github.com/flavio/docker@v0.1.3-0.20170117145210-f63d1a6eec47/integration-cli/docker_cli_authz_plugin_v2_test.go (about)

     1  // +build !windows
     2  
     3  package main
     4  
     5  import (
     6  	"fmt"
     7  	"strings"
     8  
     9  	"github.com/docker/docker/integration-cli/checker"
    10  	"github.com/docker/docker/integration-cli/daemon"
    11  	"github.com/go-check/check"
    12  )
    13  
    14  var (
    15  	authzPluginName            = "riyaz/authz-no-volume-plugin"
    16  	authzPluginTag             = "latest"
    17  	authzPluginNameWithTag     = authzPluginName + ":" + authzPluginTag
    18  	authzPluginBadManifestName = "riyaz/authz-plugin-bad-manifest"
    19  	nonexistentAuthzPluginName = "riyaz/nonexistent-authz-plugin"
    20  )
    21  
    22  func init() {
    23  	check.Suite(&DockerAuthzV2Suite{
    24  		ds: &DockerSuite{},
    25  	})
    26  }
    27  
    28  type DockerAuthzV2Suite struct {
    29  	ds *DockerSuite
    30  	d  *daemon.Daemon
    31  }
    32  
    33  func (s *DockerAuthzV2Suite) SetUpTest(c *check.C) {
    34  	testRequires(c, DaemonIsLinux, Network)
    35  	s.d = daemon.New(c, dockerBinary, dockerdBinary, daemon.Config{
    36  		Experimental: testEnv.ExperimentalDaemon(),
    37  	})
    38  	s.d.Start(c)
    39  }
    40  
    41  func (s *DockerAuthzV2Suite) TearDownTest(c *check.C) {
    42  	if s.d != nil {
    43  		s.d.Stop(c)
    44  		s.ds.TearDownTest(c)
    45  	}
    46  }
    47  
    48  func (s *DockerAuthzV2Suite) TestAuthZPluginAllowNonVolumeRequest(c *check.C) {
    49  	testRequires(c, DaemonIsLinux, IsAmd64, Network)
    50  	// Install authz plugin
    51  	_, err := s.d.Cmd("plugin", "install", "--grant-all-permissions", authzPluginNameWithTag)
    52  	c.Assert(err, checker.IsNil)
    53  	// start the daemon with the plugin and load busybox, --net=none build fails otherwise
    54  	// because it needs to pull busybox
    55  	s.d.Restart(c, "--authorization-plugin="+authzPluginNameWithTag)
    56  	c.Assert(s.d.LoadBusybox(), check.IsNil)
    57  
    58  	// defer disabling the plugin
    59  	defer func() {
    60  		s.d.Restart(c)
    61  		_, err = s.d.Cmd("plugin", "disable", authzPluginNameWithTag)
    62  		c.Assert(err, checker.IsNil)
    63  		_, err = s.d.Cmd("plugin", "rm", authzPluginNameWithTag)
    64  		c.Assert(err, checker.IsNil)
    65  	}()
    66  
    67  	// Ensure docker run command and accompanying docker ps are successful
    68  	out, err := s.d.Cmd("run", "-d", "busybox", "top")
    69  	c.Assert(err, check.IsNil)
    70  
    71  	id := strings.TrimSpace(out)
    72  
    73  	out, err = s.d.Cmd("ps")
    74  	c.Assert(err, check.IsNil)
    75  	c.Assert(assertContainerList(out, []string{id}), check.Equals, true)
    76  }
    77  
    78  func (s *DockerAuthzV2Suite) TestAuthZPluginRejectVolumeRequests(c *check.C) {
    79  	testRequires(c, DaemonIsLinux, IsAmd64, Network)
    80  	// Install authz plugin
    81  	_, err := s.d.Cmd("plugin", "install", "--grant-all-permissions", authzPluginNameWithTag)
    82  	c.Assert(err, checker.IsNil)
    83  
    84  	// restart the daemon with the plugin
    85  	s.d.Restart(c, "--authorization-plugin="+authzPluginNameWithTag)
    86  
    87  	// defer disabling the plugin
    88  	defer func() {
    89  		s.d.Restart(c)
    90  		_, err = s.d.Cmd("plugin", "disable", authzPluginNameWithTag)
    91  		c.Assert(err, checker.IsNil)
    92  		_, err = s.d.Cmd("plugin", "rm", authzPluginNameWithTag)
    93  		c.Assert(err, checker.IsNil)
    94  	}()
    95  
    96  	out, err := s.d.Cmd("volume", "create")
    97  	c.Assert(err, check.NotNil)
    98  	c.Assert(out, checker.Contains, fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag))
    99  
   100  	out, err = s.d.Cmd("volume", "ls")
   101  	c.Assert(err, check.NotNil)
   102  	c.Assert(out, checker.Contains, fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag))
   103  
   104  	// The plugin will block the command before it can determine the volume does not exist
   105  	out, err = s.d.Cmd("volume", "rm", "test")
   106  	c.Assert(err, check.NotNil)
   107  	c.Assert(out, checker.Contains, fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag))
   108  
   109  	out, err = s.d.Cmd("volume", "inspect", "test")
   110  	c.Assert(err, check.NotNil)
   111  	c.Assert(out, checker.Contains, fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag))
   112  
   113  	out, err = s.d.Cmd("volume", "prune", "-f")
   114  	c.Assert(err, check.NotNil)
   115  	c.Assert(out, checker.Contains, fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag))
   116  }
   117  
   118  func (s *DockerAuthzV2Suite) TestAuthZPluginBadManifestFailsDaemonStart(c *check.C) {
   119  	testRequires(c, DaemonIsLinux, IsAmd64, Network)
   120  	// Install authz plugin with bad manifest
   121  	_, err := s.d.Cmd("plugin", "install", "--grant-all-permissions", authzPluginBadManifestName)
   122  	c.Assert(err, checker.IsNil)
   123  
   124  	// start the daemon with the plugin, it will error
   125  	c.Assert(s.d.RestartWithError("--authorization-plugin="+authzPluginBadManifestName), check.NotNil)
   126  
   127  	// restarting the daemon without requiring the plugin will succeed
   128  	s.d.Restart(c)
   129  }
   130  
   131  func (s *DockerAuthzV2Suite) TestNonexistentAuthZPluginFailsDaemonStart(c *check.C) {
   132  	testRequires(c, DaemonIsLinux, Network)
   133  	// start the daemon with a non-existent authz plugin, it will error
   134  	c.Assert(s.d.RestartWithError("--authorization-plugin="+nonexistentAuthzPluginName), check.NotNil)
   135  
   136  	// restarting the daemon without requiring the plugin will succeed
   137  	s.d.Start(c)
   138  }