kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Ensure WORKDIR is created with remapped root ownership

Browse source 
Correct creation of a non-existing WORKDIR during docker build to use
remapped root uid/gid on mkdir

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)
This commit is contained in:
Phil Estes 2016-03-08 10:40:30 -05:00
parent 9e2c4de0de
commit 799a6b94ee
5 changed files with 20 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
container/container.go
View file

@ -18,10 +18,10 @@ import (
"github.com/docker/docker/daemon/network" "github.com/docker/docker/daemon/network"
"github.com/docker/docker/image" "github.com/docker/docker/image"
"github.com/docker/docker/layer" "github.com/docker/docker/layer"
"github.com/docker/docker/pkg/idtools"
"github.com/docker/docker/pkg/promise" "github.com/docker/docker/pkg/promise"
"github.com/docker/docker/pkg/signal" "github.com/docker/docker/pkg/signal"
"github.com/docker/docker/pkg/symlink" "github.com/docker/docker/pkg/symlink"
"github.com/docker/docker/pkg/system"
"github.com/docker/docker/runconfig" "github.com/docker/docker/runconfig"
"github.com/docker/docker/volume" "github.com/docker/docker/volume"
containertypes "github.com/docker/engine-api/types/container" containertypes "github.com/docker/engine-api/types/container"
@ -184,7 +184,7 @@ func (container *Container) WriteHostConfig() error {
} }
// SetupWorkingDirectory sets up the container's working directory as set in container.Config.WorkingDir // SetupWorkingDirectory sets up the container's working directory as set in container.Config.WorkingDir
func (container *Container) SetupWorkingDirectory() error { func (container *Container) SetupWorkingDirectory(rootUID, rootGID int) error {
if container.Config.WorkingDir == "" { if container.Config.WorkingDir == "" {
return nil return nil
} }
@ -202,7 +202,7 @@ func (container *Container) SetupWorkingDirectory() error {
return err return err
} }
if err := system.MkdirAll(pth, 0755); err != nil { if err := idtools.MkdirAllNewAs(pth, 0755, rootUID, rootGID); err != nil {
pthInfo, err2 := os.Stat(pth) pthInfo, err2 := os.Stat(pth)
if err2 == nil && pthInfo != nil && !pthInfo.IsDir() { if err2 == nil && pthInfo != nil && !pthInfo.IsDir() {
return fmt.Errorf("Cannot mkdir: %s is not a directory", container.Config.WorkingDir) return fmt.Errorf("Cannot mkdir: %s is not a directory", container.Config.WorkingDir)

3
daemon/create_unix.go
View file

@ -21,7 +21,8 @@ func (daemon *Daemon) createContainerPlatformSpecificSettings(container *contain
} }
defer daemon.Unmount(container) defer daemon.Unmount(container)
if err := container.SetupWorkingDirectory(); err != nil { rootUID, rootGID := daemon.GetRemappedUIDGID()
if err := container.SetupWorkingDirectory(rootUID, rootGID); err != nil {
return err return err
} }

3
daemon/start.go
View file

@ -126,7 +126,8 @@ func (daemon *Daemon) containerStart(container *container.Container) (err error)
if err != nil { if err != nil {
return err return err
} }
if err := container.SetupWorkingDirectory(); err != nil { rootUID, rootGID := daemon.GetRemappedUIDGID()
if err := container.SetupWorkingDirectory(rootUID, rootGID); err != nil {
return err return err
} }
env := container.CreateDaemonEnvironment(linkedEnv) env := container.CreateDaemonEnvironment(linkedEnv)

11
integration-cli/docker_cli_build_test.go
View file

@ -844,6 +844,17 @@ RUN ls -l /new_dir`,
} }
} }
func (s *DockerSuite) TestBuildWorkdirIsContainerRoot(c *check.C) {
testRequires(c, DaemonIsLinux) // Linux specific test
name := "testworkdirownership"
if _, err := buildImage(name, `FROM busybox
WORKDIR /new_dir
RUN ls -l /
RUN [ $(ls -l / | grep new_dir | awk '{print $3":"$4}') = 'root:root' ]`, true); err != nil {
c.Fatal(err)
}
}
func (s *DockerSuite) TestBuildAddMultipleFilesToFile(c *check.C) { func (s *DockerSuite) TestBuildAddMultipleFilesToFile(c *check.C) {
name := "testaddmultiplefilestofile" name := "testaddmultiplefilestofile"

4
integration-cli/docker_cli_run_test.go
View file

@ -1742,7 +1742,7 @@ func (s *DockerSuite) TestRunCleanupCmdOnEntrypoint(c *check.C) {
// TestRunWorkdirExistsAndIsFile checks that if 'docker run -w' with existing file can be detected // TestRunWorkdirExistsAndIsFile checks that if 'docker run -w' with existing file can be detected
func (s *DockerSuite) TestRunWorkdirExistsAndIsFile(c *check.C) { func (s *DockerSuite) TestRunWorkdirExistsAndIsFile(c *check.C) {
existingFile := "/bin/cat" existingFile := "/bin/cat"
expected := "Cannot mkdir: /bin/cat is not a directory" expected := "not a directory"
if daemonPlatform == "windows" { if daemonPlatform == "windows" {
existingFile = `\windows\system32\ntdll.dll` existingFile = `\windows\system32\ntdll.dll`
expected = `Cannot mkdir: \windows\system32\ntdll.dll is not a directory.` expected = `Cannot mkdir: \windows\system32\ntdll.dll is not a directory.`
@ -1750,7 +1750,7 @@ func (s *DockerSuite) TestRunWorkdirExistsAndIsFile(c *check.C) {
out, exitCode, err := dockerCmdWithError("run", "-w", existingFile, "busybox") out, exitCode, err := dockerCmdWithError("run", "-w", existingFile, "busybox")
if !(err != nil && exitCode == 125 && strings.Contains(out, expected)) { if !(err != nil && exitCode == 125 && strings.Contains(out, expected)) {
c.Fatalf("Docker must complains about making dir with exitCode 125 but we got out: %s, exitCode: %d", out, exitCode) c.Fatalf("Existing binary as a directory should error out with exitCode 125; we got: %s, exitCode: %d", out, exitCode)
} }
} }