Skip to content
This repository was archived by the owner on Mar 9, 2022. It is now read-only.

Commit e402ae2

Browse files
Random-LiuRandom-Liu
authored
Merge pull request #914 from Random-Liu/fix-addition-gids
Fix addition gids
2 parents 3e5eb0c + 51ee6ea commit e402ae2

220 files changed

Lines changed: 10598 additions & 5649 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎integration/addition_gids_test.go‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
/*
2+
Copyright 2018 The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package integration
18+
19+
import (
20+
"io/ioutil"
21+
"os"
22+
"path/filepath"
23+
"testing"
24+
"time"
25+
26+
"github.com/stretchr/testify/assert"
27+
"github.com/stretchr/testify/require"
28+
runtime "k8s.io/kubernetes/pkg/kubelet/apis/cri/runtime/v1alpha2"
29+
)
30+
31+
func TestAdditionalGids(t *testing.T) {
32+
testPodLogDir, err := ioutil.TempDir("/tmp", "additional-gids")
33+
require.NoError(t, err)
34+
defer os.RemoveAll(testPodLogDir)
35+
36+
t.Log("Create a sandbox with log directory")
37+
sbConfig := PodSandboxConfig("sandbox", "additional-gids",
38+
WithPodLogDirectory(testPodLogDir))
39+
sb, err := runtimeService.RunPodSandbox(sbConfig)
40+
require.NoError(t, err)
41+
defer func() {
42+
assert.NoError(t, runtimeService.StopPodSandbox(sb))
43+
assert.NoError(t, runtimeService.RemovePodSandbox(sb))
44+
}()
45+
46+
const (
47+
testImage = "busybox"
48+
containerName = "test-container"
49+
)
50+
t.Logf("Pull test image %q", testImage)
51+
img, err := imageService.PullImage(&runtime.ImageSpec{Image: testImage}, nil)
52+
require.NoError(t, err)
53+
defer func() {
54+
assert.NoError(t, imageService.RemoveImage(&runtime.ImageSpec{Image: img}))
55+
}()
56+
57+
t.Log("Create a container to print id")
58+
cnConfig := ContainerConfig(
59+
containerName,
60+
"busybox",
61+
WithCommand("id"),
62+
WithLogPath(containerName),
63+
WithSupplementalGroups([]int64{1 /*daemon*/, 1234 /*new group*/}),
64+
)
65+
cn, err := runtimeService.CreateContainer(sb, cnConfig, sbConfig)
66+
require.NoError(t, err)
67+
68+
t.Log("Start the container")
69+
require.NoError(t, runtimeService.StartContainer(cn))
70+
71+
t.Log("Wait for container to finish running")
72+
require.NoError(t, Eventually(func() (bool, error) {
73+
s, err := runtimeService.ContainerStatus(cn)
74+
if err != nil {
75+
return false, err
76+
}
77+
if s.GetState() == runtime.ContainerState_CONTAINER_EXITED {
78+
return true, nil
79+
}
80+
return false, nil
81+
}, time.Second, 30*time.Second))
82+
83+
t.Log("Search additional groups in container log")
84+
content, err := ioutil.ReadFile(filepath.Join(testPodLogDir, containerName))
85+
assert.NoError(t, err)
86+
assert.Contains(t, string(content), "groups=1(daemon),10(wheel),1234")
87+
}

‎integration/test_utils.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,19 @@ func WithLogPath(path string) ContainerOpts {
202202
}
203203
}
204204

205+
// WithSupplementalGroups adds supplemental groups.
206+
func WithSupplementalGroups(gids []int64) ContainerOpts {
207+
return func(c *runtime.ContainerConfig) {
208+
if c.Linux == nil {
209+
c.Linux = &runtime.LinuxContainerConfig{}
210+
}
211+
if c.Linux.SecurityContext == nil {
212+
c.Linux.SecurityContext = &runtime.LinuxContainerSecurityContext{}
213+
}
214+
c.Linux.SecurityContext.SupplementalGroups = gids
215+
}
216+
}
217+
205218
// ContainerConfig creates a container config given a name and image name
206219
// and additional container config options
207220
func ContainerConfig(name, image string, opts ...ContainerOpts) *runtime.ContainerConfig {

‎pkg/containerd/opts/spec.go‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
/*
2+
Copyright 2018 The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package opts
18+
19+
import (
20+
"context"
21+
22+
"github.com/containerd/containerd/containers"
23+
"github.com/containerd/containerd/oci"
24+
runtimespec "github.com/opencontainers/runtime-spec/specs-go"
25+
)
26+
27+
// WithAdditionalGIDs adds any additional groups listed for a particular user in the
28+
// /etc/groups file of the image's root filesystem to the OCI spec's additionalGids array.
29+
func WithAdditionalGIDs(userstr string) oci.SpecOpts {
30+
return func(ctx context.Context, client oci.Client, c *containers.Container, s *runtimespec.Spec) (err error) {
31+
gids := s.Process.User.AdditionalGids
32+
if err := oci.WithAdditionalGIDs(userstr)(ctx, client, c, s); err != nil {
33+
return err
34+
}
35+
// Merge existing gids and new gids.
36+
s.Process.User.AdditionalGids = mergeGids(s.Process.User.AdditionalGids, gids)
37+
return nil
38+
}
39+
}
40+
41+
func mergeGids(gids1, gids2 []uint32) []uint32 {
42+
for _, gid1 := range gids1 {
43+
for i, gid2 := range gids2 {
44+
if gid1 == gid2 {
45+
gids2 = append(gids2[:i], gids2[i+1:]...)
46+
break
47+
}
48+
}
49+
}
50+
return append(gids1, gids2...)
51+
}

‎pkg/containerd/opts/spec_test.go‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
/*
2+
Copyright 2018 The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package opts
18+
19+
import (
20+
"testing"
21+
22+
"github.com/stretchr/testify/assert"
23+
)
24+
25+
func TestMergeGids(t *testing.T) {
26+
gids1 := []uint32{3, 2, 1}
27+
gids2 := []uint32{2, 3, 4}
28+
assert.Equal(t, []uint32{3, 2, 1, 4}, mergeGids(gids1, gids2))
29+
}

‎pkg/server/container_create.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -229,6 +229,15 @@ func (c *criService) CreateContainer(ctx context.Context, r *runtime.CreateConta
229229
specOpts = append(specOpts, oci.WithUser(userstr))
230230
}
231231

232+
if securityContext.GetRunAsUsername() != "" {
233+
userstr = securityContext.GetRunAsUsername()
234+
} else {
235+
// Even if RunAsUser is not set, we still call `GetValue` to get uid 0.
236+
// Because it is still useful to get additional gids for uid 0.
237+
userstr = strconv.FormatInt(securityContext.GetRunAsUser().GetValue(), 10)
238+
}
239+
specOpts = append(specOpts, customopts.WithAdditionalGIDs(userstr))
240+
232241
apparmorSpecOpts, err := generateApparmorSpecOpts(
233242
securityContext.GetApparmorProfile(),
234243
securityContext.GetPrivileged(),

‎vendor.conf‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@ github.com/blang/semver v3.1.0
33
github.com/boltdb/bolt v1.3.1
44
github.com/BurntSushi/toml a368813c5e648fee92e5f6c30e3944ff9d5e8895
55
github.com/containerd/cgroups 5e610833b72089b37d0e615de9a92dfc043757c2
6-
github.com/containerd/console 4d8a41f4ce5b9bae77c41786ea2458330f43f081
7-
github.com/containerd/containerd b9eeaa1ce83dd9970605ddbd0b35d4d3fa5f87bd
8-
github.com/containerd/continuity d3c23511c1bf5851696cba83143d9cbcd666869b
6+
github.com/containerd/console c12b1e7919c14469339a5d38f2f8ed9b64a9de23
7+
github.com/containerd/containerd 1950f791d9225ffe061c77e74e292bcb3c428a04
8+
github.com/containerd/continuity f44b615e492bdfb371aae2f76ec694d9da1db537
99
github.com/containerd/fifo 3d5202aec260678c48179c56f40e6f38a095738c
1010
github.com/containerd/go-cni 6d7b509a054a3cb1c35ed1865d4fde2f0cb547cd
11-
github.com/containerd/go-runc edcf3de1f4971445c42d61f20d506b30612aa031
11+
github.com/containerd/go-runc 5a6d9f37cfa36b15efba46dc7ea349fa9b7143c3
1212
github.com/containerd/ttrpc 94dde388801693c54f88a6596f713b51a8b30b2d
1313
github.com/containerd/typeurl a93fcdb778cd272c6e9b3028b2f42d813e785d40
1414
github.com/containernetworking/cni v0.6.0
@@ -34,13 +34,13 @@ github.com/hashicorp/errwrap 7554cd9344cec97297fa6649b055a8c98c2a1e55
3434
github.com/hashicorp/go-multierror ed905158d87462226a13fe39ddf685ea65f1c11f
3535
github.com/json-iterator/go 1.1.5
3636
github.com/matttproud/golang_protobuf_extensions v1.0.0
37-
github.com/Microsoft/go-winio v0.4.7
38-
github.com/Microsoft/hcsshim v0.6.11
37+
github.com/Microsoft/go-winio v0.4.10
38+
github.com/Microsoft/hcsshim 44c060121b68e8bdc40b411beba551f3b4ee9e55
3939
github.com/modern-go/concurrent 1.0.3
4040
github.com/modern-go/reflect2 1.0.1
4141
github.com/opencontainers/go-digest c9281466c8b2f606084ac71339773efd177436e7
4242
github.com/opencontainers/image-spec v1.0.1
43-
github.com/opencontainers/runc 69663f0bd4b60df09991c08812a60108003fa340
43+
github.com/opencontainers/runc 20aff4f0488c6d4b8df4d85b4f63f1f704c11abd
4444
github.com/opencontainers/runtime-spec d810dbc60d8c5aeeb3d054bd1132fab2121968ce
4545
github.com/opencontainers/runtime-tools v0.6.0
4646
github.com/opencontainers/selinux b6fa367ed7f534f9ba25391cc2d467085dbb445a

‎vendor/github.com/Microsoft/go-winio/fileinfo.go‎

Lines changed: 2 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/Microsoft/go-winio/pipe.go‎

Lines changed: 27 additions & 30 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎vendor/github.com/Microsoft/hcsshim/README.md‎

Lines changed: 13 additions & 5 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)