@@ -1854,13 +1854,20 @@ func (s *DockerSuite) TestRunInteractiveWithRestartPolicy(c *check.C) {
18541854}
18551855
18561856// Test for #2267
1857- func (s * DockerSuite ) TestRunWriteHostsFileAndNotCommit (c * check.C ) {
1858- // Cannot run on Windows as Windows does not support diff.
1857+ func (s * DockerSuite ) TestRunWriteSpecialFilesAndNotCommit (c * check.C ) {
1858+ // Cannot run on Windows as this files are not present in Windows
18591859 testRequires (c , DaemonIsLinux )
1860- name := "writehosts"
1861- out , _ := dockerCmd (c , "run" , "--name" , name , "busybox" , "sh" , "-c" , "echo test2267 >> /etc/hosts && cat /etc/hosts" )
1860+
1861+ testRunWriteSpecialFilesAndNotCommit (c , "writehosts" , "/etc/hosts" )
1862+ testRunWriteSpecialFilesAndNotCommit (c , "writehostname" , "/etc/hostname" )
1863+ testRunWriteSpecialFilesAndNotCommit (c , "writeresolv" , "/etc/resolv.conf" )
1864+ }
1865+
1866+ func testRunWriteSpecialFilesAndNotCommit (c * check.C , name , path string ) {
1867+ command := fmt .Sprintf ("echo test2267 >> %s && cat %s" , path , path )
1868+ out , _ := dockerCmd (c , "run" , "--name" , name , "busybox" , "sh" , "-c" , command )
18621869 if ! strings .Contains (out , "test2267" ) {
1863- c .Fatal ( "/etc/hosts should contain 'test2267'" )
1870+ c .Fatalf ( "%s should contain 'test2267'", path )
18641871 }
18651872
18661873 out , _ = dockerCmd (c , "diff" , name )
@@ -1897,38 +1904,6 @@ func sliceEq(a, b []string) bool {
18971904 return true
18981905}
18991906
1900- // Test for #2267
1901- func (s * DockerSuite ) TestRunWriteHostnameFileAndNotCommit (c * check.C ) {
1902- // Cannot run on Windows as Windows does not support diff.
1903- testRequires (c , DaemonIsLinux )
1904- name := "writehostname"
1905- out , _ := dockerCmd (c , "run" , "--name" , name , "busybox" , "sh" , "-c" , "echo test2267 >> /etc/hostname && cat /etc/hostname" )
1906- if ! strings .Contains (out , "test2267" ) {
1907- c .Fatal ("/etc/hostname should contain 'test2267'" )
1908- }
1909-
1910- out , _ = dockerCmd (c , "diff" , name )
1911- if len (strings .Trim (out , "\r \n " )) != 0 && ! eqToBaseDiff (out , c ) {
1912- c .Fatal ("diff should be empty" )
1913- }
1914- }
1915-
1916- // Test for #2267
1917- func (s * DockerSuite ) TestRunWriteResolvFileAndNotCommit (c * check.C ) {
1918- // Cannot run on Windows as Windows does not support diff.
1919- testRequires (c , DaemonIsLinux )
1920- name := "writeresolv"
1921- out , _ := dockerCmd (c , "run" , "--name" , name , "busybox" , "sh" , "-c" , "echo test2267 >> /etc/resolv.conf && cat /etc/resolv.conf" )
1922- if ! strings .Contains (out , "test2267" ) {
1923- c .Fatal ("/etc/resolv.conf should contain 'test2267'" )
1924- }
1925-
1926- out , _ = dockerCmd (c , "diff" , name )
1927- if len (strings .Trim (out , "\r \n " )) != 0 && ! eqToBaseDiff (out , c ) {
1928- c .Fatal ("diff should be empty" )
1929- }
1930- }
1931-
19321907func (s * DockerSuite ) TestRunWithBadDevice (c * check.C ) {
19331908 // Cannot run on Windows as Windows does not support --device
19341909 testRequires (c , DaemonIsLinux )
@@ -3453,38 +3428,14 @@ func (s *DockerSuite) TestRunContainerWithCgroupParent(c *check.C) {
34533428 // Not applicable on Windows as uses Unix specific functionality
34543429 testRequires (c , DaemonIsLinux )
34553430
3456- cgroupParent := "test"
3457- name := "cgroup-test"
3431+ // cgroup-parent relative path
3432+ testRunContainerWithCgroupParent ( c , "test" , "cgroup-test" )
34583433
3459- out , _ , err := dockerCmdWithError ("run" , "--cgroup-parent" , cgroupParent , "--name" , name , "busybox" , "cat" , "/proc/self/cgroup" )
3460- if err != nil {
3461- c .Fatalf ("unexpected failure when running container with --cgroup-parent option - %s\n %v" , string (out ), err )
3462- }
3463- cgroupPaths := testutil .ParseCgroupPaths (string (out ))
3464- if len (cgroupPaths ) == 0 {
3465- c .Fatalf ("unexpected output - %q" , string (out ))
3466- }
3467- id , err := getIDByName (name )
3468- c .Assert (err , check .IsNil )
3469- expectedCgroup := path .Join (cgroupParent , id )
3470- found := false
3471- for _ , path := range cgroupPaths {
3472- if strings .HasSuffix (path , expectedCgroup ) {
3473- found = true
3474- break
3475- }
3476- }
3477- if ! found {
