kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #15163 from crosbymichael/proc-ro

Browse source 
Don't mount /proc as ro
This commit is contained in:
Tibor Vass 2015-07-30 15:12:29 -04:00
commit a687448c4d
3 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
daemon/execdriver/native/create.go
View file

@ -85,7 +85,7 @@ func (d *Driver) createContainer(c *execdriver.Command) (*configs.Config, error)
} }
/* These paths must be remounted as r/o */ /* These paths must be remounted as r/o */
container.ReadonlyPaths = append(container.ReadonlyPaths, "/proc", "/dev") container.ReadonlyPaths = append(container.ReadonlyPaths, "/dev")
} }
if err := d.setupMounts(container, c); err != nil { if err := d.setupMounts(container, c); err != nil {

7
integration-cli/docker_cli_exec_test.go
View file

@ -543,3 +543,10 @@ func (s *DockerSuite) TestExecWithImageUser(c *check.C) {
c.Fatalf("exec with user by id expected dockerio user got %s", out) c.Fatalf("exec with user by id expected dockerio user got %s", out)
} }
} }
func (s *DockerSuite) TestExecOnReadonlyContainer(c *check.C) {
dockerCmd(c, "run", "-d", "--read-only", "--name", "parent", "busybox", "top")
if _, status := dockerCmd(c, "exec", "parent", "true"); status != 0 {
c.Fatalf("exec into a read-only container failed with exit status %d", status)
}
}

2
integration-cli/docker_cli_run_test.go
View file

@ -2242,7 +2242,7 @@ func (s *DockerSuite) TestRunContainerWithWritableRootfs(c *check.C) {
func (s *DockerSuite) TestRunContainerWithReadonlyRootfs(c *check.C) { func (s *DockerSuite) TestRunContainerWithReadonlyRootfs(c *check.C) {
testRequires(c, NativeExecDriver) testRequires(c, NativeExecDriver)
for _, f := range []string{"/file", "/etc/hosts", "/etc/resolv.conf", "/etc/hostname", "/proc/uptime", "/sys/kernel", "/dev/.dont.touch.me"} { for _, f := range []string{"/file", "/etc/hosts", "/etc/resolv.conf", "/etc/hostname", "/sys/kernel", "/dev/.dont.touch.me"} {
testReadOnlyFile(f, c) testReadOnlyFile(f, c)
} }
} }