Use container's capabilities in exec

When no capabilities are specified in exec, use the
container's capabilities to match runc's behavior.

PiperOrigin-RevId: 211735186
Change-Id: Icd372ed64410c81144eae94f432dffc9fe3a86ce

6 files changed, 94 insertions, 17 deletions

diff --git a/runsc/cmd/exec.go b/runsc/cmd/exec.go
index 966d2e258..da1642c08 100644
--- a/runsc/cmd/exec.go
+++ b/runsc/cmd/exec.go
@@ -115,16 +115,22 @@ func (ex *Exec) Execute(_ context.Context, f *flag.FlagSet, args ...interface{})
 		Fatalf("error loading sandbox: %v", err)
 	}
 
+	// Replace empty settings with defaults from container.
 	if e.WorkingDirectory == "" {
 		e.WorkingDirectory = c.Spec.Process.Cwd
 	}
-
 	if e.Envv == nil {
 		e.Envv, err = resolveEnvs(c.Spec.Process.Env, ex.env)
 		if err != nil {
 			Fatalf("error getting environment variables: %v", err)
 		}
 	}
+	if e.Capabilities == nil {
+		e.Capabilities, err = specutils.Capabilities(c.Spec.Process.Capabilities)
+		if err != nil {
+			Fatalf("error creating capabilities: %v", err)
+		}
+	}
 
 	// containerd expects an actual process to represent the container being
 	// executed. If detach was specified, starts a child in non-detach mode,
@@ -265,9 +271,13 @@ func (ex *Exec) argsFromCLI(argv []string) (*control.ExecArgs, error) {
 		extraKGIDs = append(extraKGIDs, auth.KGID(kgid))
 	}
 
-	caps, err := capabilities(ex.caps)
-	if err != nil {
-		return nil, fmt.Errorf("capabilities error: %v", err)
+	var caps *auth.TaskCapabilities
+	if len(ex.caps) > 0 {
+		var err error
+		caps, err = capabilities(ex.caps)
+		if err != nil {
+			return nil, fmt.Errorf("capabilities error: %v", err)
+		}
 	}
 
 	return &control.ExecArgs{
@@ -299,9 +309,13 @@ func (ex *Exec) argsFromProcessFile() (*control.ExecArgs, error) {
 // to ExecArgs.
 func argsFromProcess(p *specs.Process) (*control.ExecArgs, error) {
 	// Create capabilities.
-	caps, err := specutils.Capabilities(p.Capabilities)
-	if err != nil {
-		return nil, fmt.Errorf("error creating capabilities: %v", err)
+	var caps *auth.TaskCapabilities
+	if p.Capabilities != nil {
+		var err error
+		caps, err = specutils.Capabilities(p.Capabilities)
+		if err != nil {
+			return nil, fmt.Errorf("error creating capabilities: %v", err)
+		}
 	}
 
 	// Convert the spec's additional GIDs to KGIDs.
diff --git a/runsc/test/image/image_test.go b/runsc/test/image/image_test.go
index b1e5e726a..13fd8f1ee 100644
--- a/runsc/test/image/image_test.go
+++ b/runsc/test/image/image_test.go
@@ -44,7 +44,7 @@ func TestHelloWorld(t *testing.T) {
 	}
 	defer d.CleanUp()
 
-	if err := d.WaitForOutput("Hello from Docker!", 5*time.Second); err != nil {
+	if _, err := d.WaitForOutput("Hello from Docker!", 5*time.Second); err != nil {
 		t.Fatalf("docker didn't say hello: %v", err)
 	}
 }
@@ -160,7 +160,7 @@ func TestMysql(t *testing.T) {
 	defer d.CleanUp()
 
 	// Wait until it's up and running.
-	if err := d.WaitForOutput("port: 3306  MySQL Community Server", 3*time.Minute); err != nil {
+	if _, err := d.WaitForOutput("port: 3306  MySQL Community Server", 3*time.Minute); err != nil {
 		t.Fatalf("docker.WaitForOutput() timeout: %v", err)
 	}
 
@@ -184,10 +184,10 @@ func TestMysql(t *testing.T) {
 	defer client.CleanUp()
 
