You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by ti...@apache.org on 2016/06/16 19:42:25 UTC
[3/4] mesos git commit: Added tests for sandbox authorization.
Added tests for sandbox authorization.
We add tests for checking whether the LocalAuthorizer authorizes
sandbox access as expected. Furthermore we extend the
'Get_ExecutorInfo' test to check for correct copying of fields
which are relevant to authorization.
Review: https://reviews.apache.org/r/48789/
Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/9aa14af3
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/9aa14af3
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/9aa14af3
Branch: refs/heads/master
Commit: 9aa14af3b7e151c624b30b9b7c197bc04e25cf80
Parents: dce0845
Author: Joerg Schad <jo...@mesosphere.io>
Authored: Thu Jun 16 20:05:29 2016 +0200
Committer: Till Toenshoff <to...@me.com>
Committed: Thu Jun 16 21:24:46 2016 +0200
----------------------------------------------------------------------
src/tests/authorization_tests.cpp | 154 +++++++++++++++++++++++++++++++++
src/tests/slave_tests.cpp | 16 ++++
2 files changed, 170 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mesos/blob/9aa14af3/src/tests/authorization_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/authorization_tests.cpp b/src/tests/authorization_tests.cpp
index ef49ec6..c133f52 100644
--- a/src/tests/authorization_tests.cpp
+++ b/src/tests/authorization_tests.cpp
@@ -2103,6 +2103,160 @@ TYPED_TEST(AuthorizationTest, ViewExecutor)
}
+// This tests the authorization of sandboxe access.
+TYPED_TEST(AuthorizationTest, SandBoxAccess)
+{
+ // Setup ACLs.
+ ACLs acls;
+
+ {
+ // "foo" principal cannot view any sandboxes.
+ mesos::ACL::AccessSandbox* acl = acls.add_access_sandboxes();
+ acl->mutable_principals()->add_values("foo");
+ acl->mutable_users()->set_type(mesos::ACL::Entity::NONE);
+ }
+
+ {
+ // "bar" principal can see sandboxes running under user "bar".
+ mesos::ACL::AccessSandbox* acl = acls.add_access_sandboxes();
+ acl->mutable_principals()->add_values("bar");
+ acl->mutable_users()->add_values("bar");
+ }
+
+ {
+ // "ops" principal can see all sandboxes.
+ mesos::ACL::AccessSandbox* acl = acls.add_access_sandboxes();
+ acl->mutable_principals()->add_values("ops");
+ acl->mutable_users()->set_type(mesos::ACL::Entity::ANY);
+ }
+
+ {
+ // No one else can view any sandboxes.
+ mesos::ACL::AccessSandbox* acl = acls.add_access_sandboxes();
+ acl->mutable_principals()->set_type(mesos::ACL::Entity::ANY);
+ acl->mutable_users()->set_type(mesos::ACL::Entity::NONE);
+ }
+
+ // Create an `Authorizer` with the ACLs.
+ Try<Authorizer*> create = TypeParam::create(parameterize(acls));
+ ASSERT_SOME(create);
+ Owned<Authorizer> authorizer(create.get());
+
+ // Create ExecutorInfo with a user not mentioned in the ACLs in
+ // command as object to be authorized.
+ ExecutorInfo executorInfo;
+ {
+ executorInfo.set_name("Task");
+ executorInfo.mutable_executor_id()->set_value("t");
+ executorInfo.mutable_command()->set_value("echo hello");
+ executorInfo.mutable_command()->set_user("user");
+ }
+
+ // Create ExecutorInfo with user "bar" in command as object to
+ // be authorized.
+ ExecutorInfo executorInfoBar;
+ {
+ executorInfoBar.set_name("Executor");
+ executorInfoBar.mutable_executor_id()->set_value("e");
+ executorInfoBar.mutable_command()->set_value("echo hello");
+ executorInfoBar.mutable_command()->set_user("bar");
+ }
+
+ // Create ExecutorInfo with no user in command as object to
+ // be authorized.
+ ExecutorInfo executorInfoNoUser;
+ {
+ executorInfoNoUser.set_name("Executor");
+ executorInfoNoUser.mutable_executor_id()->set_value("e");
+ executorInfoNoUser.mutable_command()->set_value("echo hello");
+ }
+
+ // Create FrameworkInfo with a generic user as object to authorized.
+ FrameworkInfo frameworkInfo;
+ {
+ frameworkInfo.set_user("user");
+ frameworkInfo.set_name("f");
+ }
+
+ // Create FrameworkInfo with user "bar" as object to authorized.
+ FrameworkInfo frameworkInfoBar;
+ {
+ frameworkInfoBar.set_user("bar");
+ frameworkInfoBar.set_name("f");
+ }
+
+ // Principal "foo" cannot access a sandbox with a request with
+ // ExecutorInfo and FrameworkInfo running with user "user".
