2019-04-29 21:25:05 +00:00
|
|
|
// Copyright 2018 The gVisor Authors.
|
2018-10-04 03:43:18 +00:00
|
|
|
//
|
|
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
// you may not use this file except in compliance with the License.
|
|
|
|
// You may obtain a copy of the License at
|
|
|
|
//
|
|
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
//
|
|
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
// See the License for the specific language governing permissions and
|
|
|
|
// limitations under the License.
|
|
|
|
|
2019-09-04 05:01:34 +00:00
|
|
|
// Package root is used for tests that requires sysadmin privileges run.
|
2018-10-04 03:43:18 +00:00
|
|
|
package root
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"io/ioutil"
|
2018-10-10 04:06:18 +00:00
|
|
|
"os/exec"
|
2018-10-04 03:43:18 +00:00
|
|
|
"path/filepath"
|
|
|
|
"strconv"
|
|
|
|
"strings"
|
|
|
|
"testing"
|
|
|
|
|
2020-04-23 18:32:08 +00:00
|
|
|
"gvisor.dev/gvisor/pkg/test/dockerutil"
|
2018-10-04 03:43:18 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// TestChroot verifies that the sandbox is chroot'd and that mounts are cleaned
|
|
|
|
// up after the sandbox is destroyed.
|
|
|
|
func TestChroot(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
d := dockerutil.MakeDocker(t)
|
|
|
|
defer d.CleanUp()
|
|
|
|
|
|
|
|
if err := d.Spawn(dockerutil.RunOpts{
|
|
|
|
Image: "basic/alpine",
|
|
|
|
}, "sleep", "10000"); err != nil {
|
2018-10-04 03:43:18 +00:00
|
|
|
t.Fatalf("docker run failed: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
pid, err := d.SandboxPid()
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Docker.SandboxPid(): %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check that sandbox is chroot'ed.
|
2019-01-14 22:07:05 +00:00
|
|
|
procRoot := filepath.Join("/proc", strconv.Itoa(pid), "root")
|
|
|
|
chroot, err := filepath.EvalSymlinks(procRoot)
|
2018-10-04 03:43:18 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("error resolving /proc/<pid>/root symlink: %v", err)
|
|
|
|
}
|
2019-01-14 22:07:05 +00:00
|
|
|
if chroot != "/" {
|
|
|
|
t.Errorf("sandbox is not chroot'd, it should be inside: /, got: %q", chroot)
|
2018-10-04 03:43:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
path, err := filepath.EvalSymlinks(filepath.Join("/proc", strconv.Itoa(pid), "cwd"))
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("error resolving /proc/<pid>/cwd symlink: %v", err)
|
|
|
|
}
|
|
|
|
if chroot != path {
|
|
|
|
t.Errorf("sandbox current dir is wrong, want: %q, got: %q", chroot, path)
|
|
|
|
}
|
|
|
|
|
2019-01-14 22:07:05 +00:00
|
|
|
fi, err := ioutil.ReadDir(procRoot)
|
2018-10-04 03:43:18 +00:00
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("error listing %q: %v", chroot, err)
|
|
|
|
}
|
2019-01-23 00:45:45 +00:00
|
|
|
if want, got := 1, len(fi); want != got {
|
2019-01-14 22:07:05 +00:00
|
|
|
t.Fatalf("chroot dir got %d entries, want %d", got, want)
|
2018-10-04 03:43:18 +00:00
|
|
|
}
|
|
|
|
|
2019-01-23 00:45:45 +00:00
|
|
|
// chroot dir is prepared by runsc and should contains only /proc.
|
|
|
|
if fi[0].Name() != "proc" {
|
|
|
|
t.Errorf("chroot got children %v, want %v", fi[0].Name(), "proc")
|
2018-10-04 03:43:18 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
d.CleanUp()
|
|
|
|
}
|
|
|
|
|
2018-10-10 04:06:18 +00:00
|
|
|
func TestChrootGofer(t *testing.T) {
|
2020-04-23 18:32:08 +00:00
|
|
|
d := dockerutil.MakeDocker(t)
|
|
|
|
defer d.CleanUp()
|
|
|
|
|
|
|
|
if err := d.Spawn(dockerutil.RunOpts{
|
|
|
|
Image: "basic/alpine",
|
|
|
|
}, "sleep", "10000"); err != nil {
|
2018-10-10 04:06:18 +00:00
|
|
|
t.Fatalf("docker run failed: %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// It's tricky to find gofers. Get sandbox PID first, then find parent. From
|
|
|
|
// parent get all immediate children, remove the sandbox, and everything else
|
|
|
|
// are gofers.
|
|
|
|
sandPID, err := d.SandboxPid()
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("Docker.SandboxPid(): %v", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Find sandbox's parent PID.
|
|
|
|
cmd := fmt.Sprintf("grep PPid /proc/%d/status | awk '{print $2}'", sandPID)
|
|
|
|
parent, err := exec.Command("sh", "-c", cmd).CombinedOutput()
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("failed to fetch runsc (%d) parent PID: %v, out:\n%s", sandPID, err, string(parent))
|
|
|
|
}
|
|
|
|
parentPID, err := strconv.Atoi(strings.TrimSpace(string(parent)))
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("failed to parse PPID %q: %v", string(parent), err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Get all children from parent.
|
|
|
|
childrenOut, err := exec.Command("/usr/bin/pgrep", "-P", strconv.Itoa(parentPID)).CombinedOutput()
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("failed to fetch containerd-shim children: %v", err)
|
|
|
|
}
|
|
|
|
children := strings.Split(strings.TrimSpace(string(childrenOut)), "\n")
|
|
|
|
|
|
|
|
// This where the root directory is mapped on the host and that's where the
|
|
|
|
// gofer must have chroot'd to.
|
2019-01-31 23:17:50 +00:00
|
|
|
root := "/root"
|
2018-10-10 04:06:18 +00:00
|
|
|
|
|
|
|
for _, child := range children {
|
|
|
|
childPID, err := strconv.Atoi(child)
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("failed to parse child PID %q: %v", child, err)
|
|
|
|
}
|
|
|
|
if childPID == sandPID {
|
|
|
|
// Skip the sandbox, all other immediate children are gofers.
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check that gofer is chroot'ed.
|
|
|
|
chroot, err := filepath.EvalSymlinks(filepath.Join("/proc", child, "root"))
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("error resolving /proc/<pid>/root symlink: %v", err)
|
|
|
|
}
|
|
|
|
if root != chroot {
|
|
|
|
t.Errorf("gofer chroot is wrong, want: %q, got: %q", root, chroot)
|
|
|
|
}
|
|
|
|
|
|
|
|
path, err := filepath.EvalSymlinks(filepath.Join("/proc", child, "cwd"))
|
|
|
|
if err != nil {
|
|
|
|
t.Fatalf("error resolving /proc/<pid>/cwd symlink: %v", err)
|
|
|
|
}
|
|
|
|
if root != path {
|
|
|
|
t.Errorf("gofer current dir is wrong, want: %q, got: %q", root, path)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|