mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
2a0c446866
When building images in a user-namespaced container, v3 capabilities are
stored including the root UID of the creator of the user-namespace.
This UID does not make sense outside the build environment however. If
the image is run in a non-user-namespaced runtime, or if a user-namespaced
runtime uses a different UID, the capabilities requested by the effective
bit will not be honoured by `execve(2)` due to this mismatch.
Instead, we convert v3 capabilities to v2, dropping the root UID on the
fly.
Signed-off-by: Eric Mountain <eric.mountain@datadoghq.com>
(cherry picked from commit 95eb490780)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
123 lines
3.6 KiB
Go
123 lines
3.6 KiB
Go
package build // import "github.com/docker/docker/integration/build"
|
|
|
|
import (
|
|
"bufio"
|
|
"bytes"
|
|
"context"
|
|
"io"
|
|
"io/ioutil"
|
|
"os"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/docker/docker/api/types"
|
|
"github.com/docker/docker/integration/internal/container"
|
|
"github.com/docker/docker/pkg/jsonmessage"
|
|
"github.com/docker/docker/pkg/stdcopy"
|
|
"github.com/docker/docker/testutil/daemon"
|
|
"github.com/docker/docker/testutil/fakecontext"
|
|
"github.com/docker/docker/testutil/fixtures/load"
|
|
"gotest.tools/v3/assert"
|
|
"gotest.tools/v3/skip"
|
|
)
|
|
|
|
// Implements a test for https://github.com/moby/moby/issues/41723
|
|
// Images built in a user-namespaced daemon should have capabilities serialised in
|
|
// VFS_CAP_REVISION_2 (no user-namespace root uid) format rather than V3 (that includes
|
|
// the root uid).
|
|
func TestBuildUserNamespaceValidateCapabilitiesAreV2(t *testing.T) {
|
|
skip.If(t, testEnv.DaemonInfo.OSType != "linux")
|
|
skip.If(t, testEnv.IsRemoteDaemon())
|
|
skip.If(t, !testEnv.IsUserNamespaceInKernel())
|
|
skip.If(t, testEnv.IsRootless())
|
|
|
|
const imageTag = "capabilities:1.0"
|
|
|
|
tmp, err := ioutil.TempDir("", "integration-")
|
|
assert.NilError(t, err)
|
|
defer os.RemoveAll(tmp)
|
|
|
|
dUserRemap := daemon.New(t)
|
|
dUserRemap.Start(t, "--userns-remap", "default")
|
|
ctx := context.Background()
|
|
clientUserRemap := dUserRemap.NewClientT(t)
|
|
|
|
err = load.FrozenImagesLinux(clientUserRemap, "debian:bullseye")
|
|
assert.NilError(t, err)
|
|
|
|
dUserRemapRunning := true
|
|
defer func() {
|
|
if dUserRemapRunning {
|
|
dUserRemap.Stop(t)
|
|
}
|
|
}()
|
|
|
|
dockerfile := `
|
|
FROM debian:bullseye
|
|
RUN setcap CAP_NET_BIND_SERVICE=+eip /bin/sleep
|
|
`
|
|
|
|
source := fakecontext.New(t, "", fakecontext.WithDockerfile(dockerfile))
|
|
defer source.Close()
|
|
|
|
resp, err := clientUserRemap.ImageBuild(ctx,
|
|
source.AsTarReader(t),
|
|
types.ImageBuildOptions{
|
|
Tags: []string{imageTag},
|
|
})
|
|
assert.NilError(t, err)
|
|
defer resp.Body.Close()
|
|
|
|
buf := bytes.NewBuffer(nil)
|
|
err = jsonmessage.DisplayJSONMessagesStream(resp.Body, buf, 0, false, nil)
|
|
assert.NilError(t, err)
|
|
|
|
reader, err := clientUserRemap.ImageSave(ctx, []string{imageTag})
|
|
assert.NilError(t, err, "failed to download capabilities image")
|
|
defer reader.Close()
|
|
|
|
tar, err := os.Create(tmp + "/image.tar")
|
|
assert.NilError(t, err, "failed to create image tar file")
|
|
defer tar.Close()
|
|
|
|
_, err = io.Copy(tar, reader)
|
|
assert.NilError(t, err, "failed to write image tar file")
|
|
|
|
dUserRemap.Stop(t)
|
|
dUserRemap.Cleanup(t)
|
|
dUserRemapRunning = false
|
|
|
|
dNoUserRemap := daemon.New(t)
|
|
dNoUserRemap.Start(t)
|
|
defer dNoUserRemap.Stop(t)
|
|
|
|
clientNoUserRemap := dNoUserRemap.NewClientT(t)
|
|
|
|
tarFile, err := os.Open(tmp + "/image.tar")
|
|
assert.NilError(t, err, "failed to open image tar file")
|
|
|
|
tarReader := bufio.NewReader(tarFile)
|
|
loadResp, err := clientNoUserRemap.ImageLoad(ctx, tarReader, false)
|
|
assert.NilError(t, err, "failed to load image tar file")
|
|
defer loadResp.Body.Close()
|
|
buf = bytes.NewBuffer(nil)
|
|
err = jsonmessage.DisplayJSONMessagesStream(loadResp.Body, buf, 0, false, nil)
|
|
assert.NilError(t, err)
|
|
|
|
cid := container.Run(ctx, t, clientNoUserRemap,
|
|
container.WithImage(imageTag),
|
|
container.WithCmd("/sbin/getcap", "-n", "/bin/sleep"),
|
|
)
|
|
logReader, err := clientNoUserRemap.ContainerLogs(ctx, cid, types.ContainerLogsOptions{
|
|
ShowStdout: true,
|
|
})
|
|
assert.NilError(t, err)
|
|
|
|
actualStdout := new(bytes.Buffer)
|
|
actualStderr := ioutil.Discard
|
|
_, err = stdcopy.StdCopy(actualStdout, actualStderr, logReader)
|
|
assert.NilError(t, err)
|
|
if strings.TrimSpace(actualStdout.String()) != "/bin/sleep cap_net_bind_service=eip" {
|
|
t.Fatalf("run produced invalid output: %q, expected %q", actualStdout.String(), "/bin/sleep cap_net_bind_service=eip")
|
|
}
|
|
}
|