From ad255533d415393ebd119645af5c8b5a6637255f Mon Sep 17 00:00:00 2001 From: umohnani8 Date: Mon, 27 Nov 2017 13:17:42 -0500 Subject: Fix --volume flag for kpod create and run Enable the --volume flag to validate user input and add functionality for :z and :Z options Signed-off-by: umohnani8 Closes: #84 Approved by: mheon --- cmd/kpod/create.go | 4 +++ cmd/kpod/create_cli.go | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++ cmd/kpod/spec.go | 41 ++++++++++++++++++++++++++++--- cmd/kpod/spec_test.go | 3 ++- 4 files changed, 109 insertions(+), 5 deletions(-) (limited to 'cmd') diff --git a/cmd/kpod/create.go b/cmd/kpod/create.go index c310ab831..57dce6fbf 100644 --- a/cmd/kpod/create.go +++ b/cmd/kpod/create.go @@ -343,6 +343,10 @@ func parseCreateOpts(c *cli.Context, runtime *libpod.Runtime) (*createConfig, er blkioWeight = uint16(u) } + if err = parseVolumes(c.StringSlice("volume")); err != nil { + return nil, err + } + // Because we cannot do a non-terminal attach, we need to set tty to true // if detach is not false // TODO Allow non-terminal attach diff --git a/cmd/kpod/create_cli.go b/cmd/kpod/create_cli.go index f90d530bf..9686b89a7 100644 --- a/cmd/kpod/create_cli.go +++ b/cmd/kpod/create_cli.go @@ -2,6 +2,7 @@ package main import ( "fmt" + "os" "strings" "github.com/docker/docker/pkg/sysinfo" @@ -40,6 +41,71 @@ func addWarning(warnings []string, msg string) []string { return append(warnings, msg) } +func parseVolumes(volumes []string) error { + if len(volumes) == 0 { + return nil + } + for _, volume := range volumes { + arr := strings.SplitN(volume, ":", 3) + if len(arr) < 2 { + return errors.Errorf("incorrect volume format %q, should be host-dir:ctr-dir:[option]", volume) + } + if err := validateVolumeHostDir(arr[0]); err != nil { + return err + } + if err := validateVolumeCtrDir(arr[1]); err != nil { + return err + } + if len(arr) > 2 { + if err := validateVolumeOpts(arr[2]); err != nil { + return err + } + } + } + return nil +} + +func validateVolumeHostDir(hostDir string) error { + if _, err := os.Stat(hostDir); err != nil { + return errors.Wrapf(err, "error checking path %q", hostDir) + } + return nil +} + +func validateVolumeCtrDir(ctrDir string) error { + if ctrDir[0] != '/' { + return errors.Errorf("invalid container directory path %q", ctrDir) + } + return nil +} + +func validateVolumeOpts(option string) error { + var foundRootPropagation, foundRWRO, foundLabelChange int + options := strings.Split(option, ",") + for _, opt := range options { + switch opt { + case "rw", "ro": + if foundRWRO > 1 { + return errors.Errorf("invalid options %q, can only specify 1 'rw' or 'ro' option", option) + } + foundRWRO++ + case "z", "Z": + if foundLabelChange > 1 { + return errors.Errorf("invalid options %q, can only specify 1 'z' or 'Z' option", option) + } + foundLabelChange++ + case "private", "rprivate", "shared", "rshared", "slave", "rslave": + if foundRootPropagation > 1 { + return errors.Errorf("invalid options %q, can only specify 1 '[r]shared', '[r]private' or '[r]slave' option", option) + } + foundRootPropagation++ + default: + return errors.Errorf("invalid option type %q", option) + } + } + return nil +} + func verifyContainerResources(config *createConfig, update bool) ([]string, error) { warnings := []string{} sysInfo := sysinfo.New(true) diff --git a/cmd/kpod/spec.go b/cmd/kpod/spec.go index 0a99d792b..b19d4d33a 100644 --- a/cmd/kpod/spec.go +++ b/cmd/kpod/spec.go @@ -11,6 +11,7 @@ import ( "github.com/docker/go-units" spec "github.com/opencontainers/runtime-spec/specs-go" "github.com/opencontainers/runtime-tools/generate" + "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" "github.com/projectatomic/libpod/libpod" ann "github.com/projectatomic/libpod/pkg/annotations" @@ -224,7 +225,11 @@ func createConfigToOCISpec(config *createConfig) (*spec.Spec, error) { } // BIND MOUNTS - configSpec.Mounts = append(configSpec.Mounts, config.GetVolumeMounts()...) + mounts, err := config.GetVolumeMounts() + if err != nil { + return nil, errors.Wrapf(err, "error getting volume mounts") + } + configSpec.Mounts = append(configSpec.Mounts, mounts...) // HANDLE CAPABILITIES if err := setupCapabilities(config, configSpec); err != nil { @@ -357,7 +362,7 @@ func getDefaultAnnotations() map[string]string { } //GetVolumeMounts takes user provided input for bind mounts and creates Mount structs -func (c *createConfig) GetVolumeMounts() []spec.Mount { +func (c *createConfig) GetVolumeMounts() ([]spec.Mount, error) { var m []spec.Mount var options []string for _, i := range c.volumes { @@ -366,8 +371,36 @@ func (c *createConfig) GetVolumeMounts() []spec.Mount { if len(spliti) > 2 { options = strings.Split(spliti[2], ",") } - // always add rbind bc mount ignores the bind filesystem when mounting options = append(options, "rbind") + // var foundrw, foundro, + var foundz, foundZ bool + for _, opt := range options { + switch opt { + // case "rw": + // foundrw = true + // case "ro": + // foundro = true + case "z": + foundz = true + case "Z": + foundZ = true + } + } + // if !foundro && !foundrw { + // // rw option is default + // options = append(options, "rw") + // } + if foundz { + if err := label.Relabel(spliti[0], c.mountLabel, true); err != nil { + return nil, errors.Wrapf(err, "relabel failed %q", spliti[0]) + } + } + if foundZ { + if err := label.Relabel(spliti[0], c.mountLabel, false); err != nil { + return nil, errors.Wrapf(err, "relabel failed %q", spliti[0]) + } + } + m = append(m, spec.Mount{ Destination: spliti[1], Type: string(TypeBind), @@ -375,7 +408,7 @@ func (c *createConfig) GetVolumeMounts() []spec.Mount { Options: options, }) } - return m + return m, nil } //GetTmpfsMounts takes user provided input for tmpfs mounts and creates Mount structs diff --git a/cmd/kpod/spec_test.go b/cmd/kpod/spec_test.go index c3de84324..1eedb0e2a 100644 --- a/cmd/kpod/spec_test.go +++ b/cmd/kpod/spec_test.go @@ -18,7 +18,8 @@ func TestCreateConfig_GetVolumeMounts(t *testing.T) { config := createConfig{ volumes: []string{"foobar:/foobar:ro"}, } - specMount := config.GetVolumeMounts() + specMount, err := config.GetVolumeMounts() + assert.NoError(t, err) assert.True(t, reflect.DeepEqual(data, specMount[0])) } -- cgit v1.2.3-54-g00ecf