 	// Ensure file executed to the end and shutdown mysql.
-	if err := client.WaitForOutput("--------------\nshutdown\n--------------", 15*time.Second); err != nil {
+	if _, err := client.WaitForOutput("--------------\nshutdown\n--------------", 15*time.Second); err != nil {
 		t.Fatalf("docker.WaitForOutput() timeout: %v", err)
 	}
-	if err := d.WaitForOutput("mysqld: Shutdown complete", 30*time.Second); err != nil {
+	if _, err := d.WaitForOutput("mysqld: Shutdown complete", 30*time.Second); err != nil {
 		t.Fatalf("docker.WaitForOutput() timeout: %v", err)
 	}
 }
diff --git a/runsc/test/integration/BUILD b/runsc/test/integration/BUILD
index b366fe936..4407016ad 100644
--- a/runsc/test/integration/BUILD
+++ b/runsc/test/integration/BUILD
@@ -6,6 +6,7 @@ go_test(
     name = "integration_test",
     size = "large",
     srcs = [
+        "exec_test.go",
         "integration_test.go",
     ],
     embed = [":integration"],
diff --git a/runsc/test/integration/exec_test.go b/runsc/test/integration/exec_test.go
new file mode 100644
index 000000000..6053ecd1c
--- /dev/null
+++ b/runsc/test/integration/exec_test.go
@@ -0,0 +1,62 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package image provides end-to-end integration tests for runsc. These tests require
+// docker and runsc to be installed on the machine. To set it up, run:
+//
+//     ./runsc/test/install.sh [--runtime <name>]
+//
+// The tests expect the runtime name to be provided in the RUNSC_RUNTIME
+// environment variable (default: runsc-test).
+//
+// Each test calls docker commands to start up a container, and tests that it is
+// behaving properly, with various runsc commands. The container is killed and deleted
+// at the end.
+
+package integration
+
+import (
+	"testing"
+	"time"
+
+	"gvisor.googlesource.com/gvisor/runsc/test/testutil"
+)
+
+func TestExecCapabilities(t *testing.T) {
+	if err := testutil.Pull("alpine"); err != nil {
+		t.Fatalf("docker pull failed: %v", err)
+	}
+	d := testutil.MakeDocker("exec-test")
+
+	// Start the container.
+	if _, err := d.Run("alpine", "sh", "-c", "cat /proc/self/status; sleep 100"); err != nil {
+		t.Fatalf("docker run failed: %v", err)
+	}
+	defer d.CleanUp()
+
+	want, err := d.WaitForOutput("CapEff:\t[0-9a-f]+\n", 5*time.Second)
+	if err != nil {
+		t.Fatalf("WaitForOutput() timeout: %v", err)
+	}
+	t.Log("Root capabilities:", want)
+
+	// Now check that exec'd process capabilities match the root.
+	got, err := d.Exec("grep", "CapEff:", "/proc/self/status")
+	if err != nil {
+		t.Fatalf("docker exec failed: %v", err)
+	}
+	if got != want {
+		t.Errorf("wrong capabilities, got: %q, want: %q", got, want)
+	}
+}
diff --git a/runsc/test/integration/integration_test.go b/runsc/test/integration/integration_test.go
index c6b546a56..59df5bd7c 100644
--- a/runsc/test/integration/integration_test.go
+++ b/runsc/test/integration/integration_test.go
@@ -179,7 +179,7 @@ func TestConnectToSelf(t *testing.T) {
 	if want := "server\n"; reply != want {
 		t.Errorf("Error on server, want: %q, got: %q", want, reply)
 	}
-	if err := d.WaitForOutput("^client\n$", 1*time.Second); err != nil {
+	if _, err := d.WaitForOutput("^client\n$", 1*time.Second); err != nil {
 		t.Fatal("docker.WaitForOutput(client) timeout:", err)
 	}
 }
diff --git a/runsc/test/testutil/docker.go b/runsc/test/testutil/docker.go
index fc67c174a..c73bb0406 100644
--- a/runsc/test/testutil/docker.go
+++ b/runsc/test/testutil/docker.go
@@ -218,20 +218,20 @@ func (d *Docker) FindPort(sandboxPort int) (int, error) {
 
 // WaitForOutput calls 'docker logs' to retrieve containers output and searches
 // for the given pattern.
-func (d *Docker) WaitForOutput(pattern string, timeout time.Duration) error {
+func (d *Docker) WaitForOutput(pattern string, timeout time.Duration) (string, error) {
 	re := regexp.MustCompile(pattern)
 	var out string
 	for exp := time.Now().Add(timeout); time.Now().Before(exp); {
 		var err error
 		out, err = do("logs", d.Name)
 		if err != nil {
-			return err
+			return "", err
 		}
-		if re.MatchString(out) {
+		if match := re.FindString(out); match != "" {
 			// Success!
-			return nil
+			return match, nil
 		}
 		time.Sleep(100 * time.Millisecond)
 	}
-	return fmt.Errorf("timeout waiting for output %q: %s", re.String(), out)
+	return "", fmt.Errorf("timeout waiting for output %q: %s", re.String(), out)
 }