test: Add docker integration no-new-privileges test. #836
Conversation
|
This test is following this approach https://www.projectatomic.io/blog/2016/03/no-new-privs-docker/ |
| @@ -0,0 +1,88 @@ | |||
| // Copyright (c) 2017 Intel Corporation | |||
|
|
||
| Context("check no-new-privileges flag", func() { | ||
| It("should display the correct effective uid", func() { | ||
| Skip("Issue https://github.com/clearcontainers/runtime/issues/880") |
There was a problem hiding this comment.
Nice. And this has inspired me to raise #837 which would be a super-useful little facility 😄
| args = []string{"-d", "--name", id, GccImage, "bash", "-c", "sleep 30"} | ||
| _, _, exitCode = DockerRun(args...) | ||
| Expect(exitCode).To(Equal(0)) | ||
| args = []string{id, "bash", "-c", "echo -e '#include<stdio.h>\n#include <unistd.h>\n#include <sys/types.h>\nint main (int argc, char *argv[])\n{printf(\"Effective uid: %d\", geteuid());return 0;}' > demo.c && make demo"} |
There was a problem hiding this comment.
I'm not really clear why it's necessary to build our own binary. Can't we just use a standard image with a standard version of /bin/id (which shows the EUID) and just create a container, copy /bin/id to /bin/id-foo or something, chmod -s it, commit the image, and re-run the test using that new image and passing --security-opt=no-new-privileges?
|
kubernetes qa-passed 👍 |
|
Hi @jodh-intel the problem is that the /usr/bin/id is not working correctly, if I do the chmod -s /usr/bin/id of a Fedora container and then I export the container and then import the image, I obtained the following In both cases the uid is 1000 (running with the flag or without). |
GabyCT
force-pushed
the
topic/flagprivilege
branch
from
f8aa965
to
9d4e75e
Compare
|
@jodh-intel , this was verified using |
|
kubernetes qa-passed 👍 |
|
@GabyCT The above behaviour is actually correct. /usr/bin/uid reports the effective user id only if its different from the real user id (https://docs.oracle.com/cd/E19683-01/816-0211/6m6nc66s5/index.html) So, Means that the effective user id (euid) is 1000, which is what we expect from the no-new-privileges flag. Also, this PR to vendor virtcontainers in the proxy needs to be merged: |
This test will verify that a container process do not gain additional privileges while running no-new-privileges with docker. Fixes clearcontainers#811 Signed-off-by: Gabriela Cervantes <[email protected]>
|
🔌 Shameless plug 🔌 If you want a clearer confirmation of which user you are running as, you could use a |
GabyCT
force-pushed
the
topic/flagprivilege
branch
from
9d4e75e
to
7163ae6
Compare
|
kubernetes qa-passed 👍 |
This test will verify that a container process do not gain
additional privileges while running no-new-privileges with docker.
Fixes #811
Signed-off-by: Gabriela Cervantes [email protected]