", "-nostdlib", "-static", "../contrib/syscall-test/exit32.s", "-o", tmp+"/"+"exit32-test").CombinedOutput()
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err, string(out))
|
2016-08-31 19:31:06 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
dockerFile := filepath.Join(tmp, "Dockerfile")
|
|
|
|
content := []byte(`
|
|
|
|
FROM debian:jessie
|
|
|
|
COPY . /usr/bin/
|
|
|
|
`)
|
|
|
|
err = ioutil.WriteFile(dockerFile, content, 600)
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err)
|
2016-08-31 19:31:06 +00:00
|
|
|
|
|
|
|
var buildArgs []string
|
|
|
|
if arg := os.Getenv("DOCKER_BUILD_ARGS"); strings.TrimSpace(arg) != "" {
|
|
|
|
buildArgs = strings.Split(arg, " ")
|
|
|
|
}
|
|
|
|
buildArgs = append(buildArgs, []string{"-q", "-t", "syscall-test", tmp}...)
|
|
|
|
buildArgs = append([]string{"build"}, buildArgs...)
|
|
|
|
dockerCmd(c, buildArgs...)
|
|
|
|
}
|
|
|
|
|
|
|
|
func ensureSyscallTestBuild(c *check.C) {
|
2017-08-25 22:48:36 +00:00
|
|
|
err := load.FrozenImagesLinux(testEnv.APIClient(), "buildpack-deps:jessie")
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err)
|
2016-08-31 19:31:06 +00:00
|
|
|
|
|
|
|
var buildArgs []string
|
|
|
|
if arg := os.Getenv("DOCKER_BUILD_ARGS"); strings.TrimSpace(arg) != "" {
|
|
|
|
buildArgs = strings.Split(arg, " ")
|
|
|
|
}
|
|
|
|
buildArgs = append(buildArgs, []string{"-q", "-t", "syscall-test", "../contrib/syscall-test"}...)
|
|
|
|
buildArgs = append([]string{"build"}, buildArgs...)
|
|
|
|
dockerCmd(c, buildArgs...)
|
|
|
|
}
|
|
|
|
|
|
|
|
func ensureNNPTest(c *check.C) {
|
2017-03-01 17:45:04 +00:00
|
|
|
defer testEnv.ProtectImage(c, "nnp-test:latest")
|
2019-03-12 07:37:31 +00:00
|
|
|
|
|
|
|
// If the image already exists, there's nothing left to do.
|
|
|
|
if testEnv.HasExistingImage(c, "nnp-test:latest") {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// if no match, must build in docker, which is significantly slower
|
|
|
|
// (slower mostly because of the vfs graphdriver)
|
2018-01-15 14:32:06 +00:00
|
|
|
if testEnv.OSType != runtime.GOOS {
|
2016-08-31 19:31:06 +00:00
|
|
|
ensureNNPTestBuild(c)
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
tmp, err := ioutil.TempDir("", "docker-nnp-test")
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err)
|
2016-08-31 19:31:06 +00:00
|
|
|
|
|
|
|
gcc, err := exec.LookPath("gcc")
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err, "could not find gcc")
|
2016-08-31 19:31:06 +00:00
|
|
|
|
|
|
|
out, err := exec.Command(gcc, "-g", "-Wall", "-static", "../contrib/nnp-test/nnp-test.c", "-o", filepath.Join(tmp, "nnp-test")).CombinedOutput()
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err, string(out))
|
2016-08-31 19:31:06 +00:00
|
|
|
|
|
|
|
dockerfile := filepath.Join(tmp, "Dockerfile")
|
|
|
|
content := `
|
|
|
|
FROM debian:jessie
|
|
|
|
COPY . /usr/bin
|
|
|
|
RUN chmod +s /usr/bin/nnp-test
|
|
|
|
`
|
|
|
|
err = ioutil.WriteFile(dockerfile, []byte(content), 600)
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err, "could not write Dockerfile for nnp-test image")
|
2016-08-31 19:31:06 +00:00
|
|
|
|
|
|
|
var buildArgs []string
|
|
|
|
if arg := os.Getenv("DOCKER_BUILD_ARGS"); strings.TrimSpace(arg) != "" {
|
|
|
|
buildArgs = strings.Split(arg, " ")
|
|
|
|
}
|
|
|
|
buildArgs = append(buildArgs, []string{"-q", "-t", "nnp-test", tmp}...)
|
|
|
|
buildArgs = append([]string{"build"}, buildArgs...)
|
|
|
|
dockerCmd(c, buildArgs...)
|
|
|
|
}
|
|
|
|
|
|
|
|
func ensureNNPTestBuild(c *check.C) {
|
2017-08-25 22:48:36 +00:00
|
|
|
err := load.FrozenImagesLinux(testEnv.APIClient(), "buildpack-deps:jessie")
|
2019-04-04 13:23:19 +00:00
|
|
|
assert.NilError(c, err)
|
2016-08-31 19:31:06 +00:00
|
|
|
|
|
|
|
var buildArgs []string
|
|
|
|
if arg := os.Getenv("DOCKER_BUILD_ARGS"); strings.TrimSpace(arg) != "" {
|
|
|
|
buildArgs = strings.Split(arg, " ")
|
|
|
|
}
|
|
|
|
buildArgs = append(buildArgs, []string{"-q", "-t", "npp-test", "../contrib/nnp-test"}...)
|
|
|
|
buildArgs = append([]string{"build"}, buildArgs...)
|
|
|
|
dockerCmd(c, buildArgs...)
|
|
|
|
}
|