From c5753f57c1a929f80fb768ff62bd35f383584aed Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Fri, 24 Aug 2018 12:15:34 +0200 Subject: rootless: exec handle processes that create an user namespace Manage the case where the main process of the container creates and joins a new user namespace. In this case we want to join only the first child in the new hierarchy, which is the user namespace that was used to create the container. Signed-off-by: Giuseppe Scrivano Closes: #1331 Approved by: rhatdan --- test/e2e/rootless_test.go | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-) (limited to 'test/e2e') diff --git a/test/e2e/rootless_test.go b/test/e2e/rootless_test.go index 8813d040d..195f403e1 100644 --- a/test/e2e/rootless_test.go +++ b/test/e2e/rootless_test.go @@ -6,11 +6,25 @@ import ( "os" "os/exec" "path/filepath" + "syscall" . "github.com/onsi/ginkgo" . "github.com/onsi/gomega" ) +func canExec() bool { + const nsGetParent = 0xb702 + + u, err := os.Open("/proc/self/ns/user") + if err != nil { + return false + } + defer u.Close() + + _, _, errno := syscall.Syscall(syscall.SYS_IOCTL, u.Fd(), uintptr(nsGetParent), 0) + return errno != syscall.ENOTTY +} + var _ = Describe("Podman rootless", func() { var ( tempdir string @@ -100,18 +114,20 @@ var _ = Describe("Podman rootless", func() { allArgs = append(allArgs, "--rootfs", mountPath, "echo", "hello") cmd := podmanTest.PodmanAsUser(allArgs, 1000, 1000, env) cmd.WaitWithDefaultTimeout() - Expect(cmd.LineInOutputContains("hello")).To(BeTrue()) Expect(cmd.ExitCode()).To(Equal(0)) + Expect(cmd.LineInOutputContains("hello")).To(BeTrue()) - allArgsD := append([]string{"run", "-d"}, args...) - allArgsD = append(allArgsD, "--rootfs", mountPath, "sleep", "1d") - cmd = podmanTest.PodmanAsUser(allArgsD, 1000, 1000, env) + allArgs = append([]string{"run", "-d"}, args...) + allArgs = append(allArgs, "--security-opt", "seccomp=unconfined", "--rootfs", mountPath, "unshare", "-r", "unshare", "-r", "top") + cmd = podmanTest.PodmanAsUser(allArgs, 1000, 1000, env) cmd.WaitWithDefaultTimeout() Expect(cmd.ExitCode()).To(Equal(0)) - cid := cmd.OutputToStringArray()[0] - allArgsE := []string{"exec", cid, "echo", "hello"} - cmd = podmanTest.PodmanAsUser(allArgsE, 1000, 1000, env) + if !canExec() { + Skip("ioctl(NS_GET_PARENT) not supported.") + } + + cmd = podmanTest.PodmanAsUser([]string{"exec", "-l", "echo", "hello"}, 1000, 1000, env) cmd.WaitWithDefaultTimeout() Expect(cmd.ExitCode()).To(Equal(0)) Expect(cmd.LineInOutputContains("hello")).To(BeTrue()) -- cgit v1.2.3-54-g00ecf