123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284 |
- // +build linux
- /*
- Copyright 2014 The Kubernetes Authors.
- Licensed under the Apache License, Version 2.0 (the "License");
- you may not use this file except in compliance with the License.
- You may obtain a copy of the License at
- http://www.apache.org/licenses/LICENSE-2.0
- Unless required by applicable law or agreed to in writing, software
- distributed under the License is distributed on an "AS IS" BASIS,
- WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- See the License for the specific language governing permissions and
- limitations under the License.
- */
- package subpath
- import (
- "fmt"
- "io/ioutil"
- "net"
- "os"
- "path/filepath"
- "reflect"
- "strconv"
- "syscall"
- "testing"
- "k8s.io/klog"
- "k8s.io/utils/mount"
- )
- func TestSafeMakeDir(t *testing.T) {
- defaultPerm := os.FileMode(0750) + os.ModeDir
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) error
- path string
- checkPath string
- perm os.FileMode
- expectError bool
- }{
- {
- "directory-does-not-exist",
- func(base string) error {
- return nil
- },
- "test/directory",
- "test/directory",
- defaultPerm,
- false,
- },
- {
- "directory-with-sgid",
- func(base string) error {
- return nil
- },
- "test/directory",
- "test/directory",
- os.FileMode(0777) + os.ModeDir + os.ModeSetgid,
- false,
- },
- {
- "directory-with-suid",
- func(base string) error {
- return nil
- },
- "test/directory",
- "test/directory",
- os.FileMode(0777) + os.ModeDir + os.ModeSetuid,
- false,
- },
- {
- "directory-with-sticky-bit",
- func(base string) error {
- return nil
- },
- "test/directory",
- "test/directory",
- os.FileMode(0777) + os.ModeDir + os.ModeSticky,
- false,
- },
- {
- "directory-exists",
- func(base string) error {
- return os.MkdirAll(filepath.Join(base, "test/directory"), 0750)
- },
- "test/directory",
- "test/directory",
- defaultPerm,
- false,
- },
- {
- "create-base",
- func(base string) error {
- return nil
- },
- "",
- "",
- defaultPerm,
- false,
- },
- {
- "escape-base-using-dots",
- func(base string) error {
- return nil
- },
- "..",
- "",
- defaultPerm,
- true,
- },
- {
- "escape-base-using-dots-2",
- func(base string) error {
- return nil
- },
- "test/../../..",
- "",
- defaultPerm,
- true,
- },
- {
- "follow-symlinks",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "destination"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("destination", filepath.Join(base, "test"))
- },
- "test/directory",
- "destination/directory",
- defaultPerm,
- false,
- },
- {
- "follow-symlink-loop",
- func(base string) error {
- return os.Symlink("test", filepath.Join(base, "test"))
- },
- "test/directory",
- "",
- defaultPerm,
- true,
- },
- {
- "follow-symlink-multiple follow",
- func(base string) error {
- /* test1/dir points to test2 and test2/dir points to test1 */
- if err := os.MkdirAll(filepath.Join(base, "test1"), defaultPerm); err != nil {
- return err
- }
- if err := os.MkdirAll(filepath.Join(base, "test2"), defaultPerm); err != nil {
- return err
- }
- if err := os.Symlink(filepath.Join(base, "test2"), filepath.Join(base, "test1/dir")); err != nil {
- return err
- }
- if err := os.Symlink(filepath.Join(base, "test1"), filepath.Join(base, "test2/dir")); err != nil {
- return err
- }
- return nil
- },
- "test1/dir/dir/dir/dir/dir/dir/dir/foo",
- "test2/foo",
- defaultPerm,
- false,
- },
- {
- "danglink-symlink",
- func(base string) error {
- return os.Symlink("non-existing", filepath.Join(base, "test"))
- },
- "test/directory",
- "",
- defaultPerm,
- true,
- },
- {
- "non-directory",
- func(base string) error {
- return ioutil.WriteFile(filepath.Join(base, "test"), []byte{}, defaultPerm)
- },
- "test/directory",
- "",
- defaultPerm,
- true,
- },
- {
- "non-directory-final",
- func(base string) error {
