1
1
#!/bin/env python3
2
2
# crun - OCI runtime written in C
3
3
#
4
- # Copyright (C) 2017, 2018, 2019 Giuseppe Scrivano <[email protected] >
4
+ # Copyright (C) 2017, 2018, 2019, 2025 Giuseppe Scrivano <[email protected] >
5
5
# crun is free software; you can redistribute it and/or modify
6
6
# it under the terms of the GNU General Public License as published by
7
7
# the Free Software Foundation; either version 2 of the License, or
16
16
# along with crun. If not, see <http://www.gnu.org/licenses/>.
17
17
18
18
import os
19
+ import sys
19
20
from tests_utils import *
20
21
21
22
def test_userns_full_mapping ():
@@ -168,6 +169,81 @@ def test_umask():
168
169
169
170
return 0
170
171
172
+ def test_dev_null_no_chown ():
173
+ """Test that /dev/null file descriptors are not chowned to container user."""
174
+ if is_rootless ():
175
+ return 77
176
+
177
+ # Get current owner of /dev/null and use owner + 1 as container user
178
+ dev_null_stat = os .stat ('/dev/null' )
179
+ container_uid = dev_null_stat .st_uid + 1
180
+ container_gid = dev_null_stat .st_gid + 1
181
+
182
+ conf = base_config ()
183
+ conf ['process' ]['user' ] = {"uid" : container_uid , "gid" : container_gid }
184
+ add_all_namespaces (conf )
185
+
186
+ # Check ownership of stdin fd which should be /dev/null
187
+ conf ['process' ]['args' ] = ['/init' , 'owner' , '/proc/self/fd/0' ]
188
+
189
+ try :
190
+ out , container_id = run_and_get_output (conf , stdin_dev_null = True )
191
+ sys .stderr .write ("# Container ran successfully, output: %s\n " % repr (out ))
192
+ if ':' in out :
193
+ uid_str , gid_str = out .strip ().split (':' )
194
+ uid , gid = int (uid_str ), int (gid_str )
195
+ # Should NOT be owned by container user
196
+ if uid == container_uid or gid == container_gid :
197
+ sys .stderr .write ("# dev-null-no-chown test failed: /dev/null fd owned by container user %d:%d\n " % (uid , gid ))
198
+ sys .stderr .write ("# stdout: %s\n " % repr (out ))
199
+ return - 1
200
+ sys .stderr .write ("# dev-null-no-chown test passed: /dev/null fd owned by %d:%d (not container user %d:%d)\n " % (uid , gid , container_uid , container_gid ))
201
+ else :
202
+ sys .stderr .write ("# dev-null-no-chown test failed: unexpected owner output format\n " )
203
+ sys .stderr .write ("# stdout: %s\n " % repr (out ))
204
+ return - 1
205
+ return 0
206
+ except Exception as e :
207
+ sys .stderr .write ("# dev-null-no-chown test failed with exception: %s\n " % str (e ))
208
+ if hasattr (e , 'output' ):
209
+ sys .stderr .write ("# command output: %s\n " % repr (e .output ))
210
+ return - 1
211
+
212
+ def test_regular_files_chowned ():
213
+ """Test that regular file descriptors are chowned to container user."""
214
+ if is_rootless ():
215
+ return 77
216
+
217
+ # Get current owner of /dev/null and use owner + 1 as container user
218
+ dev_null_stat = os .stat ('/dev/null' )
219
+ container_uid = dev_null_stat .st_uid + 1
220
+ container_gid = dev_null_stat .st_gid + 1
221
+
222
+ conf = base_config ()
223
+ conf ['process' ]['user' ] = {"uid" : container_uid , "gid" : container_gid }
224
+ add_all_namespaces (conf )
225
+
226
+ # Check ownership of regular stdout (not /dev/null)
227
+ conf ['process' ]['args' ] = ['/init' , 'owner' , '/proc/self/fd/1' ]
228
+
229
+ try :
230
+ out , _ = run_and_get_output (conf )
231
+ if ':' in out :
232
+ uid_str , gid_str = out .strip ().split (':' )
233
+ uid , gid = int (uid_str ), int (gid_str )
234
+ # Should be owned by container user
235
+ if uid != container_uid or gid != container_gid :
236
+ sys .stderr .write ("# regular-files-chowned test failed: regular fd owned by %d:%d (expected %d:%d)\n " % (uid , gid , container_uid , container_gid ))
237
+ return - 1
238
+ sys .stderr .write ("# regular-files-chowned test passed: regular fd owned by %d:%d (container user)\n " % (uid , gid ))
239
+ else :
240
+ sys .stderr .write ("# regular-files-chowned test failed: unexpected output format: %s\n " % repr (out ))
241
+ return - 1
242
+ return 0
243
+ except Exception as e :
244
+ sys .stderr .write ("# regular-files-chowned test failed with exception: %s\n " % str (e ))
245
+ return - 1
246
+
171
247
all_tests = {
172
248
"uid" : test_uid ,
173
249
"gid" : test_gid ,
@@ -176,6 +252,8 @@ def test_umask():
176
252
"keep-groups" : test_keep_groups ,
177
253
"additional-gids" : test_additional_gids ,
178
254
"umask" : test_umask ,
255
+ "dev-null-no-chown" : test_dev_null_no_chown ,
256
+ "regular-files-chowned" : test_regular_files_chowned ,
179
257
}
180
258
181
259
if __name__ == "__main__" :
0 commit comments