From 5f0002fc83a77a39d9a2ef1443bc6c18e22ea779 Mon Sep 17 00:00:00 2001 From: Fabricio Voznika Date: Wed, 5 Sep 2018 18:31:37 -0700 Subject: Use container's capabilities in exec When no capabilities are specified in exec, use the container's capabilities to match runc's behavior. PiperOrigin-RevId: 211735186 Change-Id: Icd372ed64410c81144eae94f432dffc9fe3a86ce --- runsc/test/integration/BUILD | 1 + runsc/test/integration/exec_test.go | 62 ++++++++++++++++++++++++++++++ runsc/test/integration/integration_test.go | 2 +- 3 files changed, 64 insertions(+), 1 deletion(-) create mode 100644 runsc/test/integration/exec_test.go (limited to 'runsc/test/integration') diff --git a/runsc/test/integration/BUILD b/runsc/test/integration/BUILD index b366fe936..4407016ad 100644 --- a/runsc/test/integration/BUILD +++ b/runsc/test/integration/BUILD @@ -6,6 +6,7 @@ go_test( name = "integration_test", size = "large", srcs = [ + "exec_test.go", "integration_test.go", ], embed = [":integration"], diff --git a/runsc/test/integration/exec_test.go b/runsc/test/integration/exec_test.go new file mode 100644 index 000000000..6053ecd1c --- /dev/null +++ b/runsc/test/integration/exec_test.go @@ -0,0 +1,62 @@ +// Copyright 2018 Google Inc. +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +// Package image provides end-to-end integration tests for runsc. These tests require +// docker and runsc to be installed on the machine. To set it up, run: +// +// ./runsc/test/install.sh [--runtime ] +// +// The tests expect the runtime name to be provided in the RUNSC_RUNTIME +// environment variable (default: runsc-test). +// +// Each test calls docker commands to start up a container, and tests that it is +// behaving properly, with various runsc commands. The container is killed and deleted +// at the end. + +package integration + +import ( + "testing" + "time" + + "gvisor.googlesource.com/gvisor/runsc/test/testutil" +) + +func TestExecCapabilities(t *testing.T) { + if err := testutil.Pull("alpine"); err != nil { + t.Fatalf("docker pull failed: %v", err) + } + d := testutil.MakeDocker("exec-test") + + // Start the container. + if _, err := d.Run("alpine", "sh", "-c", "cat /proc/self/status; sleep 100"); err != nil { + t.Fatalf("docker run failed: %v", err) + } + defer d.CleanUp() + + want, err := d.WaitForOutput("CapEff:\t[0-9a-f]+\n", 5*time.Second) + if err != nil { + t.Fatalf("WaitForOutput() timeout: %v", err) + } + t.Log("Root capabilities:", want) + + // Now check that exec'd process capabilities match the root. + got, err := d.Exec("grep", "CapEff:", "/proc/self/status") + if err != nil { + t.Fatalf("docker exec failed: %v", err) + } + if got != want { + t.Errorf("wrong capabilities, got: %q, want: %q", got, want) + } +} diff --git a/runsc/test/integration/integration_test.go b/runsc/test/integration/integration_test.go index c6b546a56..59df5bd7c 100644 --- a/runsc/test/integration/integration_test.go +++ b/runsc/test/integration/integration_test.go @@ -179,7 +179,7 @@ func TestConnectToSelf(t *testing.T) { if want := "server\n"; reply != want { t.Errorf("Error on server, want: %q, got: %q", want, reply) } - if err := d.WaitForOutput("^client\n$", 1*time.Second); err != nil { + if _, err := d.WaitForOutput("^client\n$", 1*time.Second); err != nil { t.Fatal("docker.WaitForOutput(client) timeout:", err) } } -- cgit v1.2.3