+ {
+ authorization::Request request;
+ request.set_action(authorization::ACCESS_SANDBOX);
+ request.mutable_subject()->set_value("foo");
+ request.mutable_object()->mutable_executor_info()->MergeFrom(executorInfo);
+ request.mutable_object()->mutable_framework_info()->MergeFrom(
+ frameworkInfo);
+
+ AWAIT_EXPECT_FALSE(authorizer.get()->authorized(request));
+ }
+
+ // Principal "bar" cannot access a sandbox with a request with
+ // ExecutorInfo and FrameworkInfo running with user "user".
+ {
+ authorization::Request request;
+ request.set_action(authorization::ACCESS_SANDBOX);
+ request.mutable_subject()->set_value("bar");
+ request.mutable_object()->mutable_executor_info()->MergeFrom(executorInfo);
+ request.mutable_object()->mutable_framework_info()->MergeFrom(
+ frameworkInfo);
+
+ AWAIT_EXPECT_FALSE(authorizer.get()->authorized(request));
+ }
+
+ // Principal "ops" can access a sandbox with a request with
+ // ExecutorInfo and FrameworkInfo running with user "user".
+ {
+ authorization::Request request;
+ request.set_action(authorization::ACCESS_SANDBOX);
+ request.mutable_subject()->set_value("ops");
+ request.mutable_object()->mutable_executor_info()->MergeFrom(executorInfo);
+ request.mutable_object()->mutable_framework_info()->MergeFrom(
+ frameworkInfo);
+
+ AWAIT_EXPECT_TRUE(authorizer.get()->authorized(request));
+ }
+
+ // Principal "bar" can access a sandbox with a request with
+ // ExecutorInfo and FrameworkInfo running with user "bar".
+ {
+ authorization::Request request;
+ request.set_action(authorization::ACCESS_SANDBOX);
+ request.mutable_subject()->set_value("bar");
+ request.mutable_object()->mutable_executor_info()->MergeFrom(
+ executorInfoBar);
+
+ request.mutable_object()->mutable_framework_info()->MergeFrom(
+ frameworkInfoBar);
+
+ AWAIT_EXPECT_TRUE(authorizer.get()->authorized(request));
+ }
+
+ // Principal "bar" can access a sandbox with a request with a
+ // ExecutorInfo without user and FrameworkInfo running with user
+ // "bar".
+ {
+ authorization::Request request;
+ request.set_action(authorization::ACCESS_SANDBOX);
+ request.mutable_subject()->set_value("bar");
+ request.mutable_object()->mutable_executor_info()->MergeFrom(
+ executorInfoNoUser);
+
+ request.mutable_object()->mutable_framework_info()->MergeFrom(
+ frameworkInfoBar);
+
+ AWAIT_EXPECT_TRUE(authorizer.get()->authorized(request));
+ }
+}
+
+
// This tests that a missing request.object is allowed for an ACL whose
// Object is ANY.
// NOTE: The only usecase for this behavior is currently teardownFramework.
http://git-wip-us.apache.org/repos/asf/mesos/blob/9aa14af3/src/tests/slave_tests.cpp
----------------------------------------------------------------------
diff --git a/src/tests/slave_tests.cpp b/src/tests/slave_tests.cpp
index 7ba03e8..12be60c 100644
--- a/src/tests/slave_tests.cpp
+++ b/src/tests/slave_tests.cpp
@@ -663,12 +663,28 @@ TEST_F(SlaveTest, GetExecutorInfo)
task.mutable_command()->MergeFrom(command);
+ DiscoveryInfo* info = task.mutable_discovery();
+ info->set_visibility(DiscoveryInfo::EXTERNAL);
+ info->set_name("mytask");
+ info->set_environment("mytest");
+ info->set_location("mylocation");
+ info->set_version("v0.1.1");
+
+ Labels* labels = task.mutable_labels();
+ labels->add_labels()->CopyFrom(createLabel("label1", "key1"));
+ labels->add_labels()->CopyFrom(createLabel("label2", "key2"));
+
const ExecutorInfo& executor = slave.getExecutorInfo(frameworkInfo, task);
// Now assert that it actually is running mesos-executor without any
// bleedover from the command we intend on running.
EXPECT_TRUE(executor.command().shell());
EXPECT_EQ(0, executor.command().arguments_size());
+ ASSERT_TRUE(executor.has_labels());
+ EXPECT_EQ(2, executor.labels().labels_size());
+ ASSERT_TRUE(executor.has_discovery());
+ ASSERT_TRUE(executor.discovery().has_name());
+ EXPECT_EQ("mytask", executor.discovery().name());
EXPECT_NE(string::npos, executor.command().value().find("mesos-executor"));
}