mirror of
https://github.com/opencontainers/runc.git
synced 2025-09-26 19:41:35 +08:00
382eba4354
The new mount option "rro" makes the mount point recursively read-only, by calling `mount_setattr(2)` with `MOUNT_ATTR_RDONLY` and `AT_RECURSIVE`. https://man7.org/linux/man-pages/man2/mount_setattr.2.html Requires kernel >= 5.12. The "rro" option string conforms to the proposal in util-linux/util-linux Issue 1501. Fix issue 2823 Similary, this commit also adds the following mount options: - rrw - r[no]{suid,dev,exec,relatime,atime,strictatime,diratime,symfollow} Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
79 lines
2.0 KiB
Bash
79 lines
2.0 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
TESTVOLUME="${BATS_RUN_TMPDIR}/mounts_recursive"
|
|
|
|
function setup_volume() {
|
|
# requires root (in the current user namespace) to mount tmpfs outside runc
|
|
requires root
|
|
|
|
mkdir -p "${TESTVOLUME}"
|
|
mount -t tmpfs none "${TESTVOLUME}"
|
|
echo "foo" >"${TESTVOLUME}/foo"
|
|
|
|
mkdir "${TESTVOLUME}/subvol"
|
|
mount -t tmpfs none "${TESTVOLUME}/subvol"
|
|
echo "bar" >"${TESTVOLUME}/subvol/bar"
|
|
}
|
|
|
|
function teardown_volume() {
|
|
umount -R "${TESTVOLUME}"
|
|
}
|
|
|
|
function setup() {
|
|
setup_volume
|
|
setup_busybox
|
|
}
|
|
|
|
function teardown() {
|
|
teardown_volume
|
|
teardown_bundle
|
|
}
|
|
|
|
@test "runc run [rbind,ro mount is read-only but not recursively]" {
|
|
update_config ".mounts += [{source: \"${TESTVOLUME}\" , destination: \"/mnt\", options: [\"rbind\",\"ro\"]}]"
|
|
|
|
runc run -d --console-socket "$CONSOLE_SOCKET" test_rbind_ro
|
|
[ "$status" -eq 0 ]
|
|
|
|
runc exec test_rbind_ro touch /mnt/foo
|
|
[ "$status" -eq 1 ]
|
|
[[ "${output}" == *"Read-only file system"* ]]
|
|
|
|
runc exec test_rbind_ro touch /mnt/subvol/bar
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "runc run [rbind,rro mount is recursively read-only]" {
|
|
requires_kernel 5.12
|
|
update_config ".mounts += [{source: \"${TESTVOLUME}\" , destination: \"/mnt\", options: [\"rbind\",\"rro\"]}]"
|
|
|
|
runc run -d --console-socket "$CONSOLE_SOCKET" test_rbind_rro
|
|
[ "$status" -eq 0 ]
|
|
|
|
runc exec test_rbind_rro touch /mnt/foo
|
|
[ "$status" -eq 1 ]
|
|
[[ "${output}" == *"Read-only file system"* ]]
|
|
|
|
runc exec test_rbind_rro touch /mnt/subvol/bar
|
|
[ "$status" -eq 1 ]
|
|
[[ "${output}" == *"Read-only file system"* ]]
|
|
}
|
|
|
|
@test "runc run [rbind,ro,rro mount is recursively read-only too]" {
|
|
requires_kernel 5.12
|
|
update_config ".mounts += [{source: \"${TESTVOLUME}\" , destination: \"/mnt\", options: [\"rbind\",\"ro\",\"rro\"]}]"
|
|
|
|
runc run -d --console-socket "$CONSOLE_SOCKET" test_rbind_ro_rro
|
|
[ "$status" -eq 0 ]
|
|
|
|
runc exec test_rbind_ro_rro touch /mnt/foo
|
|
[ "$status" -eq 1 ]
|
|
[[ "${output}" == *"Read-only file system"* ]]
|
|
|
|
runc exec test_rbind_ro_rro touch /mnt/subvol/bar
|
|
[ "$status" -eq 1 ]
|
|
[[ "${output}" == *"Read-only file system"* ]]
|
|
}
|