- return ioutil.WriteFile(filepath.Join(base, "test"), []byte{}, defaultPerm)
- },
- "test",
- "",
- defaultPerm,
- true,
- },
- {
- "escape-with-relative-symlink",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "dir"), defaultPerm); err != nil {
- return err
- }
- if err := os.MkdirAll(filepath.Join(base, "exists"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("../exists", filepath.Join(base, "dir/test"))
- },
- "dir/test",
- "",
- defaultPerm,
- false,
- },
- {
- "escape-with-relative-symlink-not-exists",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "dir"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("../not-exists", filepath.Join(base, "dir/test"))
- },
- "dir/test",
- "",
- defaultPerm,
- true,
- },
- {
- "escape-with-symlink",
- func(base string) error {
- return os.Symlink("/", filepath.Join(base, "test"))
- },
- "test/directory",
- "",
- defaultPerm,
- true,
- },
- }
- for i := range tests {
- test := tests[i]
- t.Run(test.name, func(t *testing.T) {
- base, err := ioutil.TempDir("", "safe-make-dir-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- defer os.RemoveAll(base)
- test.prepare(base)
- pathToCreate := filepath.Join(base, test.path)
- err = doSafeMakeDir(pathToCreate, base, test.perm)
- if err != nil && !test.expectError {
- t.Fatal(err)
- }
- if err != nil {
- t.Logf("got error: %s", err)
- }
- if err == nil && test.expectError {
- t.Fatalf("expected error, got none")
- }
- if test.checkPath != "" {
- st, err := os.Stat(filepath.Join(base, test.checkPath))
- if err != nil {
- t.Fatalf("cannot read path %s", test.checkPath)
- }
- actualMode := st.Mode()
- if actualMode != test.perm {
- if actualMode^test.perm == os.ModeSetgid && test.perm&os.ModeSetgid == 0 {
- // when TMPDIR is a kubernetes emptydir, the sticky gid bit is set due to fsgroup
- t.Logf("masking bit from %o", actualMode)
- } else {
- t.Errorf("expected permissions %o, got %o (%b)", test.perm, actualMode, test.perm^actualMode)
- }
- }
- }
- })
- }
- }
- func TestRemoveEmptyDirs(t *testing.T) {
- defaultPerm := os.FileMode(0750)
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) error
- // Function that validates directory structure after the test
- validate func(base string) error
- baseDir string
- endDir string
- expectError bool
- }{
- {
- name: "all-empty",
- prepare: func(base string) error {
- return os.MkdirAll(filepath.Join(base, "a/b/c"), defaultPerm)
- },
- validate: func(base string) error {
- return validateDirEmpty(filepath.Join(base, "a"))
- },
- baseDir: "a",
- endDir: "a/b/c",
- expectError: false,
- },
- {
- name: "dir-not-empty",
- prepare: func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "a/b/c"), defaultPerm); err != nil {
- return err
- }
- return os.Mkdir(filepath.Join(base, "a/b/d"), defaultPerm)
- },
- validate: func(base string) error {
- if err := validateDirNotExists(filepath.Join(base, "a/b/c")); err != nil {
- return err
- }
- return validateDirExists(filepath.Join(base, "a/b"))
- },
- baseDir: "a",
- endDir: "a/b/c",
- expectError: false,
- },
- {
- name: "path-not-within-base",
- prepare: func(base string) error {
- return os.MkdirAll(filepath.Join(base, "a/b/c"), defaultPerm)
- },
- validate: func(base string) error {
- return validateDirExists(filepath.Join(base, "a"))
- },
- baseDir: "a",
- endDir: "b/c",
- expectError: true,
- },
- {
- name: "path-already-deleted",
- prepare: func(base string) error {
- return nil
- },
- validate: func(base string) error {
- return nil
- },
- baseDir: "a",
- endDir: "a/b/c",
- expectError: false,
- },
- {
- name: "path-not-dir",
- prepare: func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "a/b"), defaultPerm); err != nil {
- return err
- }
- return ioutil.WriteFile(filepath.Join(base, "a/b", "c"), []byte{}, defaultPerm)
- },
- validate: func(base string) error {
- if err := validateDirExists(filepath.Join(base, "a/b")); err != nil {
