Always set HOME env var with `runsc exec`.
We already do this for `runsc run`, but need to do the same for `runsc exec`. PiperOrigin-RevId: 270793459
This commit is contained in:
parent
6c88f674af
commit
f2ea8e6b24
|
@ -109,6 +109,7 @@ go_test(
|
|||
"//pkg/sentry/arch:registers_go_proto",
|
||||
"//pkg/sentry/context/contexttest",
|
||||
"//pkg/sentry/fs",
|
||||
"//pkg/sentry/kernel/auth",
|
||||
"//pkg/unet",
|
||||
"//runsc/fsgofer",
|
||||
"@com_github_opencontainers_runtime-spec//specs-go:go_default_library",
|
||||
|
|
|
@ -20,7 +20,6 @@ import (
|
|||
mrand "math/rand"
|
||||
"os"
|
||||
"runtime"
|
||||
"strings"
|
||||
"sync"
|
||||
"sync/atomic"
|
||||
"syscall"
|
||||
|
@ -535,23 +534,12 @@ func (l *Loader) run() error {
|
|||
return err
|
||||
}
|
||||
|
||||
// Read /etc/passwd for the user's HOME directory and set the HOME
|
||||
// environment variable as required by POSIX if it is not overridden by
|
||||
// the user.
|
||||
hasHomeEnvv := false
|
||||
for _, envv := range l.rootProcArgs.Envv {
|
||||
if strings.HasPrefix(envv, "HOME=") {
|
||||
hasHomeEnvv = true
|
||||
}
|
||||
}
|
||||
if !hasHomeEnvv {
|
||||
homeDir, err := getExecUserHome(ctx, l.rootProcArgs.MountNamespace, uint32(l.rootProcArgs.Credentials.RealKUID))
|
||||
if err != nil {
|
||||
return fmt.Errorf("error reading exec user: %v", err)
|
||||
}
|
||||
|
||||
l.rootProcArgs.Envv = append(l.rootProcArgs.Envv, "HOME="+homeDir)
|
||||
// Add the HOME enviroment variable if it is not already set.
|
||||
envv, err := maybeAddExecUserHome(ctx, l.rootProcArgs.MountNamespace, l.rootProcArgs.Credentials.RealKUID, l.rootProcArgs.Envv)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
l.rootProcArgs.Envv = envv
|
||||
|
||||
// Create the root container init task. It will begin running
|
||||
// when the kernel is started.
|
||||
|
@ -815,6 +803,16 @@ func (l *Loader) executeAsync(args *control.ExecArgs) (kernel.ThreadID, error) {
|
|||
})
|
||||
defer args.MountNamespace.DecRef()
|
||||
|
||||
// Add the HOME enviroment varible if it is not already set.
|
||||
root := args.MountNamespace.Root()
|
||||
defer root.DecRef()
|
||||
ctx := fs.WithRoot(l.k.SupervisorContext(), root)
|
||||
envv, err := maybeAddExecUserHome(ctx, args.MountNamespace, args.KUID, args.Envv)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
args.Envv = envv
|
||||
|
||||
// Start the process.
|
||||
proc := control.Proc{Kernel: l.k}
|
||||
args.PIDNamespace = tg.PIDNamespace()
|
||||
|
|
|
@ -16,6 +16,7 @@ package boot
|
|||
|
||||
import (
|
||||
"bufio"
|
||||
"fmt"
|
||||
"io"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
@ -23,6 +24,7 @@ import (
|
|||
"gvisor.dev/gvisor/pkg/abi/linux"
|
||||
"gvisor.dev/gvisor/pkg/sentry/context"
|
||||
"gvisor.dev/gvisor/pkg/sentry/fs"
|
||||
"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
|
||||
"gvisor.dev/gvisor/pkg/sentry/usermem"
|
||||
)
|
||||
|
||||
|
@ -42,7 +44,7 @@ func (r *fileReader) Read(buf []byte) (int, error) {
|
|||
|
||||
// getExecUserHome returns the home directory of the executing user read from
|
||||
// /etc/passwd as read from the container filesystem.
|
||||
func getExecUserHome(ctx context.Context, rootMns *fs.MountNamespace, uid uint32) (string, error) {
|
||||
func getExecUserHome(ctx context.Context, rootMns *fs.MountNamespace, uid auth.KUID) (string, error) {
|
||||
// The default user home directory to return if no user matching the user
|
||||
// if found in the /etc/passwd found in the image.
|
||||
const defaultHome = "/"
|
||||
|
@ -82,7 +84,7 @@ func getExecUserHome(ctx context.Context, rootMns *fs.MountNamespace, uid uint32
|
|||
File: f,
|
||||
}
|
||||
|
||||
homeDir, err := findHomeInPasswd(uid, r, defaultHome)
|
||||
homeDir, err := findHomeInPasswd(uint32(uid), r, defaultHome)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
@ -90,6 +92,28 @@ func getExecUserHome(ctx context.Context, rootMns *fs.MountNamespace, uid uint32
|
|||
return homeDir, nil
|
||||
}
|
||||
|
||||
// maybeAddExecUserHome returns a new slice with the HOME enviroment variable
|
||||
// set if the slice does not already contain it, otherwise it returns the
|
||||
// original slice unmodified.
|
||||
func maybeAddExecUserHome(ctx context.Context, mns *fs.MountNamespace, uid auth.KUID, envv []string) ([]string, error) {
|
||||
// Check if the envv already contains HOME.
