-
Notifications
You must be signed in to change notification settings - Fork 2.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
tests: remap rootfs for userns tests
Previously, all of our userns tests worked around the remapping issue by creating the paths that runc would attempt to create (like /proc). However, this isn't really accurate to how real userns containers are created, so it's much better to actually remap the rootfs. Signed-off-by: Aleksa Sarai <[email protected]>
- Loading branch information
Showing
8 changed files
with
116 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "encoding/json" | ||
| "fmt" | ||
| "os" | ||
| "path/filepath" | ||
| "syscall" | ||
|
|
||
| "github.com/opencontainers/runtime-spec/specs-go" | ||
| ) | ||
|
|
||
| func usage() { | ||
| fmt.Println("usage: remap-rootfs <bundle>") | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| func toHostID(mappings []specs.LinuxIDMapping, id uint32) (int, bool) { | ||
| for _, m := range mappings { | ||
| if m.ContainerID <= id && id < m.ContainerID+m.Size { | ||
| return int(m.HostID + id), true | ||
| } | ||
| } | ||
| return -1, false | ||
| } | ||
|
|
||
| func remapRootfs(root string, uidMap, gidMap []specs.LinuxIDMapping) error { | ||
| return filepath.Walk(root, func(path string, info os.FileInfo, err error) error { | ||
| if err != nil { | ||
| return err | ||
| } | ||
| // Skip symlinks. | ||
| if info.Mode().Type() == os.ModeSymlink { | ||
| return nil | ||
| } | ||
| // Chown the file. | ||
| mode := info.Mode() | ||
| uid := info.Sys().(*syscall.Stat_t).Uid | ||
| gid := info.Sys().(*syscall.Stat_t).Gid | ||
| newUID, ok1 := toHostID(uidMap, uid) | ||
| newGID, ok2 := toHostID(gidMap, gid) | ||
| if !ok1 || !ok2 { | ||
| niceName := path | ||
| if relName, err := filepath.Rel(root, path); err == nil { | ||
| niceName = "/" + relName | ||
| } | ||
| // Skip files that cannot be mapped. | ||
| fmt.Printf("skipping file %s: cannot remap user %d:%d -> %d:%d\n", niceName, uid, gid, newUID, newGID) | ||
| return nil | ||
| } | ||
| if err := os.Chown(path, newUID, newGID); err != nil { | ||
| return err | ||
| } | ||
| // Make sure to re-apply any setid bits. | ||
| return os.Chmod(path, mode) | ||
| }) | ||
| } | ||
|
|
||
| func Main(args []string) error { | ||
| if len(args) != 1 { | ||
| usage() | ||
| } | ||
| bundle := args[0] | ||
|
|
||
| configFile, err := os.Open(bundle + "/config.json") | ||
| if err != nil { | ||
| return err | ||
| } | ||
| defer configFile.Close() | ||
|
|
||
| var spec specs.Spec | ||
| if err := json.NewDecoder(configFile).Decode(&spec); err != nil { | ||
| return fmt.Errorf("parsing config.json: %w", err) | ||
| } | ||
|
|
||
| if spec.Root == nil { | ||
| return fmt.Errorf("invalid config.json: root section is null") | ||
| } | ||
| rootfs := bundle + "/" + spec.Root.Path | ||
|
|
||
| if spec.Linux == nil { | ||
| return fmt.Errorf("invalid config.json: linux section is null") | ||
| } | ||
| uidMap := spec.Linux.UIDMappings | ||
| gidMap := spec.Linux.GIDMappings | ||
| if uidMap == nil && gidMap == nil { | ||
| fmt.Println("skipping remapping -- no userns mappings specified") | ||
| return nil | ||
| } | ||
|
|
||
| return remapRootfs(rootfs, uidMap, gidMap) | ||
| } | ||
|
|
||
| func main() { | ||
| err := Main(os.Args[1:]) | ||
| if err != nil { | ||
| fmt.Fprintf(os.Stderr, "remap-rootfs failed: %v\n", err) | ||
| os.Exit(1) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters