summaryrefslogtreecommitdiffhomepage
path: root/runsc
diff options
context:
space:
mode:
Diffstat (limited to 'runsc')
-rw-r--r--runsc/cmd/exec.go28
-rw-r--r--runsc/test/image/image_test.go8
-rw-r--r--runsc/test/integration/BUILD1
-rw-r--r--runsc/test/integration/exec_test.go62
-rw-r--r--runsc/test/integration/integration_test.go2
-rw-r--r--runsc/test/testutil/docker.go10
6 files changed, 94 insertions, 17 deletions
diff --git a/runsc/cmd/exec.go b/runsc/cmd/exec.go
index 966d2e258..da1642c08 100644
--- a/runsc/cmd/exec.go
+++ b/runsc/cmd/exec.go
@@ -115,16 +115,22 @@ func (ex *Exec) Execute(_ context.Context, f *flag.FlagSet, args ...interface{})
Fatalf("error loading sandbox: %v", err)
}
+ // Replace empty settings with defaults from container.
if e.WorkingDirectory == "" {
e.WorkingDirectory = c.Spec.Process.Cwd
}
-
if e.Envv == nil {
e.Envv, err = resolveEnvs(c.Spec.Process.Env, ex.env)
if err != nil {
Fatalf("error getting environment variables: %v", err)
}
}
+ if e.Capabilities == nil {
+ e.Capabilities, err = specutils.Capabilities(c.Spec.Process.Capabilities)
+ if err != nil {
+ Fatalf("error creating capabilities: %v", err)
+ }
+ }
// containerd expects an actual process to represent the container being
// executed. If detach was specified, starts a child in non-detach mode,
@@ -265,9 +271,13 @@ func (ex *Exec) argsFromCLI(argv []string) (*control.ExecArgs, error) {
extraKGIDs = append(extraKGIDs, auth.KGID(kgid))
}
- caps, err := capabilities(ex.caps)
- if err != nil {
- return nil, fmt.Errorf("capabilities error: %v", err)
+ var caps *auth.TaskCapabilities
+ if len(ex.caps) > 0 {
+ var err error
+ caps, err = capabilities(ex.caps)
+ if err != nil {
+ return nil, fmt.Errorf("capabilities error: %v", err)
+ }
}
return &control.ExecArgs{
@@ -299,9 +309,13 @@ func (ex *Exec) argsFromProcessFile() (*control.ExecArgs, error) {
// to ExecArgs.
func argsFromProcess(p *specs.Process) (*control.ExecArgs, error) {
// Create capabilities.
- caps, err := specutils.Capabilities(p.Capabilities)
- if err != nil {
- return nil, fmt.Errorf("error creating capabilities: %v", err)
+ var caps *auth.TaskCapabilities
+ if p.Capabilities != nil {
+ var err error
+ caps, err = specutils.Capabilities(p.Capabilities)
+ if err != nil {
+ return nil, fmt.Errorf("error creating capabilities: %v", err)
+ }
}
// Convert the spec's additional GIDs to KGIDs.
diff --git a/runsc/test/image/image_test.go b/runsc/test/image/image_test.go
index b1e5e726a..13fd8f1ee 100644
--- a/runsc/test/image/image_test.go
+++ b/runsc/test/image/image_test.go
@@ -44,7 +44,7 @@ func TestHelloWorld(t *testing.T) {
}
defer d.CleanUp()
- if err := d.WaitForOutput("Hello from Docker!", 5*time.Second); err != nil {
+ if _, err := d.WaitForOutput("Hello from Docker!", 5*time.Second); err != nil {
t.Fatalf("docker didn't say hello: %v", err)
}
}
@@ -160,7 +160,7 @@ func TestMysql(t *testing.T) {
defer d.CleanUp()
// Wait until it's up and running.
- if err := d.WaitForOutput("port: 3306 MySQL Community Server", 3*time.Minute); err != nil {
+ if _, err := d.WaitForOutput("port: 3306 MySQL Community Server", 3*time.Minute); err != nil {
t.Fatalf("docker.WaitForOutput() timeout: %v", err)
}
@@ -184,10 +184,10 @@ func TestMysql(t *testing.T) {
defer client.CleanUp()
// Ensure file executed to the end and shutdown mysql.