- return err
- }
- return validateFileExists(filepath.Join(base, "a/b/c"))
- },
- baseDir: "a",
- endDir: "a/b/c",
- expectError: true,
- },
- }
- for _, test := range tests {
- klog.V(4).Infof("test %q", test.name)
- base, err := ioutil.TempDir("", "remove-empty-dirs-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- if err = test.prepare(base); err != nil {
- os.RemoveAll(base)
- t.Fatalf("failed to prepare test %q: %v", test.name, err.Error())
- }
- err = removeEmptyDirs(filepath.Join(base, test.baseDir), filepath.Join(base, test.endDir))
- if err != nil && !test.expectError {
- t.Errorf("test %q failed: %v", test.name, err)
- }
- if err == nil && test.expectError {
- t.Errorf("test %q failed: expected error, got success", test.name)
- }
- if err = test.validate(base); err != nil {
- t.Errorf("test %q failed validation: %v", test.name, err)
- }
- os.RemoveAll(base)
- }
- }
- func TestCleanSubPaths(t *testing.T) {
- defaultPerm := os.FileMode(0750)
- testVol := "vol1"
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) ([]mount.MountPoint, error)
- // Function that validates directory structure after the test
- validate func(base string) error
- expectError bool
- unmount func(path string) error
- }{
- {
- name: "not-exists",
- prepare: func(base string) ([]mount.MountPoint, error) {
- return nil, nil
- },
- validate: func(base string) error {
- return nil
- },
- expectError: false,
- },
- {
- name: "subpath-not-mount",
- prepare: func(base string) ([]mount.MountPoint, error) {
- return nil, os.MkdirAll(filepath.Join(base, containerSubPathDirectoryName, testVol, "container1", "0"), defaultPerm)
- },
- validate: func(base string) error {
- return validateDirNotExists(filepath.Join(base, containerSubPathDirectoryName))
- },
- expectError: false,
- },
- {
- name: "subpath-file",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1")
- if err := os.MkdirAll(path, defaultPerm); err != nil {
- return nil, err
- }
- return nil, ioutil.WriteFile(filepath.Join(path, "0"), []byte{}, defaultPerm)
- },
- validate: func(base string) error {
- return validateDirNotExists(filepath.Join(base, containerSubPathDirectoryName))
- },
- expectError: false,
- },
- {
- name: "subpath-container-not-dir",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol)
- if err := os.MkdirAll(path, defaultPerm); err != nil {
- return nil, err
- }
- return nil, ioutil.WriteFile(filepath.Join(path, "container1"), []byte{}, defaultPerm)
- },
- validate: func(base string) error {
- return validateDirExists(filepath.Join(base, containerSubPathDirectoryName, testVol))
- },
- expectError: true,
- },
- {
- name: "subpath-multiple-container-not-dir",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol)
- if err := os.MkdirAll(filepath.Join(path, "container1"), defaultPerm); err != nil {
- return nil, err
- }
- return nil, ioutil.WriteFile(filepath.Join(path, "container2"), []byte{}, defaultPerm)
- },
- validate: func(base string) error {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol)
- if err := validateDirNotExists(filepath.Join(path, "container1")); err != nil {
- return err
- }
- return validateFileExists(filepath.Join(path, "container2"))
- },
- expectError: true,
- },
- {
- name: "subpath-mount",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1", "0")
- if err := os.MkdirAll(path, defaultPerm); err != nil {
- return nil, err
- }
- mounts := []mount.MountPoint{{Device: "/dev/sdb", Path: path}}
- return mounts, nil
- },
- validate: func(base string) error {
- return validateDirNotExists(filepath.Join(base, containerSubPathDirectoryName))
- },
- },
- {
- name: "subpath-mount-multiple",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1", "0")
- path2 := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1", "1")
- path3 := filepath.Join(base, containerSubPathDirectoryName, testVol, "container2", "1")
