You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by ji...@apache.org on 2017/06/14 19:11:45 UTC
[1/2] mesos git commit: Ensure that host /etc/* files are mounted
RDONLY by the CNI Isolator.
Repository: mesos
Updated Branches:
refs/heads/master 8a8e4ba5f -> 9fc047c29
Ensure that host /etc/* files are mounted RDONLY by the CNI Isolator.
Review: https://reviews.apache.org/r/57884/
Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/d3d04772
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/d3d04772
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/d3d04772
Branch: refs/heads/master
Commit: d3d04772e7408846019e2ea6704f53921d60f04e
Parents: 8a8e4ba
Author: Silas Snider <sw...@apple.com>
Authored: Wed Jun 14 10:24:23 2017 -0700
Committer: Jie Yu <yu...@gmail.com>
Committed: Wed Jun 14 10:24:23 2017 -0700
----------------------------------------------------------------------
.../mesos/isolators/network/cni/cni.cpp | 35 ++++++++++++++++++++
.../mesos/isolators/network/cni/cni.hpp | 1 +
2 files changed, 36 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mesos/blob/d3d04772/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp b/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
index 3aecd8c..b386fbe 100644
--- a/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
+++ b/src/slave/containerizer/mesos/isolators/network/cni/cni.cpp
@@ -763,6 +763,7 @@ Future<Nothing> NetworkCniIsolatorProcess::isolate(
CHECK(infos[containerId]->rootfs.isSome());
NetworkCniIsolatorSetup setup;
+ setup.flags.bind_readonly = true;
setup.flags.pid = pid;
setup.flags.rootfs = infos[containerId]->rootfs;
@@ -1779,6 +1780,12 @@ NetworkCniIsolatorSetup::Flags::Flags()
"Bind mount the container's network files to the network files "
"present on host filesystem",
false);
+
+ add(&Flags::bind_readonly,
+ "bind_readonly",
+ "Bind mount the container's network files read-only to protect the "
+ "originals",
+ false);
}
@@ -1914,6 +1921,20 @@ int NetworkCniIsolatorSetup::execute()
<< file << "': " << mount.error() << endl;
return EXIT_FAILURE;
}
+
+ if (flags.bind_readonly) {
+ mount = fs::mount(
+ source,
+ file,
+ None(),
+ MS_RDONLY | MS_REMOUNT | MS_BIND,
+ nullptr);
+ if (mount.isError()) {
+ cerr << "Failed to remount bind mount as readonly from '" << source
+ << "' to '" << file << "': " << mount.error() << endl;
+ return EXIT_FAILURE;
+ }
+ }
}
// Do the bind mount in the container filesystem.
@@ -1964,6 +1985,20 @@ int NetworkCniIsolatorSetup::execute()
<< target << "': " << mount.error() << endl;
return EXIT_FAILURE;
}
+
+ if (flags.bind_readonly) {
+ mount = fs::mount(
+ source,
+ target,
+ None(),
+ MS_RDONLY | MS_REMOUNT | MS_BIND,
+ nullptr);
+ if (mount.isError()) {
+ cerr << "Failed to remount bind mount as readonly from '" << source
+ << "' to '" << target << "': " << mount.error() << endl;
+ return EXIT_FAILURE;
+ }
+ }
}
}
http://git-wip-us.apache.org/repos/asf/mesos/blob/d3d04772/src/slave/containerizer/mesos/isolators/network/cni/cni.hpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/network/cni/cni.hpp b/src/slave/containerizer/mesos/isolators/network/cni/cni.hpp
index 36217d2..a04700b 100644
--- a/src/slave/containerizer/mesos/isolators/network/cni/cni.hpp
+++ b/src/slave/containerizer/mesos/isolators/network/cni/cni.hpp
@@ -229,6 +229,7 @@ public:
Option<std::string> etc_hostname_path;
Option<std::string> etc_resolv_conf;
bool bind_host_files;
+ bool bind_readonly;
};
NetworkCniIsolatorSetup() : Subcommand(NAME) {}
[2/2] mesos git commit: Test that bind-mounted host network
configuration is mounted readonly.
Posted by ji...@apache.org.
Test that bind-mounted host network configuration is mounted readonly.
