Merge pull request kubernetes#9384 from pmorie/emptydir-nonroot

Support emptydir volumes for containers running as non-root
nikhiljindal · Jul 29, 2015 · 5dff049 · 5dff049
2 parents 4ddfa5d + 5394aa9
commit 5dff049
Show file tree

Hide file tree

Showing 14 changed files with 734 additions and 160 deletions.
diff --git a/contrib/for-tests/mount-tester-user/Dockerfile b/contrib/for-tests/mount-tester-user/Dockerfile
@@ -0,0 +1,16 @@
+# Copyright 2015 Google Inc. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM gcr.io/google-containers/mounttest:0.3
+USER 1001
diff --git a/contrib/for-tests/mount-tester-user/Makefile b/contrib/for-tests/mount-tester-user/Makefile
@@ -0,0 +1,9 @@
+all: push
+
+TAG = 0.1
+
+image:
+	sudo docker build -t gcr.io/google_containers/mounttest-user:$(TAG) .
+
+push: image
+	gcloud docker push gcr.io/google_containers/mounttest-user:$(TAG)
diff --git a/contrib/for-tests/mount-tester/Makefile b/contrib/for-tests/mount-tester/Makefile
@@ -1,6 +1,6 @@
 all: push
 
-TAG = 0.2
+TAG = 0.3
 
 mt: mt.go
 	CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -ldflags '-w' ./mt.go

diff --git a/contrib/for-tests/mount-tester/mt.go b/contrib/for-tests/mount-tester/mt.go
@@ -25,17 +25,23 @@ import (
 )
 
 var (
-	fsTypePath           = ""
-	fileModePath         = ""
-	readFileContentPath  = ""
-	readWriteNewFilePath = ""
+	fsTypePath          = ""
+	fileModePath        = ""
+	filePermPath        = ""
+	readFileContentPath = ""
+	newFilePath0644     = ""
+	newFilePath0666     = ""
+	newFilePath0777     = ""
 )
 
 func init() {
 	flag.StringVar(&fsTypePath, "fs_type", "", "Path to print the fs type for")
-	flag.StringVar(&fileModePath, "file_mode", "", "Path to print the filemode of")
+	flag.StringVar(&fileModePath, "file_mode", "", "Path to print the mode bits of")
+	flag.StringVar(&filePermPath, "file_perm", "", "Path to print the perms of")
 	flag.StringVar(&readFileContentPath, "file_content", "", "Path to read the file content from")
-	flag.StringVar(&readWriteNewFilePath, "rw_new_file", "", "Path to write to and read from")
+	flag.StringVar(&newFilePath0644, "new_file_0644", "", "Path to write to and read from with perm 0644")
+	flag.StringVar(&newFilePath0666, "new_file_0666", "", "Path to write to and read from with perm 0666")
+	flag.StringVar(&newFilePath0777, "new_file_0777", "", "Path to write to and read from with perm 0777")
 }
 
 // This program performs some tests on the filesystem as dictated by the
@@ -48,6 +54,9 @@ func main() {
 		errs = []error{}
 	)
 
+	// Clear the umask so we can set any mode bits we want.
+	syscall.Umask(0000)
+
 	// NOTE: the ordering of execution of the various command line
 	// flags is intentional and allows a single command to:
 	//
@@ -62,7 +71,17 @@ func main() {
 		errs = append(errs, err)
 	}
 
-	err = readWriteNewFile(readWriteNewFilePath)
+	err = readWriteNewFile(newFilePath0644, 0644)
+	if err != nil {
+		errs = append(errs, err)
+	}
+
+	err = readWriteNewFile(newFilePath0666, 0666)
+	if err != nil {
+		errs = append(errs, err)
+	}
+
+	err = readWriteNewFile(newFilePath0777, 0777)
 	if err != nil {
 		errs = append(errs, err)
 	}
@@ -72,6 +91,11 @@ func main() {
 		errs = append(errs, err)
 	}
 
+	err = filePerm(filePermPath)
+	if err != nil {
+		errs = append(errs, err)
+	}
+
 	err = readFileContent(readFileContentPath)
 	if err != nil {
 		errs = append(errs, err)
@@ -94,7 +118,7 @@ func fsType(path string) error {
 
 	buf := syscall.Statfs_t{}
 	if err := syscall.Statfs(path, &buf); err != nil {
-		fmt.Printf("error from statfs(%q): %v", path, err)
+		fmt.Printf("error from statfs(%q): %v\n", path, err)
 		return err
 	}
 
@@ -122,6 +146,21 @@ func fileMode(path string) error {
 	return nil
 }
 
+func filePerm(path string) error {
+	if path == "" {
+		return nil
+	}
+
+	fileinfo, err := os.Lstat(path)
+	if err != nil {
+		fmt.Printf("error from Lstat(%q): %v\n", path, err)
+		return err
+	}
+
+	fmt.Printf("perms of file %q: %v\n", path, fileinfo.Mode().Perm())
+	return nil
+}
+
 func readFileContent(path string) error {
 	if path == "" {
 		return nil
@@ -138,13 +177,13 @@ func readFileContent(path string) error {
 	return nil
 }
 