- if err := os.MkdirAll(path, defaultPerm); err != nil {
- return nil, err
- }
- if err := os.MkdirAll(path2, defaultPerm); err != nil {
- return nil, err
- }
- if err := os.MkdirAll(path3, defaultPerm); err != nil {
- return nil, err
- }
- mounts := []mount.MountPoint{
- {Device: "/dev/sdb", Path: path},
- {Device: "/dev/sdb", Path: path3},
- }
- return mounts, nil
- },
- validate: func(base string) error {
- return validateDirNotExists(filepath.Join(base, containerSubPathDirectoryName))
- },
- },
- {
- name: "subpath-mount-multiple-vols",
- prepare: func(base string) ([]mount.MountPoint, error) {
- path := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1", "0")
- path2 := filepath.Join(base, containerSubPathDirectoryName, "vol2", "container1", "1")
- if err := os.MkdirAll(path, defaultPerm); err != nil {
- return nil, err
- }
- if err := os.MkdirAll(path2, defaultPerm); err != nil {
- return nil, err
- }
- mounts := []mount.MountPoint{
- {Device: "/dev/sdb", Path: path},
- }
- return mounts, nil
- },
- validate: func(base string) error {
- baseSubdir := filepath.Join(base, containerSubPathDirectoryName)
- if err := validateDirNotExists(filepath.Join(baseSubdir, testVol)); err != nil {
- return err
- }
- return validateDirExists(baseSubdir)
- },
- },
- {
- name: "subpath-with-files",
- prepare: func(base string) ([]mount.MountPoint, error) {
- containerPath := filepath.Join(base, containerSubPathDirectoryName, testVol, "container1")
- if err := os.MkdirAll(containerPath, defaultPerm); err != nil {
- return nil, err
- }
- file0 := filepath.Join(containerPath, "0")
- if err := ioutil.WriteFile(file0, []byte{}, defaultPerm); err != nil {
- return nil, err
- }
- dir1 := filepath.Join(containerPath, "1")
- if err := os.MkdirAll(filepath.Join(dir1, "my-dir-1"), defaultPerm); err != nil {
- return nil, err
- }
- dir2 := filepath.Join(containerPath, "2")
- if err := os.MkdirAll(filepath.Join(dir2, "my-dir-2"), defaultPerm); err != nil {
- return nil, err
- }
- file3 := filepath.Join(containerPath, "3")
- if err := ioutil.WriteFile(file3, []byte{}, defaultPerm); err != nil {
- return nil, err
- }
- mounts := []mount.MountPoint{
- {Device: "/dev/sdb", Path: file0},
- {Device: "/dev/sdc", Path: dir1},
- {Device: "/dev/sdd", Path: dir2},
- {Device: "/dev/sde", Path: file3},
- }
- return mounts, nil
- },
- unmount: func(mountpath string) error {
- err := filepath.Walk(mountpath, func(path string, info os.FileInfo, err error) error {
- if path == mountpath {
- // Skip top level directory
- return nil
- }
- if err = os.Remove(path); err != nil {
- return err
- }
- return filepath.SkipDir
- })
- if err != nil {
- return fmt.Errorf("error processing %s: %s", mountpath, err)
- }
- return nil
- },
- validate: func(base string) error {
- return validateDirNotExists(filepath.Join(base, containerSubPathDirectoryName))
- },
- },
- }
- for _, test := range tests {
- klog.V(4).Infof("test %q", test.name)
- base, err := ioutil.TempDir("", "clean-subpaths-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- mounts, err := test.prepare(base)
- if err != nil {
- os.RemoveAll(base)
- t.Fatalf("failed to prepare test %q: %v", test.name, err.Error())
- }
- fm := mount.NewFakeMounter(mounts)
- fm.UnmountFunc = test.unmount
- err = doCleanSubPaths(fm, base, testVol)
- if err != nil && !test.expectError {
- t.Errorf("test %q failed: %v", test.name, err)
- }
- if err == nil && test.expectError {
- t.Errorf("test %q failed: expected error, got success", test.name)
- }
- if err = test.validate(base); err != nil {
- t.Errorf("test %q failed validation: %v", test.name, err)
- }
- os.RemoveAll(base)
- }
- }
- var (
- testVol = "vol1"
- testPod = "pod0"
- testContainer = "container0"
- testSubpath = 1
- )
- func setupFakeMounter(testMounts []string) *mount.FakeMounter {