Review: https://reviews.apache.org/r/58250/
Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/9fc047c2
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/9fc047c2
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/9fc047c2
Branch: refs/heads/master
Commit: 9fc047c299223440d70c626241ff2903b9fdfd12
Parents: d3d0477
Author: Silas Snider <sw...@apple.com>
Authored: Wed Jun 14 12:07:38 2017 -0700
Committer: Jie Yu <yu...@gmail.com>
Committed: Wed Jun 14 12:08:40 2017 -0700
----------------------------------------------------------------------
src/tests/containerizer/cni_isolator_tests.cpp | 87 +++++++++++++++++++++
1 file changed, 87 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mesos/blob/9fc047c2/src/tests/containerizer/cni_isolator_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/containerizer/cni_isolator_tests.cpp b/src/tests/containerizer/cni_isolator_tests.cpp
index 3a5f4eb..505439f 100644
--- a/src/tests/containerizer/cni_isolator_tests.cpp
+++ b/src/tests/containerizer/cni_isolator_tests.cpp
@@ -1445,6 +1445,93 @@ TEST_F(CniIsolatorPortMapperTest, ROOT_INTERNET_CURL_PortMapper)
driver.join();
}
+
+// This test launches a container which has an image and joins host
+// network, and then verifies that /etc/hosts and friends are mounted
+// read-only.
+TEST_F(CniIsolatorTest, ROOT_INTERNET_CURL_ReadOnlyBindMounts)
+{
+ Try<Owned<cluster::Master>> master = StartMaster();
+ ASSERT_SOME(master);
+
+ slave::Flags flags = CreateSlaveFlags();
+ flags.isolation = "docker/runtime,filesystem/linux";
+ flags.image_providers = "docker";
+ flags.docker_store_dir = path::join(sandbox.get(), "store");
+
+ Owned<MasterDetector> detector = master.get()->createDetector();
+
+ Try<Owned<cluster::Slave>> slave = StartSlave(detector.get(), flags);
+ ASSERT_SOME(slave);
+
+ MockScheduler sched;
+ MesosSchedulerDriver driver(
+ &sched,
+ DEFAULT_FRAMEWORK_INFO,
+ master.get()->pid,
+ DEFAULT_CREDENTIAL);
+
+ EXPECT_CALL(sched, registered(&driver, _, _));
+
+ Future<vector<Offer>> offers;
+ EXPECT_CALL(sched, resourceOffers(&driver, _))
+ .WillOnce(FutureArg<1>(&offers))
+ .WillRepeatedly(Return()); // Ignore subsequent offers.
+
+ driver.start();
+
+ AWAIT_READY(offers);
+ ASSERT_EQ(1u, offers->size());
+
+ const Offer& offer = offers.get()[0];
+
+ // NOTE: We use a non-shell command here because 'sh' might not be
+ // in the PATH. 'alpine' does not specify env PATH in the image.
+ CommandInfo command;
+ command.set_shell(false);
+ command.set_value("/bin/ash");
+ command.add_arguments("ash");
+ command.add_arguments("-c");
+ command.add_arguments(
+ "if echo '#sometext' >> /etc/resolv.conf; then"
+ " exit 1; "
+ "else"
+ " exit 0; "
+ "fi");
+
+ TaskInfo task = createTask(
+ offer.slave_id(),
+ Resources::parse("cpus:1;mem:128").get(),
+ command);
+
+ Image image;
+ image.set_type(Image::DOCKER);
+ image.mutable_docker()->set_name("alpine");
+
+ ContainerInfo* container = task.mutable_container();
+ container->set_type(ContainerInfo::MESOS);
+ container->mutable_mesos()->mutable_image()->CopyFrom(image);
+
+ Future<TaskStatus> statusRunning;
+ Future<TaskStatus> statusFinished;
+ EXPECT_CALL(sched, statusUpdate(&driver, _))
+ .WillOnce(FutureArg<1>(&statusRunning))
+ .WillOnce(FutureArg<1>(&statusFinished));
+
+ driver.launchTasks(offer.id(), {task});
+
+ AWAIT_READY_FOR(statusRunning, Seconds(60));
+ EXPECT_EQ(task.task_id(), statusRunning->task_id());
+ EXPECT_EQ(TASK_RUNNING, statusRunning->state());
+
+ AWAIT_READY(statusFinished);
+ EXPECT_EQ(task.task_id(), statusFinished->task_id());
+ EXPECT_EQ(TASK_FINISHED, statusFinished->state());
+
+ driver.stop();
+ driver.join();
+}
+
} // namespace tests {
} // namespace internal {
} // namespace mesos {