kotovalexarian-likes-github
/
moby--moby
mirror of https://github.com/moby/moby.git
1
0
Fork 0
Code Releases Activity

Merge pull request #25950 from akalipetis/fix-#21738-userns-mount-create 

Host mounted directories are correctly chowned to the remapped root, if the directory does not already exist
This commit is contained in:
Phil Estes 2016-09-06 12:42:39 -04:00 committed by GitHub
parent 368a27a8d8 c6bff578b4
commit 078964177f
3 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
daemon/volumes_unix.go
View File

@ -28,7 +28,8 @@ func (daemon *Daemon) setupMounts(c *container.Container) ([]container.Mount, er
if err := daemon.lazyInitializeVolume(c.ID, m); err != nil {
return nil, err
}
path, err := m.Setup(c.MountLabel)
rootUID, rootGID := daemon.GetRemappedUIDGID()
path, err := m.Setup(c.MountLabel, rootUID, rootGID)
if err != nil {
return nil, err
}

14
integration-cli/docker_cli_userns_test.go
View File

@ -7,11 +7,13 @@ import (
"io/ioutil"
"os"
"os/exec"
"path"
"path/filepath"
"strconv"
"strings"
"github.com/docker/docker/pkg/integration/checker"
"github.com/docker/docker/pkg/stringid"
"github.com/docker/docker/pkg/system"
"github.com/go-check/check"
)
@ -29,6 +31,10 @@ func (s *DockerDaemonSuite) TestDaemonUserNamespaceRootSetting(c *check.C) {
defer os.RemoveAll(tmpDir)
// Set a non-existent path
tmpDirNotExists := path.Join(os.TempDir(), "userns"+stringid.GenerateRandomID())
defer os.RemoveAll(tmpDirNotExists)
// we need to find the uid and gid of the remapped root from the daemon's root dir info
uidgid := strings.Split(filepath.Base(s.d.root), ".")
c.Assert(uidgid, checker.HasLen, 2, check.Commentf("Should have gotten uid/gid strings from root dirname: %s", filepath.Base(s.d.root)))
@ -40,11 +46,17 @@ func (s *DockerDaemonSuite) TestDaemonUserNamespaceRootSetting(c *check.C) {
// writable by the remapped root UID/GID pair
c.Assert(os.Chown(tmpDir, uid, gid), checker.IsNil)
out, err := s.d.Cmd("run", "-d", "--name", "userns", "-v", tmpDir+":/goofy", "busybox", "sh", "-c", "touch /goofy/testfile; top")
out, err := s.d.Cmd("run", "-d", "--name", "userns", "-v", tmpDir+":/goofy", "-v", tmpDirNotExists+":/donald", "busybox", "sh", "-c", "touch /goofy/testfile; top")
c.Assert(err, checker.IsNil, check.Commentf("Output: %s", out))
user := s.findUser(c, "userns")
c.Assert(uidgid[0], checker.Equals, user)
// check that the created directory is owned by remapped uid:gid
statNotExists, err := system.Stat(tmpDirNotExists)
c.Assert(err, checker.IsNil)
c.Assert(statNotExists.UID(), checker.Equals, uint32(uid), check.Commentf("Created directory not owned by remapped root UID"))
c.Assert(statNotExists.GID(), checker.Equals, uint32(gid), check.Commentf("Created directory not owned by remapped root GID"))
pid, err := s.d.Cmd("inspect", "--format={{.State.Pid}}", "userns")
c.Assert(err, checker.IsNil, check.Commentf("Could not inspect running container: out: %q", pid))
// check the uid and gid maps for the PID to ensure root is remapped

9
volume/volume.go
View File

@ -6,8 +6,8 @@ import (
"strings"
"syscall"
"github.com/docker/docker/pkg/idtools"
"github.com/docker/docker/pkg/stringid"
"github.com/docker/docker/pkg/system"
mounttypes "github.com/docker/engine-api/types/mount"
"github.com/opencontainers/runc/libcontainer/label"
)
@ -107,7 +107,7 @@ type MountPoint struct {
// Setup sets up a mount point by either mounting the volume if it is
// configured, or creating the source directory if supplied.
func (m *MountPoint) Setup(mountLabel string) (string, error) {
func (m *MountPoint) Setup(mountLabel string, rootUID, rootGID int) (string, error) {
if m.Volume != nil {
if m.ID == "" {
m.ID = stringid.GenerateNonCryptoID()
@ -117,8 +117,9 @@ func (m *MountPoint) Setup(mountLabel string) (string, error) {
if len(m.Source) == 0 {
return "", fmt.Errorf("Unable to setup mount point, neither source nor volume defined")
}
// system.MkdirAll() produces an error if m.Source exists and is a file (not a directory),
if err := system.MkdirAll(m.Source, 0755); err != nil {
// idtools.MkdirAllNewAs() produces an error if m.Source exists and is a file (not a directory)
// also, makes sure that if the directory is created, the correct remapped rootUID/rootGID will own it
if err := idtools.MkdirAllNewAs(m.Source, 0755, rootUID, rootGID); err != nil {
if perr, ok := err.(*os.PathError); ok {
if perr.Err != syscall.ENOTDIR {
return "", err