- mounts := []mount.MountPoint{}
- for _, mountPoint := range testMounts {
- mounts = append(mounts, mount.MountPoint{Device: "/foo", Path: mountPoint})
- }
- return mount.NewFakeMounter(mounts)
- }
- func getTestPaths(base string) (string, string) {
- return filepath.Join(base, testVol),
- filepath.Join(base, testPod, containerSubPathDirectoryName, testVol, testContainer, strconv.Itoa(testSubpath))
- }
- func TestBindSubPath(t *testing.T) {
- defaultPerm := os.FileMode(0750)
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) ([]string, string, string, error)
- expectError bool
- }{
- {
- name: "subpath-dir",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "dir0")
- return nil, volpath, subpath, os.MkdirAll(subpath, defaultPerm)
- },
- expectError: false,
- },
- {
- name: "subpath-dir-symlink",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "dir0")
- if err := os.MkdirAll(subpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- subpathLink := filepath.Join(volpath, "dirLink")
- return nil, volpath, subpath, os.Symlink(subpath, subpathLink)
- },
- expectError: false,
- },
- {
- name: "subpath-file",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "file0")
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- return nil, volpath, subpath, ioutil.WriteFile(subpath, []byte{}, defaultPerm)
- },
- expectError: false,
- },
- {
- name: "subpath-not-exists",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "file0")
- return nil, volpath, subpath, nil
- },
- expectError: true,
- },
- {
- name: "subpath-outside",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "dir0")
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- return nil, volpath, subpath, os.Symlink(base, subpath)
- },
- expectError: true,
- },
- {
- name: "subpath-symlink-child-outside",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpathDir := filepath.Join(volpath, "dir0")
- subpath := filepath.Join(subpathDir, "child0")
- if err := os.MkdirAll(subpathDir, defaultPerm); err != nil {
- return nil, "", "", err
- }
- return nil, volpath, subpath, os.Symlink(base, subpath)
- },
- expectError: true,
- },
- {
- name: "subpath-child-outside-exists",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpathDir := filepath.Join(volpath, "dir0")
- child := filepath.Join(base, "child0")
- subpath := filepath.Join(subpathDir, "child0")
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // touch file outside
- if err := ioutil.WriteFile(child, []byte{}, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // create symlink for subpath dir
- return nil, volpath, subpath, os.Symlink(base, subpathDir)
- },
- expectError: true,
- },
- {
- name: "subpath-child-outside-not-exists",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpathDir := filepath.Join(volpath, "dir0")
- subpath := filepath.Join(subpathDir, "child0")
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // create symlink for subpath dir
- return nil, volpath, subpath, os.Symlink(base, subpathDir)
- },
- expectError: true,
- },
- {
- name: "subpath-child-outside-exists-middle-dir-symlink",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpathDir := filepath.Join(volpath, "dir0")
- symlinkDir := filepath.Join(subpathDir, "linkDir0")
- child := filepath.Join(base, "child0")
- subpath := filepath.Join(symlinkDir, "child0")
- if err := os.MkdirAll(subpathDir, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // touch file outside
- if err := ioutil.WriteFile(child, []byte{}, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // create symlink for middle dir
- return nil, volpath, subpath, os.Symlink(base, symlinkDir)
- },
- expectError: true,
- },
- {
- name: "subpath-backstepping",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, _ := getTestPaths(base)
- subpath := filepath.Join(volpath, "dir0")
- symlinkBase := filepath.Join(volpath, "..")