- if err := client.WaitForOutput("--------------\nshutdown\n--------------", 15*time.Second); err != nil {
+ if _, err := client.WaitForOutput("--------------\nshutdown\n--------------", 15*time.Second); err != nil {
t.Fatalf("docker.WaitForOutput() timeout: %v", err)
}
- if err := d.WaitForOutput("mysqld: Shutdown complete", 30*time.Second); err != nil {
+ if _, err := d.WaitForOutput("mysqld: Shutdown complete", 30*time.Second); err != nil {
t.Fatalf("docker.WaitForOutput() timeout: %v", err)
}
}
diff --git a/runsc/test/integration/BUILD b/runsc/test/integration/BUILD
index b366fe936..4407016ad 100644
--- a/runsc/test/integration/BUILD
+++ b/runsc/test/integration/BUILD
@@ -6,6 +6,7 @@ go_test(
name = "integration_test",
size = "large",
srcs = [
+ "exec_test.go",
"integration_test.go",
],
embed = [":integration"],
diff --git a/runsc/test/integration/exec_test.go b/runsc/test/integration/exec_test.go
new file mode 100644
index 000000000..6053ecd1c
--- /dev/null
+++ b/runsc/test/integration/exec_test.go
@@ -0,0 +1,62 @@
+// Copyright 2018 Google Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package image provides end-to-end integration tests for runsc. These tests require
+// docker and runsc to be installed on the machine. To set it up, run:
+//
+// ./runsc/test/install.sh [--runtime <name>]
+//
+// The tests expect the runtime name to be provided in the RUNSC_RUNTIME
+// environment variable (default: runsc-test).
+//
+// Each test calls docker commands to start up a container, and tests that it is
+// behaving properly, with various runsc commands. The container is killed and deleted
+// at the end.
+
+package integration
+
+import (
+ "testing"
+ "time"
+
+ "gvisor.googlesource.com/gvisor/runsc/test/testutil"
+)
+
+func TestExecCapabilities(t *testing.T) {
+ if err := testutil.Pull("alpine"); err != nil {
+ t.Fatalf("docker pull failed: %v", err)
+ }
+ d := testutil.MakeDocker("exec-test")
+
+ // Start the container.
+ if _, err := d.Run("alpine", "sh", "-c", "cat /proc/self/status; sleep 100"); err != nil {
+ t.Fatalf("docker run failed: %v", err)
+ }
+ defer d.CleanUp()
+
+ want, err := d.WaitForOutput("CapEff:\t[0-9a-f]+\n", 5*time.Second)
+ if err != nil {
+ t.Fatalf("WaitForOutput() timeout: %v", err)
+ }
+ t.Log("Root capabilities:", want)
+
+ // Now check that exec'd process capabilities match the root.
+ got, err := d.Exec("grep", "CapEff:", "/proc/self/status")
+ if err != nil {
+ t.Fatalf("docker exec failed: %v", err)
+ }
+ if got != want {
+ t.Errorf("wrong capabilities, got: %q, want: %q", got, want)
+ }
+}
diff --git a/runsc/test/integration/integration_test.go b/runsc/test/integration/integration_test.go
index c6b546a56..59df5bd7c 100644
--- a/runsc/test/integration/integration_test.go
+++ b/runsc/test/integration/integration_test.go
@@ -179,7 +179,7 @@ func TestConnectToSelf(t *testing.T) {
if want := "server\n"; reply != want {
t.Errorf("Error on server, want: %q, got: %q", want, reply)
}
- if err := d.WaitForOutput("^client\n$", 1*time.Second); err != nil {
+ if _, err := d.WaitForOutput("^client\n$", 1*time.Second); err != nil {
t.Fatal("docker.WaitForOutput(client) timeout:", err)
}
}
diff --git a/runsc/test/testutil/docker.go b/runsc/test/testutil/docker.go
index fc67c174a..c73bb0406 100644
--- a/runsc/test/testutil/docker.go
+++ b/runsc/test/testutil/docker.go
@@ -218,20 +218,20 @@ func (d *Docker) FindPort(sandboxPort int) (int, error) {
// WaitForOutput calls 'docker logs' to retrieve containers output and searches
// for the given pattern.
-func (d *Docker) WaitForOutput(pattern string, timeout time.Duration) error {
+func (d *Docker) WaitForOutput(pattern string, timeout time.Duration) (string, error) {
re := regexp.MustCompile(pattern)
var out string
for exp := time.Now().Add(timeout); time.Now().Before(exp); {
var err error
out, err = do("logs", d.Name)
if err != nil {
- return err
+ return "", err
}
- if re.MatchString(out) {
+ if match := re.FindString(out); match != "" {
// Success!
- return nil
+ return match, nil
}
time.Sleep(100 * time.Millisecond)
}
- return fmt.Errorf("timeout waiting for output %q: %s", re.String(), out)
+ return "", fmt.Errorf("timeout waiting for output %q: %s", re.String(), out)
}
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-05 03:10:59 +0000