kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

pkg/archive: fix TestTarUntarWithXattr failure on recent kernel

Browse source 
Recent kernel has strict check for security.capability value.
Fix #38289

Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
This commit is contained in:
Akihiro Suda 2018-11-29 16:14:35 +09:00
parent 852542b397
commit 9ddd6e47a9
2 changed files with 15 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Dockerfile
View file

@ -182,6 +182,7 @@ RUN apt-get update && apt-get install -y \
btrfs-tools \ btrfs-tools \
iptables \ iptables \
jq \ jq \
libcap2-bin \
libdevmapper-dev \ libdevmapper-dev \
libudev-dev \ libudev-dev \
libsystemd-dev \ libsystemd-dev \

20
pkg/archive/archive_unix_test.go
View file

@ -7,6 +7,7 @@ import (
"fmt" "fmt"
"io/ioutil" "io/ioutil"
"os" "os"
"os/exec"
"path/filepath" "path/filepath"
"strings" "strings"
"syscall" "syscall"
@ -222,6 +223,13 @@ func TestTarWithBlockCharFifo(t *testing.T) {
// TestTarUntarWithXattr is Unix as Lsetxattr is not supported on Windows // TestTarUntarWithXattr is Unix as Lsetxattr is not supported on Windows
func TestTarUntarWithXattr(t *testing.T) { func TestTarUntarWithXattr(t *testing.T) {
skip.If(t, os.Getuid() != 0, "skipping test that requires root") skip.If(t, os.Getuid() != 0, "skipping test that requires root")
if _, err := exec.LookPath("setcap"); err != nil {
t.Skip("setcap not installed")
}
if _, err := exec.LookPath("getcap"); err != nil {
t.Skip("getcap not installed")
}
origin, err := ioutil.TempDir("", "docker-test-untar-origin") origin, err := ioutil.TempDir("", "docker-test-untar-origin")
assert.NilError(t, err) assert.NilError(t, err)
defer os.RemoveAll(origin) defer os.RemoveAll(origin)
@ -232,8 +240,9 @@ func TestTarUntarWithXattr(t *testing.T) {
assert.NilError(t, err) assert.NilError(t, err)
err = ioutil.WriteFile(filepath.Join(origin, "3"), []byte("will be ignored"), 0700) err = ioutil.WriteFile(filepath.Join(origin, "3"), []byte("will be ignored"), 0700)
assert.NilError(t, err) assert.NilError(t, err)
err = system.Lsetxattr(filepath.Join(origin, "2"), "security.capability", []byte{0x00}, 0) // there is no known Go implementation of setcap/getcap with support for v3 file capability
assert.NilError(t, err) out, err := exec.Command("setcap", "cap_block_suspend+ep", filepath.Join(origin, "2")).CombinedOutput()
assert.NilError(t, err, string(out))
for _, c := range []Compression{ for _, c := range []Compression{
Uncompressed, Uncompressed,
@ -251,10 +260,9 @@ func TestTarUntarWithXattr(t *testing.T) {
if len(changes) != 1 || changes[0].Path != "/3" { if len(changes) != 1 || changes[0].Path != "/3" {
t.Fatalf("Unexpected differences after tarUntar: %v", changes) t.Fatalf("Unexpected differences after tarUntar: %v", changes)
} }
capability, _ := system.Lgetxattr(filepath.Join(origin, "2"), "security.capability") out, err := exec.Command("getcap", filepath.Join(origin, "2")).CombinedOutput()
if capability == nil && capability[0] != 0x00 { assert.NilError(t, err, string(out))
t.Fatalf("Untar should have kept the 'security.capability' xattr.") assert.Check(t, is.Contains(string(out), "= cap_block_suspend+ep"), "untar should have kept the 'security.capability' xattr")
}
} }
} }