summaryrefslogtreecommitdiff
path: root/test
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2018-08-24 12:15:34 +0200
committerAtomic Bot <atomic-devel@projectatomic.io>2018-08-26 07:22:42 +0000
commitc5753f57c1a929f80fb768ff62bd35f383584aed (patch)
treeece117393325d5a26d1fc7dfc23ad6b2c6f48631 /test
parent720eb85ba55d8c825262e9b2e058ec8a8e0e4d9f (diff)
downloadpodman-c5753f57c1a929f80fb768ff62bd35f383584aed.tar.gz
podman-c5753f57c1a929f80fb768ff62bd35f383584aed.tar.bz2
podman-c5753f57c1a929f80fb768ff62bd35f383584aed.zip
rootless: exec handle processes that create an user namespace
Manage the case where the main process of the container creates and joins a new user namespace. In this case we want to join only the first child in the new hierarchy, which is the user namespace that was used to create the container. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com> Closes: #1331 Approved by: rhatdan
Diffstat (limited to 'test')
-rw-r--r--test/e2e/rootless_test.go30
1 files changed, 23 insertions, 7 deletions
diff --git a/test/e2e/rootless_test.go b/test/e2e/rootless_test.go
index 8813d040d..195f403e1 100644
--- a/test/e2e/rootless_test.go
+++ b/test/e2e/rootless_test.go
@@ -6,11 +6,25 @@ import (
"os"
"os/exec"
"path/filepath"
+ "syscall"
. "github.com/onsi/ginkgo"
. "github.com/onsi/gomega"
)
+func canExec() bool {
+ const nsGetParent = 0xb702
+
+ u, err := os.Open("/proc/self/ns/user")
+ if err != nil {
+ return false
+ }
+ defer u.Close()
+
+ _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, u.Fd(), uintptr(nsGetParent), 0)
+ return errno != syscall.ENOTTY
+}
+
var _ = Describe("Podman rootless", func() {
var (
tempdir string
@@ -100,18 +114,20 @@ var _ = Describe("Podman rootless", func() {
allArgs = append(allArgs, "--rootfs", mountPath, "echo", "hello")
cmd := podmanTest.PodmanAsUser(allArgs, 1000, 1000, env)
cmd.WaitWithDefaultTimeout()
- Expect(cmd.LineInOutputContains("hello")).To(BeTrue())
Expect(cmd.ExitCode()).To(Equal(0))
+ Expect(cmd.LineInOutputContains("hello")).To(BeTrue())
- allArgsD := append([]string{"run", "-d"}, args...)
- allArgsD = append(allArgsD, "--rootfs", mountPath, "sleep", "1d")
- cmd = podmanTest.PodmanAsUser(allArgsD, 1000, 1000, env)
+ allArgs = append([]string{"run", "-d"}, args...)
+ allArgs = append(allArgs, "--security-opt", "seccomp=unconfined", "--rootfs", mountPath, "unshare", "-r", "unshare", "-r", "top")
+ cmd = podmanTest.PodmanAsUser(allArgs, 1000, 1000, env)
cmd.WaitWithDefaultTimeout()
Expect(cmd.ExitCode()).To(Equal(0))
- cid := cmd.OutputToStringArray()[0]
- allArgsE := []string{"exec", cid, "echo", "hello"}
- cmd = podmanTest.PodmanAsUser(allArgsE, 1000, 1000, env)
+ if !canExec() {
+ Skip("ioctl(NS_GET_PARENT) not supported.")
+ }
+
+ cmd = podmanTest.PodmanAsUser([]string{"exec", "-l", "echo", "hello"}, 1000, 1000, env)
cmd.WaitWithDefaultTimeout()
Expect(cmd.ExitCode()).To(Equal(0))
Expect(cmd.LineInOutputContains("hello")).To(BeTrue())