|
||||
for _, env := range envv {
|
||||
if strings.HasPrefix(env, "HOME=") {
|
||||
// We have it. Return the original slice unmodified.
|
||||
return envv, nil
|
||||
}
|
||||
}
|
||||
|
||||
// Read /etc/passwd for the user's HOME directory and set the HOME
|
||||
// environment variable as required by POSIX if it is not overridden by
|
||||
// the user.
|
||||
homeDir, err := getExecUserHome(ctx, mns, uid)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("error reading exec user: %v", err)
|
||||
}
|
||||
return append(envv, "HOME="+homeDir), nil
|
||||
}
|
||||
|
||||
// findHomeInPasswd parses a passwd file and returns the given user's home
|
||||
// directory. This function does it's best to replicate the runc's behavior.
|
||||
func findHomeInPasswd(uid uint32, passwd io.Reader, defaultHome string) (string, error) {
|
||||
|
|
|
@ -25,6 +25,7 @@ import (
|
|||
specs "github.com/opencontainers/runtime-spec/specs-go"
|
||||
"gvisor.dev/gvisor/pkg/sentry/context/contexttest"
|
||||
"gvisor.dev/gvisor/pkg/sentry/fs"
|
||||
"gvisor.dev/gvisor/pkg/sentry/kernel/auth"
|
||||
)
|
||||
|
||||
func setupTempDir() (string, error) {
|
||||
|
@ -68,7 +69,7 @@ func setupPasswd(contents string, perms os.FileMode) func() (string, error) {
|
|||
// TestGetExecUserHome tests the getExecUserHome function.
|
||||
func TestGetExecUserHome(t *testing.T) {
|
||||
tests := map[string]struct {
|
||||
uid uint32
|
||||
uid auth.KUID
|
||||
createRoot func() (string, error)
|
||||
expected string
|
||||
}{
|
||||
|
|
|
@ -127,6 +127,7 @@ func (ex *Exec) Execute(_ context.Context, f *flag.FlagSet, args ...interface{})
|
|||
Fatalf("getting environment variables: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
if e.Capabilities == nil {
|
||||
// enableRaw is set to true to prevent the filtering out of
|
||||
// CAP_NET_RAW. This is the opposite of Create() because exec
|
||||
|
|
|
@ -287,6 +287,14 @@ func (d *Docker) Exec(args ...string) (string, error) {
|
|||
return do(a...)
|
||||
}
|
||||
|
||||
// ExecAsUser calls 'docker exec' as the given user with the arguments
|
||||
// provided.
|
||||
func (d *Docker) ExecAsUser(user string, args ...string) (string, error) {
|
||||
a := []string{"exec", "--user", user, d.Name}
|
||||
a = append(a, args...)
|
||||
return do(a...)
|
||||
}
|
||||
|
||||
// ExecWithTerminal calls 'docker exec -it' with the arguments provided and
|
||||
// attaches a pty to stdio.
|
||||
func (d *Docker) ExecWithTerminal(args ...string) (*exec.Cmd, *os.File, error) {
|
||||
|
|
|
@ -177,3 +177,45 @@ func TestExecEnv(t *testing.T) {
|
|||
t.Errorf("wanted exec output to contain %q, got %q", want, got)
|
||||
}
|
||||
}
|
||||
|
||||
// Test that exec always has HOME environment set, even when not set in run.
|
||||
func TestExecEnvHasHome(t *testing.T) {
|
||||
// Base alpine image does not have any environment variables set.
|
||||
if err := dockerutil.Pull("alpine"); err != nil {
|
||||
t.Fatalf("docker pull failed: %v", err)
|
||||
}
|
||||
d := dockerutil.MakeDocker("exec-env-test")
|
||||
|
||||
// We will check that HOME is set for root user, and also for a new
|
||||
// non-root user we will create.
|
||||
newUID := 1234
|
||||
newHome := "/foo/bar"
|
||||
|
||||
// Create a new user with a home directory, and then sleep.
|
||||
script := fmt.Sprintf(`
|
||||
mkdir -p -m 777 %s && \
|
||||
adduser foo -D -u %d -h %s && \
|
||||
sleep 1000`, newHome, newUID, newHome)
|
||||
if err := d.Run("alpine", "/bin/sh", "-c", script); err != nil {
|
||||
t.Fatalf("docker run failed: %v", err)
|
||||
}
|
||||
defer d.CleanUp()
|
||||
|
||||
// Exec "echo $HOME", and expect to see "/root".
|
||||
got, err := d.Exec("/bin/sh", "-c", "echo $HOME")
|
||||
if err != nil {
|
||||
t.Fatalf("docker exec failed: %v", err)
|
||||
}
|
||||
if want := "/root"; !strings.Contains(got, want) {
|
||||
t.Errorf("wanted exec output to contain %q, got %q", want, got)
|
||||
}
|
||||
|
||||
// Execute the same as uid 123 and expect newHome.
|
||||
got, err = d.ExecAsUser(strconv.Itoa(newUID), "/bin/sh", "-c", "echo $HOME")
|
||||
if err != nil {
|
||||
t.Fatalf("docker exec failed: %v", err)
|
||||
}
|
||||
if want := newHome; !strings.Contains(got, want) {
|
||||
t.Errorf("wanted exec output to contain %q, got %q", want, got)
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue