Skip to content

Make cwd required #475

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 15, 2016
Merged

Make cwd required #475

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions libcontainer/init_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,10 +134,8 @@ func finalizeNamespace(config *initConfig) error {
if err := w.drop(); err != nil {
return err
}
if config.Cwd != "" {
if err := syscall.Chdir(config.Cwd); err != nil {
return err
}
if err := syscall.Chdir(config.Cwd); err != nil {
return err
}
return nil
}
Expand Down
2 changes: 2 additions & 0 deletions libcontainer/integration/checkpoint_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@ func TestCheckpoint(t *testing.T) {
var stdout bytes.Buffer

pconfig := libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand Down Expand Up @@ -150,6 +151,7 @@ func TestCheckpoint(t *testing.T) {
}

restoreProcessConfig := &libcontainer.Process{
Cwd: "/",
Stdin: restoreStdinR,
Stdout: &stdout,
}
Expand Down
16 changes: 16 additions & 0 deletions libcontainer/integration/exec_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,7 @@ func TestEnter(t *testing.T) {
var stdout, stdout2 bytes.Buffer

pconfig := libcontainer.Process{
Cwd: "/",
Args: []string{"sh", "-c", "cat && readlink /proc/self/ns/pid"},
Env: standardEnvironment,
Stdin: stdinR,
Expand All @@ -224,6 +225,7 @@ func TestEnter(t *testing.T) {
stdinR2, stdinW2, err := os.Pipe()
ok(t, err)
pconfig2 := libcontainer.Process{
Cwd: "/",
Env: standardEnvironment,
}
pconfig2.Args = []string{"sh", "-c", "cat && readlink /proc/self/ns/pid"}
Expand Down Expand Up @@ -290,6 +292,7 @@ func TestProcessEnv(t *testing.T) {

var stdout bytes.Buffer
pconfig := libcontainer.Process{
Cwd: "/",
Args: []string{"sh", "-c", "env"},
Env: []string{
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
Expand Down Expand Up @@ -341,6 +344,7 @@ func TestProcessCaps(t *testing.T) {

var stdout bytes.Buffer
pconfig := libcontainer.Process{
Cwd: "/",
Args: []string{"sh", "-c", "cat /proc/self/status"},
Env: standardEnvironment,
Capabilities: processCaps,
Expand Down Expand Up @@ -411,6 +415,7 @@ func TestAdditionalGroups(t *testing.T) {

var stdout bytes.Buffer
pconfig := libcontainer.Process{
Cwd: "/",
Args: []string{"sh", "-c", "id", "-Gn"},
Env: standardEnvironment,
Stdin: nil,
Expand Down Expand Up @@ -471,6 +476,7 @@ func testFreeze(t *testing.T, systemd bool) {
ok(t, err)

pconfig := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand Down Expand Up @@ -667,6 +673,7 @@ func TestContainerState(t *testing.T) {
t.Fatal(err)
}
p := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand Down Expand Up @@ -717,6 +724,7 @@ func TestPassExtraFiles(t *testing.T) {
pipeout1, pipein1, err := os.Pipe()
pipeout2, pipein2, err := os.Pipe()
process := libcontainer.Process{
Cwd: "/",
Args: []string{"sh", "-c", "cd /proc/$$/fd; echo -n *; echo -n 1 >3; echo -n 2 >4"},
Env: []string{"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},
ExtraFiles: []*os.File{pipein1, pipein2},
Expand Down Expand Up @@ -800,6 +808,7 @@ func TestMountCmds(t *testing.T) {
defer container.Destroy()

pconfig := libcontainer.Process{
Cwd: "/",
Args: []string{"sh", "-c", "env"},
Env: standardEnvironment,
}
Expand Down Expand Up @@ -846,6 +855,7 @@ func TestSysctl(t *testing.T) {

var stdout bytes.Buffer
pconfig := libcontainer.Process{
Cwd: "/",
Args: []string{"sh", "-c", "cat /proc/sys/kernel/shmmni"},
Env: standardEnvironment,
Stdin: nil,
Expand Down Expand Up @@ -985,6 +995,7 @@ func TestOomScoreAdj(t *testing.T) {

var stdout bytes.Buffer
pconfig := libcontainer.Process{
Cwd: "/",
Args: []string{"sh", "-c", "cat /proc/self/oom_score_adj"},
Env: standardEnvironment,
Stdin: nil,
Expand Down Expand Up @@ -1037,6 +1048,7 @@ func TestHook(t *testing.T) {

var stdout bytes.Buffer
pconfig := libcontainer.Process{
Cwd: "/",
Args: []string{"sh", "-c", "ls /test"},
Env: standardEnvironment,
Stdin: nil,
Expand Down Expand Up @@ -1143,6 +1155,7 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
ok(t, err)

pconfig := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand Down Expand Up @@ -1170,6 +1183,7 @@ func TestRootfsPropagationSlaveMount(t *testing.T) {
ok(t, err)

pconfig2 := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat", "/proc/self/mountinfo"},
Env: standardEnvironment,
Stdin: stdinR2,
Expand Down Expand Up @@ -1259,6 +1273,7 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
ok(t, err)

pconfig := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand Down Expand Up @@ -1288,6 +1303,7 @@ func TestRootfsPropagationSharedMount(t *testing.T) {
processCaps := append(config.Capabilities, "CAP_SYS_ADMIN")

pconfig2 := &libcontainer.Process{
Cwd: "/",
Args: []string{"mount", "--bind", dir2cont, dir2cont},
Env: standardEnvironment,
Stdin: stdinR2,
Expand Down
14 changes: 14 additions & 0 deletions libcontainer/integration/execin_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ func TestExecIn(t *testing.T) {
stdinR, stdinW, err := os.Pipe()
ok(t, err)
process := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand All @@ -39,6 +40,7 @@ func TestExecIn(t *testing.T) {

buffers := newStdBuffers()
ps := &libcontainer.Process{
Cwd: "/",
Args: []string{"ps"},
Env: standardEnvironment,
Stdin: buffers.Stdin,
Expand Down Expand Up @@ -73,6 +75,7 @@ func TestExecInRlimit(t *testing.T) {
stdinR, stdinW, err := os.Pipe()
ok(t, err)
process := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand All @@ -84,6 +87,7 @@ func TestExecInRlimit(t *testing.T) {

buffers := newStdBuffers()
ps := &libcontainer.Process{
Cwd: "/",
Args: []string{"/bin/sh", "-c", "ulimit -n"},
Env: standardEnvironment,
Stdin: buffers.Stdin,
Expand Down Expand Up @@ -119,6 +123,7 @@ func TestExecInError(t *testing.T) {
stdinR, stdinW, err := os.Pipe()
ok(t, err)
process := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand All @@ -136,6 +141,7 @@ func TestExecInError(t *testing.T) {
for i := 0; i < 42; i++ {
var out bytes.Buffer
unexistent := &libcontainer.Process{
Cwd: "/",
Args: []string{"unexistent"},
Env: standardEnvironment,
Stdout: &out,
Expand Down Expand Up @@ -169,6 +175,7 @@ func TestExecInTTY(t *testing.T) {
stdinR, stdinW, err := os.Pipe()
ok(t, err)
process := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand All @@ -180,6 +187,7 @@ func TestExecInTTY(t *testing.T) {

var stdout bytes.Buffer
ps := &libcontainer.Process{
Cwd: "/",
Args: []string{"ps"},
Env: standardEnvironment,
}
Expand Down Expand Up @@ -224,6 +232,7 @@ func TestExecInEnvironment(t *testing.T) {
stdinR, stdinW, err := os.Pipe()
ok(t, err)
process := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand All @@ -235,6 +244,7 @@ func TestExecInEnvironment(t *testing.T) {

buffers := newStdBuffers()
process2 := &libcontainer.Process{
Cwd: "/",
Args: []string{"env"},
Env: []string{
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
Expand Down Expand Up @@ -286,6 +296,7 @@ func TestExecinPassExtraFiles(t *testing.T) {
t.Fatal(err)
}
process := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand All @@ -301,6 +312,7 @@ func TestExecinPassExtraFiles(t *testing.T) {
pipeout1, pipein1, err := os.Pipe()
pipeout2, pipein2, err := os.Pipe()
inprocess := &libcontainer.Process{
Cwd: "/",
Args: []string{"sh", "-c", "cd /proc/$$/fd; echo -n *; echo -n 1 >3; echo -n 2 >4"},
Env: []string{"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},
ExtraFiles: []*os.File{pipein1, pipein2},
Expand Down Expand Up @@ -357,6 +369,7 @@ func TestExecInOomScoreAdj(t *testing.T) {
stdinR, stdinW, err := os.Pipe()
ok(t, err)
process := &libcontainer.Process{
Cwd: "/",
Args: []string{"cat"},
Env: standardEnvironment,
Stdin: stdinR,
Expand All @@ -368,6 +381,7 @@ func TestExecInOomScoreAdj(t *testing.T) {

buffers := newStdBuffers()
ps := &libcontainer.Process{
Cwd: "/",
Args: []string{"/bin/sh", "-c", "cat /proc/self/oom_score_adj"},
Env: standardEnvironment,
Stdin: buffers.Stdin,
Expand Down
3 changes: 3 additions & 0 deletions libcontainer/integration/seccomp_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@ func TestSeccompDenyGetcwd(t *testing.T) {

buffers := newStdBuffers()
pwd := &libcontainer.Process{
Cwd: "/",
Args: []string{"pwd"},
Env: standardEnvironment,
Stdin: buffers.Stdin,
Expand Down Expand Up @@ -116,6 +117,7 @@ func TestSeccompPermitWriteConditional(t *testing.T) {

buffers := newStdBuffers()
dmesg := &libcontainer.Process{
Cwd: "/",
Args: []string{"busybox", "ls", "/"},
Env: standardEnvironment,
Stdin: buffers.Stdin,
Expand Down Expand Up @@ -176,6 +178,7 @@ func TestSeccompDenyWriteConditional(t *testing.T) {

buffers := newStdBuffers()
dmesg := &libcontainer.Process{
Cwd: "/",
Args: []string{"busybox", "ls", "does_not_exist"},
Env: standardEnvironment,
Stdin: buffers.Stdin,
Expand Down
1 change: 1 addition & 0 deletions libcontainer/integration/utils_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,7 @@ func runContainer(config *configs.Config, console string, args ...string) (buffe
defer container.Destroy()
buffers = newStdBuffers()
process := &libcontainer.Process{
Cwd: "/",
Args: args,
Env: standardEnvironment,
Stdin: buffers.Stdin,
Expand Down
15 changes: 14 additions & 1 deletion spec.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,6 +53,7 @@ var specCommand = cli.Command{
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"TERM=xterm",
},
Cwd: "/",
},
Hostname: "shell",
Mounts: []specs.MountPoint{
Expand Down Expand Up @@ -290,6 +291,15 @@ var mountPropagationMapping = map[string]int{
"": syscall.MS_PRIVATE | syscall.MS_REC,
}

// validateSpec validates the fields in the spec
// TODO: Add validation for other fields where applicable
func validateSpec(spec *specs.LinuxSpec, rspec *specs.LinuxRuntimeSpec) error {
if spec.Process.Cwd == "" {
Copy link

@duglin duglin Jan 15, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if opencontainers/runtime-spec#312 is adopted before this PR is merged, can you add a check to ensure its an abs path? filepath.IsAbs()

Copy link
Contributor Author

@mrunalp mrunalp Jan 15, 2016

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure.

Sent from my iPhone

On Jan 15, 2016, at 6:14 AM, Doug Davis [email protected] wrote:

In spec.go:

@@ -290,6 +291,15 @@ var mountPropagationMapping = map[string]int{
"": syscall.MS_PRIVATE | syscall.MS_REC,
}

+// validateSpec validates the fields in the spec
+// TODO: Add validation for other fields where applicable
+func validateSpec(spec *specs.LinuxSpec, rspec *specs.LinuxRuntimeSpec) error {

—
Reply to this email directly or view it on GitHub.

return fmt.Errorf("Cwd property must not be empty")
}
return nil
}

// loadSpec loads the specification from the provided path.
// If the path is empty then the default path will be "config.json"
func loadSpec(cPath, rPath string) (spec *specs.LinuxSpec, rspec *specs.LinuxRuntimeSpec, err error) {
Expand Down Expand Up @@ -317,7 +327,10 @@ func loadSpec(cPath, rPath string) (spec *specs.LinuxSpec, rspec *specs.LinuxRun
if err = json.NewDecoder(rf).Decode(&rspec); err != nil {
return spec, rspec, err
}
return spec, rspec, checkSpecVersion(spec)
if err := checkSpecVersion(spec); err != nil {
return spec, rspec, err
}
return spec, rspec, validateSpec(spec, rspec)
}

// checkSpecVersion makes sure that the spec version matches runc's while we are in the initial
Expand Down
1 change: 1 addition & 0 deletions start.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,7 @@ func startContainer(context *cli.Context, spec *specs.LinuxSpec, rspec *specs.Li
// ensure that the container is always removed if we were the process
// that created it.
defer destroy(container)

process := newProcess(spec.Process)

// Support on-demand socket activation by passing file descriptors into the container init process.
Expand Down