-func readWriteNewFile(path string) error {
+func readWriteNewFile(path string, perm os.FileMode) error {
 	if path == "" {
 		return nil
 	}
 
 	content := "mount-tester new file\n"
-	err := ioutil.WriteFile(path, []byte(content), 0644)
+	err := ioutil.WriteFile(path, []byte(content), perm)
 	if err != nil {
 		fmt.Printf("error writing new file %q: %v\n", path, err)
 		return err

diff --git a/pkg/securitycontext/util.go b/pkg/securitycontext/util.go
@@ -16,7 +16,12 @@ limitations under the License.
 
 package securitycontext
 
-import "github.com/GoogleCloudPlatform/kubernetes/pkg/api"
+import (
+	"fmt"
+	"strings"
+
+	"github.com/GoogleCloudPlatform/kubernetes/pkg/api"
+)
 
 // HasPrivilegedRequest returns the value of SecurityContext.Privileged, taking into account
 // the possibility of nils
@@ -41,3 +46,23 @@ func HasCapabilitiesRequest(container *api.Container) bool {
 	}
 	return len(container.SecurityContext.Capabilities.Add) > 0 || len(container.SecurityContext.Capabilities.Drop) > 0
 }
+
+const expectedSELinuxContextFields = 4
+
+// ParseSELinuxOptions parses a string containing a full SELinux context
+// (user, role, type, and level) into an SELinuxOptions object.  If the
+// context is malformed, an error is returned.
+func ParseSELinuxOptions(context string) (*api.SELinuxOptions, error) {
+	fields := strings.SplitN(context, ":", expectedSELinuxContextFields)
+
+	if len(fields) != expectedSELinuxContextFields {
+		return nil, fmt.Errorf("expected %v fields in selinuxcontext; got %v (context: %v)", expectedSELinuxContextFields, len(fields), context)
+	}
+
+	return &api.SELinuxOptions{
+		User:  fields[0],
+		Role:  fields[1],
+		Type:  fields[2],
+		Level: fields[3],
+	}, nil
+}
diff --git a/pkg/securitycontext/util_test.go b/pkg/securitycontext/util_test.go
@@ -0,0 +1,85 @@
+/*
+Copyright 2014 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package securitycontext
+
+import (
+	"testing"
+
+	"github.com/GoogleCloudPlatform/kubernetes/pkg/api"
+)
+
+func TestParseSELinuxOptions(t *testing.T) {
+	cases := []struct {
+		name     string
+		input    string
+		expected *api.SELinuxOptions
+	}{
+		{
+			name:  "simple",
+			input: "user_t:role_t:type_t:s0",
+			expected: &api.SELinuxOptions{
+				User:  "user_t",
+				Role:  "role_t",
+				Type:  "type_t",
+				Level: "s0",
+			},
+		},
+		{
+			name:  "simple + categories",
+			input: "user_t:role_t:type_t:s0:c0",
+			expected: &api.SELinuxOptions{
+				User:  "user_t",
+				Role:  "role_t",
+				Type:  "type_t",
+				Level: "s0:c0",
+			},
+		},
+		{
+			name:  "not enough fields",
+			input: "type_t:s0:c0",
+		},
+	}
+
+	for _, tc := range cases {
+		result, err := ParseSELinuxOptions(tc.input)
+
+		if err != nil {
+			if tc.expected == nil {
+				continue
+			} else {
+				t.Errorf("%v: unexpected error: %v", tc.name, err)
+			}
+		}
+
+		compareContexts(tc.name, tc.expected, result, t)
+	}
+}
+
+func compareContexts(name string, ex, ac *api.SELinuxOptions, t *testing.T) {
+	if e, a := ex.User, ac.User; e != a {
+		t.Errorf("%v: expected user: %v, got: %v", name, e, a)
+	}
+	if e, a := ex.Role, ac.Role; e != a {
+		t.Errorf("%v: expected role: %v, got: %v", name, e, a)
+	}
+	if e, a := ex.Type, ac.Type; e != a {
+		t.Errorf("%v: expected type: %v, got: %v", name, e, a)
+	}
+	if e, a := ex.Level, ac.Level; e != a {
+		t.Errorf("%v: expected level: %v, got: %v", name, e, a)
+	}
+}
diff --git a/pkg/volume/empty_dir/chcon_runner.go b/pkg/volume/empty_dir/chcon_runner.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2014 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package empty_dir
+
+// chconRunner knows how to chcon a directory.
+type chconRunner interface {
+	SetContext(dir, context string) error
+}
+
+// newChconRunner returns a new chconRunner.
+func newChconRunner() chconRunner {
+	return &realChconRunner{}
+}
diff --git a/pkg/volume/empty_dir/chcon_runner_linux.go b/pkg/volume/empty_dir/chcon_runner_linux.go
@@ -0,0 +1,34 @@
+// +build linux
+
+/*
+Copyright 2014 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package empty_dir
+
+import (
+	"github.com/docker/libcontainer/selinux"
+)
+
+type realChconRunner struct{}
+
+func (_ *realChconRunner) SetContext(dir, context string) error {
+	// If SELinux is not enabled, return an empty string
+	if !selinux.SelinuxEnabled() {
+		return nil
+	}
+
+	return selinux.Setfilecon(dir, context)
+}
diff --git a/pkg/volume/empty_dir/chcon_runner_unsupported.go b/pkg/volume/empty_dir/chcon_runner_unsupported.go
@@ -0,0 +1,26 @@
+// +build !linux
+
+/*
+Copyright 2014 The Kubernetes Authors All rights reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package empty_dir
+
+type realChconRunner struct{}
+
+func (_ *realChconRunner) SetContext(dir, context string) error {
+	// NOP
+	return nil
+}