3478- c .Fatalf ("unexpected cgroup paths. Expected at least one cgroup path to have suffix %q. Cgroup Paths: %v" , expectedCgroup , cgroupPaths )
3479- }
3434+ // cgroup-parent absolute path
3435+ testRunContainerWithCgroupParent (c , "/cgroup-parent/test" , "cgroup-test-absolute" )
34803436}
34813437
3482- func (s * DockerSuite ) TestRunContainerWithCgroupParentAbsPath (c * check.C ) {
3483- // Not applicable on Windows as uses Unix specific functionality
3484- testRequires (c , DaemonIsLinux )
3485-
3486- cgroupParent := "/cgroup-parent/test"
3487- name := "cgroup-test"
3438+ func testRunContainerWithCgroupParent (c * check.C , cgroupParent , name string ) {
34883439 out , _ , err := dockerCmdWithError ("run" , "--cgroup-parent" , cgroupParent , "--name" , name , "busybox" , "cat" , "/proc/self/cgroup" )
34893440 if err != nil {
34903441 c .Fatalf ("unexpected failure when running container with --cgroup-parent option - %s\n %v" , string (out ), err )
@@ -3513,49 +3464,12 @@ func (s *DockerSuite) TestRunInvalidCgroupParent(c *check.C) {
35133464 // Not applicable on Windows as uses Unix specific functionality
35143465 testRequires (c , DaemonIsLinux )
35153466
3516- cgroupParent := "../../../../../../../../SHOULD_NOT_EXIST"
3517- cleanCgroupParent := "SHOULD_NOT_EXIST"
3518- name := "cgroup-invalid-test"
3467+ testRunInvalidCgroupParent (c , "../../../../../../../../SHOULD_NOT_EXIST" , "SHOULD_NOT_EXIST" , "cgroup-invalid-test" )
35193468
3520- out , _ , err := dockerCmdWithError ("run" , "--cgroup-parent" , cgroupParent , "--name" , name , "busybox" , "cat" , "/proc/self/cgroup" )
3521- if err != nil {
3522- // XXX: This may include a daemon crash.
3523- c .Fatalf ("unexpected failure when running container with --cgroup-parent option - %s\n %v" , string (out ), err )
3524- }
3525-
3526- // We expect "/SHOULD_NOT_EXIST" to not exist. If not, we have a security issue.
3527- if _ , err := os .Stat ("/SHOULD_NOT_EXIST" ); err == nil || ! os .IsNotExist (err ) {
3528- c .Fatalf ("SECURITY: --cgroup-parent with ../../ relative paths cause files to be created in the host (this is bad) !!" )
3529- }
3530-
3531- cgroupPaths := testutil .ParseCgroupPaths (string (out ))
3532- if len (cgroupPaths ) == 0 {
3533- c .Fatalf ("unexpected output - %q" , string (out ))
3534- }
3535- id , err := getIDByName (name )
3536- c .Assert (err , check .IsNil )
3537- expectedCgroup := path .Join (cleanCgroupParent , id )
3538- found := false
3539- for _ , path := range cgroupPaths {
3540- if strings .HasSuffix (path , expectedCgroup ) {
3541- found = true
3542- break
3543- }
3544- }
3545- if ! found {
3546- c .Fatalf ("unexpected cgroup paths. Expected at least one cgroup path to have suffix %q. Cgroup Paths: %v" , expectedCgroup , cgroupPaths )
3547- }
3469+ testRunInvalidCgroupParent (c , "/../../../../../../../../SHOULD_NOT_EXIST" , "/SHOULD_NOT_EXIST" , "cgroup-absolute-invalid-test" )
35483470}
35493471
3550- // TestRunInvalidCgroupParent checks that a specially-crafted cgroup parent doesn't cause Docker to crash or start modifying /.
3551- func (s * DockerSuite ) TestRunAbsoluteInvalidCgroupParent (c * check.C ) {
3552- // Not applicable on Windows as uses Unix specific functionality
3553- testRequires (c , DaemonIsLinux )
3554-
3555- cgroupParent := "/../../../../../../../../SHOULD_NOT_EXIST"
3556- cleanCgroupParent := "/SHOULD_NOT_EXIST"
3557- name := "cgroup-absolute-invalid-test"
3558-
3472+ func testRunInvalidCgroupParent (c * check.C , cgroupParent , cleanCgroupParent , name string ) {
35593473 out , _ , err := dockerCmdWithError ("run" , "--cgroup-parent" , cgroupParent , "--name" , name , "busybox" , "cat" , "/proc/self/cgroup" )
35603474 if err != nil {
35613475 // XXX: This may include a daemon crash.
@@ -3564,7 +3478,7 @@ func (s *DockerSuite) TestRunAbsoluteInvalidCgroupParent(c *check.C) {
35643478
35653479 // We expect "/SHOULD_NOT_EXIST" to not exist. If not, we have a security issue.
35663480 if _ , err := os .Stat ("/SHOULD_NOT_EXIST" ); err == nil || ! os .IsNotExist (err ) {
3567- c .Fatalf ("SECURITY: --cgroup-parent with / ../../ garbage paths cause files to be created in the host (this is bad) !!" )
3481+ c .Fatalf ("SECURITY: --cgroup-parent with ../../ relative paths cause files to be created in the host (this is bad) !!" )
35683482 }
35693483
35703484 cgroupPaths := testutil .ParseCgroupPaths (string (out ))
0 commit comments