scottk/kubernetes
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/kubernetes.git synced 2025-11-03 19:58:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #46725 from timstclair/apparmor-debug

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 46620, 46732, 46773, 46772, 46725)

Fix AppArmor test for docker 1.13

... & better debugging.

The issue is that we run the pod containers in a shared PID namespace with docker 1.13, so PID 1 is no longer the container's root process. Since it's messy to get the container's root process, I switched to using `/proc/self` to read the apparmor profile. While this wouldn't catch a regression that caused only the init process to run with the wrong profile, I think it's a good approximation.

/cc @aulanov @Amey-D
This commit is contained in:
Kubernetes Submit Queue
2017-06-03 11:39:46 -07:00
committed by GitHub
parent a2412f114e b1af8da735
commit 903c40b5d3
2 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
test/e2e/apparmor.go
View File

@@ -26,13 +26,20 @@ import (
var _ = framework.KubeDescribe("AppArmor", func() { var _ = framework.KubeDescribe("AppArmor", func() {
f := framework.NewDefaultFramework("apparmor") f := framework.NewDefaultFramework("apparmor")
BeforeEach(func() { Context("load AppArmor profiles", func() {
common.SkipIfAppArmorNotSupported() BeforeEach(func() {
common.LoadAppArmorProfiles(f) common.SkipIfAppArmorNotSupported()
}) common.LoadAppArmorProfiles(f)
})
AfterEach(func() {
if !CurrentGinkgoTestDescription().Failed {
return
}
framework.LogFailedContainers(f.ClientSet, f.Namespace.Name, framework.Logf)
})
It("should enforce an AppArmor profile", func() { It("should enforce an AppArmor profile", func() {
common.CreateAppArmorTestPod(f, true) common.CreateAppArmorTestPod(f, true)
framework.LogFailedContainers(f.ClientSet, f.Namespace.Name, framework.Logf) })
}) })
}) })

3
test/e2e/common/apparmor.go
View File

@@ -58,8 +58,9 @@ if touch %[1]s; then
elif ! touch %[2]s; then elif ! touch %[2]s; then
echo "FAILURE: write to %[2]s should be allowed" echo "FAILURE: write to %[2]s should be allowed"
exit 2 exit 2
elif ! grep "%[3]s" /proc/1/attr/current; then elif ! grep "%[3]s" /proc/self/attr/current; then
echo "FAILURE: not running with expected profile %[3]s" echo "FAILURE: not running with expected profile %[3]s"
echo "found: $(cat /proc/self/attr/current)"
exit 3 exit 3
fi`, appArmorDeniedPath, appArmorAllowedPath, appArmorProfilePrefix+f.Namespace.Name) fi`, appArmorDeniedPath, appArmorAllowedPath, appArmorProfilePrefix+f.Namespace.Name)