github.com/flavio/docker@v0.1.3-0.20170117145210-f63d1a6eec47/integration-cli/docker_cli_authz_plugin_v2_test.go (about) 1 // +build !windows 2 3 package main 4 5 import ( 6 "fmt" 7 "strings" 8 9 "github.com/docker/docker/integration-cli/checker" 10 "github.com/docker/docker/integration-cli/daemon" 11 "github.com/go-check/check" 12 ) 13 14 var ( 15 authzPluginName = "riyaz/authz-no-volume-plugin" 16 authzPluginTag = "latest" 17 authzPluginNameWithTag = authzPluginName + ":" + authzPluginTag 18 authzPluginBadManifestName = "riyaz/authz-plugin-bad-manifest" 19 nonexistentAuthzPluginName = "riyaz/nonexistent-authz-plugin" 20 ) 21 22 func init() { 23 check.Suite(&DockerAuthzV2Suite{ 24 ds: &DockerSuite{}, 25 }) 26 } 27 28 type DockerAuthzV2Suite struct { 29 ds *DockerSuite 30 d *daemon.Daemon 31 } 32 33 func (s *DockerAuthzV2Suite) SetUpTest(c *check.C) { 34 testRequires(c, DaemonIsLinux, Network) 35 s.d = daemon.New(c, dockerBinary, dockerdBinary, daemon.Config{ 36 Experimental: testEnv.ExperimentalDaemon(), 37 }) 38 s.d.Start(c) 39 } 40 41 func (s *DockerAuthzV2Suite) TearDownTest(c *check.C) { 42 if s.d != nil { 43 s.d.Stop(c) 44 s.ds.TearDownTest(c) 45 } 46 } 47 48 func (s *DockerAuthzV2Suite) TestAuthZPluginAllowNonVolumeRequest(c *check.C) { 49 testRequires(c, DaemonIsLinux, IsAmd64, Network) 50 // Install authz plugin 51 _, err := s.d.Cmd("plugin", "install", "--grant-all-permissions", authzPluginNameWithTag) 52 c.Assert(err, checker.IsNil) 53 // start the daemon with the plugin and load busybox, --net=none build fails otherwise 54 // because it needs to pull busybox 55 s.d.Restart(c, "--authorization-plugin="+authzPluginNameWithTag) 56 c.Assert(s.d.LoadBusybox(), check.IsNil) 57 58 // defer disabling the plugin 59 defer func() { 60 s.d.Restart(c) 61 _, err = s.d.Cmd("plugin", "disable", authzPluginNameWithTag) 62 c.Assert(err, checker.IsNil) 63 _, err = s.d.Cmd("plugin", "rm", authzPluginNameWithTag) 64 c.Assert(err, checker.IsNil) 65 }() 66 67 // Ensure docker run command and accompanying docker ps are successful 68 out, err := s.d.Cmd("run", "-d", "busybox", "top") 69 c.Assert(err, check.IsNil) 70 71 id := strings.TrimSpace(out) 72 73 out, err = s.d.Cmd("ps") 74 c.Assert(err, check.IsNil) 75 c.Assert(assertContainerList(out, []string{id}), check.Equals, true) 76 } 77 78 func (s *DockerAuthzV2Suite) TestAuthZPluginRejectVolumeRequests(c *check.C) { 79 testRequires(c, DaemonIsLinux, IsAmd64, Network) 80 // Install authz plugin 81 _, err := s.d.Cmd("plugin", "install", "--grant-all-permissions", authzPluginNameWithTag) 82 c.Assert(err, checker.IsNil) 83 84 // restart the daemon with the plugin 85 s.d.Restart(c, "--authorization-plugin="+authzPluginNameWithTag) 86 87 // defer disabling the plugin 88 defer func() { 89 s.d.Restart(c) 90 _, err = s.d.Cmd("plugin", "disable", authzPluginNameWithTag) 91 c.Assert(err, checker.IsNil) 92 _, err = s.d.Cmd("plugin", "rm", authzPluginNameWithTag) 93 c.Assert(err, checker.IsNil) 94 }() 95 96 out, err := s.d.Cmd("volume", "create") 97 c.Assert(err, check.NotNil) 98 c.Assert(out, checker.Contains, fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)) 99 100 out, err = s.d.Cmd("volume", "ls") 101 c.Assert(err, check.NotNil) 102 c.Assert(out, checker.Contains, fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)) 103 104 // The plugin will block the command before it can determine the volume does not exist 105 out, err = s.d.Cmd("volume", "rm", "test") 106 c.Assert(err, check.NotNil) 107 c.Assert(out, checker.Contains, fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)) 108 109 out, err = s.d.Cmd("volume", "inspect", "test") 110 c.Assert(err, check.NotNil) 111 c.Assert(out, checker.Contains, fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)) 112 113 out, err = s.d.Cmd("volume", "prune", "-f") 114 c.Assert(err, check.NotNil) 115 c.Assert(out, checker.Contains, fmt.Sprintf("Error response from daemon: plugin %s failed with error:", authzPluginNameWithTag)) 116 } 117 118 func (s *DockerAuthzV2Suite) TestAuthZPluginBadManifestFailsDaemonStart(c *check.C) { 119 testRequires(c, DaemonIsLinux, IsAmd64, Network) 120 // Install authz plugin with bad manifest 121 _, err := s.d.Cmd("plugin", "install", "--grant-all-permissions", authzPluginBadManifestName) 122 c.Assert(err, checker.IsNil) 123 124 // start the daemon with the plugin, it will error 125 c.Assert(s.d.RestartWithError("--authorization-plugin="+authzPluginBadManifestName), check.NotNil) 126 127 // restarting the daemon without requiring the plugin will succeed 128 s.d.Restart(c) 129 } 130 131 func (s *DockerAuthzV2Suite) TestNonexistentAuthZPluginFailsDaemonStart(c *check.C) { 132 testRequires(c, DaemonIsLinux, Network) 133 // start the daemon with a non-existent authz plugin, it will error 134 c.Assert(s.d.RestartWithError("--authorization-plugin="+nonexistentAuthzPluginName), check.NotNil) 135 136 // restarting the daemon without requiring the plugin will succeed 137 s.d.Start(c) 138 }