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- // create symlink for subpath
- return nil, volpath, subpath, os.Symlink(symlinkBase, subpath)
- },
- expectError: true,
- },
- {
- name: "subpath-mountdir-already-exists",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, subpathMount := getTestPaths(base)
- if err := os.MkdirAll(subpathMount, defaultPerm); err != nil {
- return nil, "", "", err
- }
- subpath := filepath.Join(volpath, "dir0")
- return nil, volpath, subpath, os.MkdirAll(subpath, defaultPerm)
- },
- expectError: false,
- },
- {
- name: "subpath-mount-already-exists",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, subpathMount := getTestPaths(base)
- mounts := []string{subpathMount}
- if err := os.MkdirAll(subpathMount, defaultPerm); err != nil {
- return nil, "", "", err
- }
- subpath := filepath.Join(volpath, "dir0")
- return mounts, volpath, subpath, os.MkdirAll(subpath, defaultPerm)
- },
- expectError: false,
- },
- {
- name: "mount-unix-socket",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, subpathMount := getTestPaths(base)
- mounts := []string{subpathMount}
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- socketFile, socketCreateError := createSocketFile(volpath)
- return mounts, volpath, socketFile, socketCreateError
- },
- expectError: false,
- },
- {
- name: "subpath-mounting-fifo",
- prepare: func(base string) ([]string, string, string, error) {
- volpath, subpathMount := getTestPaths(base)
- mounts := []string{subpathMount}
- if err := os.MkdirAll(volpath, defaultPerm); err != nil {
- return nil, "", "", err
- }
- testFifo := filepath.Join(volpath, "mount_test.fifo")
- err := syscall.Mkfifo(testFifo, 0)
- return mounts, volpath, testFifo, err
- },
- expectError: false,
- },
- }
- for _, test := range tests {
- klog.V(4).Infof("test %q", test.name)
- base, err := ioutil.TempDir("", "bind-subpath-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- mounts, volPath, subPath, err := test.prepare(base)
- if err != nil {
- os.RemoveAll(base)
- t.Fatalf("failed to prepare test %q: %v", test.name, err.Error())
- }
- fm := setupFakeMounter(mounts)
- subpath := Subpath{
- VolumeMountIndex: testSubpath,
- Path: subPath,
- VolumeName: testVol,
- VolumePath: volPath,
- PodDir: filepath.Join(base, "pod0"),
- ContainerName: testContainer,
- }
- _, subpathMount := getTestPaths(base)
- bindPathTarget, err := doBindSubPath(fm, subpath)
- if test.expectError {
- if err == nil {
- t.Errorf("test %q failed: expected error, got success", test.name)
- }
- if bindPathTarget != "" {
- t.Errorf("test %q failed: expected empty bindPathTarget, got %v", test.name, bindPathTarget)
- }
- if err = validateDirNotExists(subpathMount); err != nil {
- t.Errorf("test %q failed: %v", test.name, err)
- }
- }
- if !test.expectError {
- if err != nil {
- t.Errorf("test %q failed: %v", test.name, err)
- }
- if bindPathTarget != subpathMount {
- t.Errorf("test %q failed: expected bindPathTarget %v, got %v", test.name, subpathMount, bindPathTarget)
- }
- if err = validateFileExists(subpathMount); err != nil {
- t.Errorf("test %q failed: %v", test.name, err)
- }
- }
- os.RemoveAll(base)
- }
- }
- func TestSafeOpen(t *testing.T) {
- defaultPerm := os.FileMode(0750)
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) error
- path string
- expectError bool
- }{
- {
- "directory-does-not-exist",
- func(base string) error {
- return nil
- },
- "test/directory",
- true,
- },
- {
- "directory-exists",
- func(base string) error {
- return os.MkdirAll(filepath.Join(base, "test/directory"), 0750)
- },
- "test/directory",
- false,
- },
- {
- "escape-base-using-dots",
- func(base string) error {
- return nil
- },
- "..",
- true,
- },
- {
- "escape-base-using-dots-2",
