github.com/jiasir/docker@v1.3.3-0.20170609024000-252e610103e7/integration-cli/docker_cli_userns_test.go (about)

     1  // +build !windows
     2  
     3  package main
     4  
     5  import (
     6  	"fmt"
     7  	"io/ioutil"
     8  	"os"
     9  	"os/exec"
    10  	"path"
    11  	"path/filepath"
    12  	"strconv"
    13  	"strings"
    14  
    15  	"github.com/docker/docker/integration-cli/checker"
    16  	"github.com/docker/docker/pkg/stringid"
    17  	"github.com/docker/docker/pkg/system"
    18  	"github.com/docker/docker/pkg/testutil"
    19  	"github.com/go-check/check"
    20  )
    21  
    22  // user namespaces test: run daemon with remapped root setting
    23  // 1. validate uid/gid maps are set properly
    24  // 2. verify that files created are owned by remapped root
    25  func (s *DockerDaemonSuite) TestDaemonUserNamespaceRootSetting(c *check.C) {
    26  	testRequires(c, DaemonIsLinux, SameHostDaemon, UserNamespaceInKernel)
    27  
    28  	s.d.StartWithBusybox(c, "--userns-remap", "default")
    29  
    30  	tmpDir, err := ioutil.TempDir("", "userns")
    31  	c.Assert(err, checker.IsNil)
    32  
    33  	defer os.RemoveAll(tmpDir)
    34  
    35  	// Set a non-existent path
    36  	tmpDirNotExists := path.Join(os.TempDir(), "userns"+stringid.GenerateRandomID())
    37  	defer os.RemoveAll(tmpDirNotExists)
    38  
    39  	// we need to find the uid and gid of the remapped root from the daemon's root dir info
    40  	uidgid := strings.Split(filepath.Base(s.d.Root), ".")
    41  	c.Assert(uidgid, checker.HasLen, 2, check.Commentf("Should have gotten uid/gid strings from root dirname: %s", filepath.Base(s.d.Root)))
    42  	uid, err := strconv.Atoi(uidgid[0])
    43  	c.Assert(err, checker.IsNil, check.Commentf("Can't parse uid"))
    44  	gid, err := strconv.Atoi(uidgid[1])
    45  	c.Assert(err, checker.IsNil, check.Commentf("Can't parse gid"))
    46  
    47  	// writable by the remapped root UID/GID pair
    48  	c.Assert(os.Chown(tmpDir, uid, gid), checker.IsNil)
    49  
    50  	out, err := s.d.Cmd("run", "-d", "--name", "userns", "-v", tmpDir+":/goofy", "-v", tmpDirNotExists+":/donald", "busybox", "sh", "-c", "touch /goofy/testfile; top")
    51  	c.Assert(err, checker.IsNil, check.Commentf("Output: %s", out))
    52  	user := s.findUser(c, "userns")
    53  	c.Assert(uidgid[0], checker.Equals, user)
    54  
    55  	// check that the created directory is owned by remapped uid:gid
    56  	statNotExists, err := system.Stat(tmpDirNotExists)
    57  	c.Assert(err, checker.IsNil)
    58  	c.Assert(statNotExists.UID(), checker.Equals, uint32(uid), check.Commentf("Created directory not owned by remapped root UID"))
    59  	c.Assert(statNotExists.GID(), checker.Equals, uint32(gid), check.Commentf("Created directory not owned by remapped root GID"))
    60  
    61  	pid, err := s.d.Cmd("inspect", "--format={{.State.Pid}}", "userns")
    62  	c.Assert(err, checker.IsNil, check.Commentf("Could not inspect running container: out: %q", pid))
    63  	// check the uid and gid maps for the PID to ensure root is remapped
    64  	// (cmd = cat /proc/<pid>/uid_map | grep -E '0\s+9999\s+1')
    65  	out, rc1, err := testutil.RunCommandPipelineWithOutput(
    66  		exec.Command("cat", "/proc/"+strings.TrimSpace(pid)+"/uid_map"),
    67  		exec.Command("grep", "-E", fmt.Sprintf("0[[:space:]]+%d[[:space:]]+", uid)))
    68  	c.Assert(rc1, checker.Equals, 0, check.Commentf("Didn't match uid_map: output: %s", out))
    69  
    70  	out, rc2, err := testutil.RunCommandPipelineWithOutput(
    71  		exec.Command("cat", "/proc/"+strings.TrimSpace(pid)+"/gid_map"),
    72  		exec.Command("grep", "-E", fmt.Sprintf("0[[:space:]]+%d[[:space:]]+", gid)))
    73  	c.Assert(rc2, checker.Equals, 0, check.Commentf("Didn't match gid_map: output: %s", out))
    74  
    75  	// check that the touched file is owned by remapped uid:gid
    76  	stat, err := system.Stat(filepath.Join(tmpDir, "testfile"))
    77  	c.Assert(err, checker.IsNil)
    78  	c.Assert(stat.UID(), checker.Equals, uint32(uid), check.Commentf("Touched file not owned by remapped root UID"))
    79  	c.Assert(stat.GID(), checker.Equals, uint32(gid), check.Commentf("Touched file not owned by remapped root GID"))
    80  
    81  	// use host usernamespace
    82  	out, err = s.d.Cmd("run", "-d", "--name", "userns_skip", "--userns", "host", "busybox", "sh", "-c", "touch /goofy/testfile; top")
    83  	c.Assert(err, checker.IsNil, check.Commentf("Output: %s", out))
    84  	user = s.findUser(c, "userns_skip")
    85  	// userns are skipped, user is root
    86  	c.Assert(user, checker.Equals, "root")
    87  }
    88  
    89  // findUser finds the uid or name of the user of the first process that runs in a container
    90  func (s *DockerDaemonSuite) findUser(c *check.C, container string) string {
    91  	out, err := s.d.Cmd("top", container)
    92  	c.Assert(err, checker.IsNil, check.Commentf("Output: %s", out))
    93  	rows := strings.Split(out, "\n")
    94  	if len(rows) < 2 {
    95  		// No process rows founds
    96  		c.FailNow()
    97  	}
    98  	return strings.Fields(rows[1])[0]
    99  }