kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Allow libcontainer to eval symlink destination

Browse source 
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>

Add tests for mounting into /proc and /sys

These two locations should be prohibited from mounting volumes into
those destinations.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
This commit is contained in:
Michael Crosby 2015-04-21 17:31:05 -07:00 committed by Jessica Frazelle
parent 2f54c1a352
commit f25bbedc85
2 changed files with 19 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
daemon/execdriver/native/create.go
View file

@ -6,12 +6,10 @@ import (
"errors"
"fmt"
"net"
"path/filepath"
"strings"
"syscall"
"github.com/docker/docker/daemon/execdriver"
"github.com/docker/docker/pkg/symlink"
"github.com/docker/libcontainer/apparmor"
"github.com/docker/libcontainer/configs"
"github.com/docker/libcontainer/devices"
@ -231,10 +229,6 @@ func (d *driver) setupMounts(container *configs.Config, c *execdriver.Command) e
container.Mounts = defaultMounts
for _, m := range c.Mounts {
dest, err := symlink.FollowSymlinkInScope(filepath.Join(c.Rootfs, m.Destination), c.Rootfs)
if err != nil {
return err
}
flags := syscall.MS_BIND | syscall.MS_REC
if !m.Writable {
flags |= syscall.MS_RDONLY
@ -242,10 +236,9 @@ func (d *driver) setupMounts(container *configs.Config, c *execdriver.Command) e
if m.Slave {
flags |= syscall.MS_SLAVE
}
container.Mounts = append(container.Mounts, &configs.Mount{
Source: m.Source,
Destination: dest,
Destination: m.Destination,
Device: "bind",
Flags: flags,
})

18
integration-cli/docker_cli_run_test.go
View file

@ -3107,3 +3107,21 @@ func TestRunReadProcLatency(t *testing.T) {
}
logDone("run - read /proc/latency_stats")
}
func TestMountIntoProc(t *testing.T) {
defer deleteAllContainers()
code, err := runCommand(exec.Command(dockerBinary, "run", "-v", "/proc//sys", "busybox", "true"))
if err == nil || code == 0 {
t.Fatal("container should not be able to mount into /proc")
}
logDone("run - mount into proc")
}
func TestMountIntoSys(t *testing.T) {
defer deleteAllContainers()
code, err := runCommand(exec.Command(dockerBinary, "run", "-v", "/sys/", "busybox", "true"))
if err == nil || code == 0 {
t.Fatal("container should not be able to mount into /sys")
}
logDone("run - mount into sys")
}