- func(base string) error {
- return os.MkdirAll(filepath.Join(base, "test"), 0750)
- },
- "test/../../..",
- true,
- },
- {
- "symlink",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "destination"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("destination", filepath.Join(base, "test"))
- },
- "test",
- true,
- },
- {
- "symlink-nested",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "dir1/dir2"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("dir1", filepath.Join(base, "dir1/dir2/test"))
- },
- "test",
- true,
- },
- {
- "symlink-loop",
- func(base string) error {
- return os.Symlink("test", filepath.Join(base, "test"))
- },
- "test",
- true,
- },
- {
- "symlink-not-exists",
- func(base string) error {
- return os.Symlink("non-existing", filepath.Join(base, "test"))
- },
- "test",
- true,
- },
- {
- "non-directory",
- func(base string) error {
- return ioutil.WriteFile(filepath.Join(base, "test"), []byte{}, defaultPerm)
- },
- "test/directory",
- true,
- },
- {
- "non-directory-final",
- func(base string) error {
- return ioutil.WriteFile(filepath.Join(base, "test"), []byte{}, defaultPerm)
- },
- "test",
- false,
- },
- {
- "escape-with-relative-symlink",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "dir"), defaultPerm); err != nil {
- return err
- }
- if err := os.MkdirAll(filepath.Join(base, "exists"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("../exists", filepath.Join(base, "dir/test"))
- },
- "dir/test",
- true,
- },
- {
- "escape-with-relative-symlink-not-exists",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "dir"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("../not-exists", filepath.Join(base, "dir/test"))
- },
- "dir/test",
- true,
- },
- {
- "escape-with-symlink",
- func(base string) error {
- return os.Symlink("/", filepath.Join(base, "test"))
- },
- "test",
- true,
- },
- {
- "mount-unix-socket",
- func(base string) error {
- socketFile, socketError := createSocketFile(base)
- if socketError != nil {
- return fmt.Errorf("Error preparing socket file %s with %v", socketFile, socketError)
- }
- return nil
- },
- "mt.sock",
- false,
- },
- {
- "mounting-unix-socket-in-middle",
- func(base string) error {
- testSocketFile, socketError := createSocketFile(base)
- if socketError != nil {
- return fmt.Errorf("Error preparing socket file %s with %v", testSocketFile, socketError)
- }
- return nil
- },
- "mt.sock/bar",
- true,
- },
- }
- for _, test := range tests {
- klog.V(4).Infof("test %q", test.name)
- base, err := ioutil.TempDir("", "safe-open-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- test.prepare(base)
- pathToCreate := filepath.Join(base, test.path)
- fd, err := doSafeOpen(pathToCreate, base)
- if err != nil && !test.expectError {
- t.Errorf("test %q: %s", test.name, err)
- }
- if err != nil {
- klog.Infof("got error: %s", err)
- }
- if err == nil && test.expectError {
- t.Errorf("test %q: expected error, got none", test.name)
- }
- syscall.Close(fd)
- os.RemoveAll(base)
- }
- }
- func createSocketFile(socketDir string) (string, error) {
- testSocketFile := filepath.Join(socketDir, "mt.sock")
- // Switch to volume path and create the socket file
- // socket file can not have length of more than 108 character
- // and hence we must use relative path
- oldDir, _ := os.Getwd()
- err := os.Chdir(socketDir)
- if err != nil {
- return "", err
- }
- defer func() {
- os.Chdir(oldDir)
- }()
- _, socketCreateError := net.Listen("unix", "mt.sock")
- return testSocketFile, socketCreateError
- }
- func TestFindExistingPrefix(t *testing.T) {
- defaultPerm := os.FileMode(0750)
- tests := []struct {
- name string
- // Function that prepares directory structure for the test under given
- // base.
