Use container's capabilities in exec

When no capabilities are specified in exec, use the
container's capabilities to match runc's behavior.

PiperOrigin-RevId: 211735186
Change-Id: Icd372ed64410c81144eae94f432dffc9fe3a86ce

3 files changed, 64 insertions, 1 deletions

diff --git a/runsc/test/integration/BUILD b/runsc/test/integration/BUILD
index b366fe936..4407016ad 100644
--- a/runsc/test/integration/BUILD
+++ b/runsc/test/integration/BUILD
@@ -6,6 +6,7 @@ go_test(
     name = "integration_test",
     size = "large",
     srcs = [
+        "exec_test.go",
         "integration_test.go",
     ],
     embed = [":integration"],
diff --git a/runsc/test/integration/exec_test.go b/runsc/test/integration/exec_test.go
new file mode 100644
index 000000000..6053ecd1c
--- /dev/null
+++ b/runsc/test/integration/exec_test.go
@@ -0,0 +1,62 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package image provides end-to-end integration tests for runsc. These tests require
+// docker and runsc to be installed on the machine. To set it up, run:
+//
+//     ./runsc/test/install.sh [--runtime <name>]
+//
+// The tests expect the runtime name to be provided in the RUNSC_RUNTIME
+// environment variable (default: runsc-test).
+//
+// Each test calls docker commands to start up a container, and tests that it is
+// behaving properly, with various runsc commands. The container is killed and deleted
+// at the end.
+
+package integration
+
+import (
+	"testing"
+	"time"
+
+	"gvisor.googlesource.com/gvisor/runsc/test/testutil"
+)
+
+func TestExecCapabilities(t *testing.T) {
+	if err := testutil.Pull("alpine"); err != nil {
+		t.Fatalf("docker pull failed: %v", err)
+	}
+	d := testutil.MakeDocker("exec-test")
+
+	// Start the container.
+	if _, err := d.Run("alpine", "sh", "-c", "cat /proc/self/status; sleep 100"); err != nil {
+		t.Fatalf("docker run failed: %v", err)
+	}
+	defer d.CleanUp()
+
+	want, err := d.WaitForOutput("CapEff:\t[0-9a-f]+\n", 5*time.Second)
+	if err != nil {
+		t.Fatalf("WaitForOutput() timeout: %v", err)
+	}
+	t.Log("Root capabilities:", want)
+
+	// Now check that exec'd process capabilities match the root.
+	got, err := d.Exec("grep", "CapEff:", "/proc/self/status")
+	if err != nil {
+		t.Fatalf("docker exec failed: %v", err)
+	}
+	if got != want {
+		t.Errorf("wrong capabilities, got: %q, want: %q", got, want)
+	}
+}
diff --git a/runsc/test/integration/integration_test.go b/runsc/test/integration/integration_test.go
index c6b546a56..59df5bd7c 100644
--- a/runsc/test/integration/integration_test.go
+++ b/runsc/test/integration/integration_test.go
@@ -179,7 +179,7 @@ func TestConnectToSelf(t *testing.T) {
 	if want := "server\n"; reply != want {
 		t.Errorf("Error on server, want: %q, got: %q", want, reply)
 	}
-	if err := d.WaitForOutput("^client\n$", 1*time.Second); err != nil {
+	if _, err := d.WaitForOutput("^client\n$", 1*time.Second); err != nil {
 		t.Fatal("docker.WaitForOutput(client) timeout:", err)
 	}
 }