github.com/fabiokung/docker@v0.11.2-0.20170222101415-4534dcd49497/integration-cli/docker_cli_userns_test.go (about) 1 // +build !windows 2 3 package main 4 5 import ( 6 "fmt" 7 "io/ioutil" 8 "os" 9 "os/exec" 10 "path" 11 "path/filepath" 12 "strconv" 13 "strings" 14 15 "github.com/docker/docker/integration-cli/checker" 16 "github.com/docker/docker/pkg/stringid" 17 "github.com/docker/docker/pkg/system" 18 "github.com/docker/docker/pkg/testutil" 19 "github.com/go-check/check" 20 ) 21 22 // user namespaces test: run daemon with remapped root setting 23 // 1. validate uid/gid maps are set properly 24 // 2. verify that files created are owned by remapped root 25 func (s *DockerDaemonSuite) TestDaemonUserNamespaceRootSetting(c *check.C) { 26 testRequires(c, DaemonIsLinux, SameHostDaemon, UserNamespaceInKernel) 27 28 s.d.StartWithBusybox(c, "--userns-remap", "default") 29 30 tmpDir, err := ioutil.TempDir("", "userns") 31 c.Assert(err, checker.IsNil) 32 33 defer os.RemoveAll(tmpDir) 34 35 // Set a non-existent path 36 tmpDirNotExists := path.Join(os.TempDir(), "userns"+stringid.GenerateRandomID()) 37 defer os.RemoveAll(tmpDirNotExists) 38 39 // we need to find the uid and gid of the remapped root from the daemon's root dir info 40 uidgid := strings.Split(filepath.Base(s.d.Root), ".") 41 c.Assert(uidgid, checker.HasLen, 2, check.Commentf("Should have gotten uid/gid strings from root dirname: %s", filepath.Base(s.d.Root))) 42 uid, err := strconv.Atoi(uidgid[0]) 43 c.Assert(err, checker.IsNil, check.Commentf("Can't parse uid")) 44 gid, err := strconv.Atoi(uidgid[1]) 45 c.Assert(err, checker.IsNil, check.Commentf("Can't parse gid")) 46 47 // writable by the remapped root UID/GID pair 48 c.Assert(os.Chown(tmpDir, uid, gid), checker.IsNil) 49 50 out, err := s.d.Cmd("run", "-d", "--name", "userns", "-v", tmpDir+":/goofy", "-v", tmpDirNotExists+":/donald", "busybox", "sh", "-c", "touch /goofy/testfile; top") 51 c.Assert(err, checker.IsNil, check.Commentf("Output: %s", out)) 52 user := s.findUser(c, "userns") 53 c.Assert(uidgid[0], checker.Equals, user) 54 55 // check that the created directory is owned by remapped uid:gid 56 statNotExists, err := system.Stat(tmpDirNotExists) 57 c.Assert(err, checker.IsNil) 58 c.Assert(statNotExists.UID(), checker.Equals, uint32(uid), check.Commentf("Created directory not owned by remapped root UID")) 59 c.Assert(statNotExists.GID(), checker.Equals, uint32(gid), check.Commentf("Created directory not owned by remapped root GID")) 60 61 pid, err := s.d.Cmd("inspect", "--format={{.State.Pid}}", "userns") 62 c.Assert(err, checker.IsNil, check.Commentf("Could not inspect running container: out: %q", pid)) 63 // check the uid and gid maps for the PID to ensure root is remapped 64 // (cmd = cat /proc/<pid>/uid_map | grep -E '0\s+9999\s+1') 65 out, rc1, err := testutil.RunCommandPipelineWithOutput( 66 exec.Command("cat", "/proc/"+strings.TrimSpace(pid)+"/uid_map"), 67 exec.Command("grep", "-E", fmt.Sprintf("0[[:space:]]+%d[[:space:]]+", uid))) 68 c.Assert(rc1, checker.Equals, 0, check.Commentf("Didn't match uid_map: output: %s", out)) 69 70 out, rc2, err := testutil.RunCommandPipelineWithOutput( 71 exec.Command("cat", "/proc/"+strings.TrimSpace(pid)+"/gid_map"), 72 exec.Command("grep", "-E", fmt.Sprintf("0[[:space:]]+%d[[:space:]]+", gid))) 73 c.Assert(rc2, checker.Equals, 0, check.Commentf("Didn't match gid_map: output: %s", out)) 74 75 // check that the touched file is owned by remapped uid:gid 76 stat, err := system.Stat(filepath.Join(tmpDir, "testfile")) 77 c.Assert(err, checker.IsNil) 78 c.Assert(stat.UID(), checker.Equals, uint32(uid), check.Commentf("Touched file not owned by remapped root UID")) 79 c.Assert(stat.GID(), checker.Equals, uint32(gid), check.Commentf("Touched file not owned by remapped root GID")) 80 81 // use host usernamespace 82 out, err = s.d.Cmd("run", "-d", "--name", "userns_skip", "--userns", "host", "busybox", "sh", "-c", "touch /goofy/testfile; top") 83 c.Assert(err, checker.IsNil, check.Commentf("Output: %s", out)) 84 user = s.findUser(c, "userns_skip") 85 // userns are skipped, user is root 86 c.Assert(user, checker.Equals, "root") 87 } 88 89 // findUser finds the uid or name of the user of the first process that runs in a container 90 func (s *DockerDaemonSuite) findUser(c *check.C, container string) string { 91 out, err := s.d.Cmd("top", container) 92 c.Assert(err, checker.IsNil, check.Commentf("Output: %s", out)) 93 rows := strings.Split(out, "\n") 94 if len(rows) < 2 { 95 // No process rows founds 96 c.FailNow() 97 } 98 return strings.Fields(rows[1])[0] 99 }