- prepare func(base string) error
- path string
- expectedPath string
- expectedDirs []string
- expectError bool
- }{
- {
- "directory-does-not-exist",
- func(base string) error {
- return nil
- },
- "directory",
- "",
- []string{"directory"},
- false,
- },
- {
- "directory-exists",
- func(base string) error {
- return os.MkdirAll(filepath.Join(base, "test/directory"), 0750)
- },
- "test/directory",
- "test/directory",
- []string{},
- false,
- },
- {
- "follow-symlinks",
- func(base string) error {
- if err := os.MkdirAll(filepath.Join(base, "destination/directory"), defaultPerm); err != nil {
- return err
- }
- return os.Symlink("destination", filepath.Join(base, "test"))
- },
- "test/directory",
- "test/directory",
- []string{},
- false,
- },
- {
- "follow-symlink-loop",
- func(base string) error {
- return os.Symlink("test", filepath.Join(base, "test"))
- },
- "test/directory",
- "",
- nil,
- true,
- },
- {
- "follow-symlink-multiple follow",
- func(base string) error {
- /* test1/dir points to test2 and test2/dir points to test1 */
- if err := os.MkdirAll(filepath.Join(base, "test1"), defaultPerm); err != nil {
- return err
- }
- if err := os.MkdirAll(filepath.Join(base, "test2"), defaultPerm); err != nil {
- return err
- }
- if err := os.Symlink(filepath.Join(base, "test2"), filepath.Join(base, "test1/dir")); err != nil {
- return err
- }
- if err := os.Symlink(filepath.Join(base, "test1"), filepath.Join(base, "test2/dir")); err != nil {
- return err
- }
- return nil
- },
- "test1/dir/dir/foo/bar",
- "test1/dir/dir",
- []string{"foo", "bar"},
- false,
- },
- {
- "danglink-symlink",
- func(base string) error {
- return os.Symlink("non-existing", filepath.Join(base, "test"))
- },
- // OS returns IsNotExist error both for dangling symlink and for
- // non-existing directory.
- "test/directory",
- "",
- []string{"test", "directory"},
- false,
- },
- {
- "with-fifo-in-middle",
- func(base string) error {
- testFifo := filepath.Join(base, "mount_test.fifo")
- return syscall.Mkfifo(testFifo, 0)
- },
- "mount_test.fifo/directory",
- "",
- nil,
- true,
- },
- }
- for _, test := range tests {
- klog.V(4).Infof("test %q", test.name)
- base, err := ioutil.TempDir("", "find-prefix-"+test.name+"-")
- if err != nil {
- t.Fatalf(err.Error())
- }
- test.prepare(base)
- path := filepath.Join(base, test.path)
- existingPath, dirs, err := findExistingPrefix(base, path)
- if err != nil && !test.expectError {
- t.Errorf("test %q: %s", test.name, err)
- }
- if err != nil {
- klog.Infof("got error: %s", err)
- }
- if err == nil && test.expectError {
- t.Errorf("test %q: expected error, got none", test.name)
- }
- fullExpectedPath := filepath.Join(base, test.expectedPath)
- if existingPath != fullExpectedPath {
- t.Errorf("test %q: expected path %q, got %q", test.name, fullExpectedPath, existingPath)
- }
- if !reflect.DeepEqual(dirs, test.expectedDirs) {
- t.Errorf("test %q: expected dirs %v, got %v", test.name, test.expectedDirs, dirs)
- }
- os.RemoveAll(base)
- }
- }
- func validateDirEmpty(dir string) error {
- files, err := ioutil.ReadDir(dir)
- if err != nil {
- return err
- }
- if len(files) != 0 {
- return fmt.Errorf("Directory %q is not empty", dir)
- }
- return nil
- }
- func validateDirExists(dir string) error {
- _, err := ioutil.ReadDir(dir)
- if err != nil {
- return err
- }
- return nil
- }
- func validateDirNotExists(dir string) error {
- _, err := ioutil.ReadDir(dir)
- if os.IsNotExist(err) {
- return nil
- }
- if err != nil {
- return err
- }
- return fmt.Errorf("dir %q still exists", dir)
- }
- func validateFileExists(file string) error {
- if _, err := os.Stat(file); err != nil {
- return err
- }
- return nil
- }
|