diff options
| -rw-r--r-- | runsc/cmd/exec.go | 28 | ||||
| -rw-r--r-- | runsc/test/image/image_test.go | 8 | ||||
| -rw-r--r-- | runsc/test/integration/BUILD | 1 | ||||
| -rw-r--r-- | runsc/test/integration/exec_test.go | 62 | ||||
| -rw-r--r-- | runsc/test/integration/integration_test.go | 2 | ||||
| -rw-r--r-- | runsc/test/testutil/docker.go | 10 |
6 files changed, 94 insertions, 17 deletions
diff --git a/runsc/cmd/exec.go b/runsc/cmd/exec.go index 966d2e258..da1642c08 100644 --- a/runsc/cmd/exec.go +++ b/runsc/cmd/exec.go @@ -115,16 +115,22 @@ func (ex *Exec) Execute(_ context.Context, f *flag.FlagSet, args ...interface{}) Fatalf("error loading sandbox: %v", err) } + // Replace empty settings with defaults from container. if e.WorkingDirectory == "" { e.WorkingDirectory = c.Spec.Process.Cwd } - if e.Envv == nil { e.Envv, err = resolveEnvs(c.Spec.Process.Env, ex.env) if err != nil { Fatalf("error getting environment variables: %v", err) } } + if e.Capabilities == nil { + e.Capabilities, err = specutils.Capabilities(c.Spec.Process.Capabilities) + if err != nil { + Fatalf("error creating capabilities: %v", err) + } + } // containerd expects an actual process to represent the container being // executed. If detach was specified, starts a child in non-detach mode, @@ -265,9 +271,13 @@ func (ex *Exec) argsFromCLI(argv []string) (*control.ExecArgs, error) { extraKGIDs = append(extraKGIDs, auth.KGID(kgid)) } - caps, err := capabilities(ex.caps) - if err != nil { - return nil, fmt.Errorf("capabilities error: %v", err) + var caps *auth.TaskCapabilities + if len(ex.caps) > 0 { + var err error + caps, err = capabilities(ex.caps) + if err != nil { + return nil, fmt.Errorf("capabilities error: %v", err) + } } return &control.ExecArgs{ @@ -299,9 +309,13 @@ func (ex *Exec) argsFromProcessFile() (*control.ExecArgs, error) { // to ExecArgs. func argsFromProcess(p *specs.Process) (*control.ExecArgs, error) { // Create capabilities. - caps, err := specutils.Capabilities(p.Capabilities) - if err != nil { - return nil, fmt.Errorf("error creating capabilities: %v", err) + var caps *auth.TaskCapabilities + if p.Capabilities != nil { + var err error + caps, err = specutils.Capabilities(p.Capabilities) + if err != nil { + return nil, fmt.Errorf("error creating capabilities: %v", err) + } } // Convert the spec's additional GIDs to KGIDs. diff --git a/runsc/test/image/image_test.go b/runsc/test/image/image_test.go index b1e5e726a..13fd8f1ee 100644 --- a/runsc/test/image/image_test.go +++ b/runsc/test/image/image_test.go @@ -44,7 +44,7 @@ func TestHelloWorld(t *testing.T) { } defer d.CleanUp() - if err := d.WaitForOutput("Hello from Docker!", 5*time.Second); err != nil { + if _, err := d.WaitForOutput("Hello from Docker!", 5*time.Second); err != nil { t.Fatalf("docker didn't say hello: %v", err) } } @@ -160,7 +160,7 @@ func TestMysql(t *testing.T) { defer d.CleanUp() // Wait until it's up and running. - if err := d.WaitForOutput("port: 3306 MySQL Community Server", 3*time.Minute); err != nil { + if _, err := d.WaitForOutput("port: 3306 MySQL Community Server", 3*time.Minute); err != nil { t.Fatalf("docker.WaitForOutput() timeout: %v", err) } @@ -184,10 +184,10 @@ func TestMysql(t *testing.T) { defer client.CleanUp() // Ensure file executed to the end and shutdown mysql. - if err := client.WaitForOutput("--------------\nshutdown\n--------------", 15*time.Second); err != nil { + if _, err := client.WaitForOutput("--------------\nshutdown\n--------------", 15*time.Second); err != nil { t.Fatalf("docker.WaitForOutput() timeout: %v", err) } - if err := d.WaitForOutput("mysqld: Shutdown complete", 30*time.Second); err != nil { + if _, err := d.WaitForOutput("mysqld: Shutdown complete", 30*time.Second); err != nil { t.Fatalf("docker.WaitForOutput() timeout: %v", err) } } diff --git a/runsc/test/integration/BUILD b/runsc/test/integration/BUILD index b366fe936..4407016ad 100644 --- a/runsc/test/integration/BUILD +++ b/runsc/test/integration/BUILD @@ -6,6 +6,7 @@ go_test( name = "integration_test", size = "large", srcs = [ + "exec_test.go", "integration_test.go", ], embed = [":integration"], diff --git a/runsc/test/integration/exec_test.go b/runsc/test/integration/exec_test.go new file mode 100644 index 000000000..6053ecd1c --- /dev/null +++ b/runsc/test/integration/exec_test.go @@ -0,0 +1,62 @@ +// Copyright 2018 Google Inc. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +// Package image provides end-to-end integration tests for runsc. These tests require +// docker and runsc to be installed on the machine. To set it up, run: +// +// ./runsc/test/install.sh [--runtime <name>] +// +// The tests expect the runtime name to be provided in the RUNSC_RUNTIME +// environment variable (default: runsc-test). +// +// Each test calls docker commands to start up a container, and tests that it is +// behaving properly, with various runsc commands. The container is killed and deleted +// at the end. + +package integration + +import ( + "testing" + "time" + + "gvisor.googlesource.com/gvisor/runsc/test/testutil" +) + +func TestExecCapabilities(t *testing.T) { + if err := testutil.Pull("alpine"); err != nil { + t.Fatalf("docker pull failed: %v", err) + } + d := testutil.MakeDocker("exec-test") + + // Start the container. + if _, err := d.Run("alpine", "sh", "-c", "cat /proc/self/status; sleep 100"); err != nil { + t.Fatalf("docker run failed: %v", err) + } + defer d.CleanUp() + + want, err := d.WaitForOutput("CapEff:\t[0-9a-f]+\n", 5*time.Second) + if err != nil { + t.Fatalf("WaitForOutput() timeout: %v", err) + } + t.Log("Root capabilities:", want) + + // Now check that exec'd process capabilities match the root. + got, err := d.Exec("grep", "CapEff:", "/proc/self/status") + if err != nil { + t.Fatalf("docker exec failed: %v", err) + } + if got != want { + t.Errorf("wrong capabilities, got: %q, want: %q", got, want) + } +} diff --git a/runsc/test/integration/integration_test.go b/runsc/test/integration/integration_test.go index c6b546a56..59df5bd7c 100644 --- a/runsc/test/integration/integration_test.go +++ b/runsc/test/integration/integration_test.go @@ -179,7 +179,7 @@ func TestConnectToSelf(t *testing.T) { if want := "server\n"; reply != want { t.Errorf("Error on server, want: %q, got: %q", want, reply) } - if err := d.WaitForOutput("^client\n$", 1*time.Second); err != nil { + if _, err := d.WaitForOutput("^client\n$", 1*time.Second); err != nil { t.Fatal("docker.WaitForOutput(client) timeout:", err) } } diff --git a/runsc/test/testutil/docker.go b/runsc/test/testutil/docker.go index fc67c174a..c73bb0406 100644 --- a/runsc/test/testutil/docker.go +++ b/runsc/test/testutil/docker.go @@ -218,20 +218,20 @@ func (d *Docker) FindPort(sandboxPort int) (int, error) { // WaitForOutput calls 'docker logs' to retrieve containers output and searches // for the given pattern. -func (d *Docker) WaitForOutput(pattern string, timeout time.Duration) error { +func (d *Docker) WaitForOutput(pattern string, timeout time.Duration) (string, error) { re := regexp.MustCompile(pattern) var out string for exp := time.Now().Add(timeout); time.Now().Before(exp); { var err error out, err = do("logs", d.Name) if err != nil { - return err + return "", err } - if re.MatchString(out) { + if match := re.FindString(out); match != "" { // Success! - return nil + return match, nil } time.Sleep(100 * time.Millisecond) } - return fmt.Errorf("timeout waiting for output %q: %s", re.String(), out) + return "", fmt.Errorf("timeout waiting for output %q: %s", re.String(), out) } |