Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(core): allow asset bundling when selinux is enabled #15742

Merged
merged 4 commits into from
Sep 2, 2021
Merged

fix(core): allow asset bundling when selinux is enabled #15742

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
323ce3a
feat(core): allow asset bundling when selinux is enabled
maafk Jul 24, 2021
41937de
assume darwin platform so that added spawnSync command doesn't need t…
maafk Jul 24, 2021
71a5ddb
Merge branch 'master' into selinux-docker-mount
maafk Aug 30, 2021
1341f8f
Merge branch 'master' into selinux-docker-mount
mergify[bot] Sep 2, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 26 additions & 1 deletion packages/@aws-cdk/core/lib/bundling.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -200,7 +200,7 @@ export class BundlingDockerImage {
...options.user
? ['-u', options.user]
: [],
...flatten(volumes.map(v => ['-v', `${v.hostPath}:${v.containerPath}:${v.consistency ?? DockerVolumeConsistency.DELEGATED}`])),
...flatten(volumes.map(v => ['-v', `${v.hostPath}:${v.containerPath}:${isSeLinux() ? 'z,' : ''}${v.consistency ?? DockerVolumeConsistency.DELEGATED}`])),
...flatten(Object.entries(environment).map(([k, v]) => ['--env', `${k}=${v}`])),
...options.workingDirectory
? ['-w', options.workingDirectory]
Expand Down Expand Up @@ -481,3 +481,28 @@ function dockerExec(args: string[], options?: SpawnSyncOptions) {

return proc;
}

function isSeLinux() : boolean {
if (process.platform != 'linux') {
return false;
}
const prog = 'selinuxenabled';
const proc = spawnSync(prog, [], {
stdio: [ // show selinux status output
'pipe', // get value of stdio
process.stderr, // redirect stdout to stderr
'inherit', // inherit stderr
],
});
if (proc.error) {
// selinuxenabled not a valid command, therefore not enabled
return false;
}
if (proc.status == 0) {
// selinux enabled
return true;
} else {
// selinux not enabled
return false;
}
}
134 changes: 132 additions & 2 deletions packages/@aws-cdk/core/test/bundling.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@ nodeunitShim({
},

'bundling with image from registry'(test: Test) {
sinon.stub(process, 'platform').value('darwin');
const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
status: 0,
stderr: Buffer.from('stderr'),
Expand Down Expand Up @@ -230,6 +231,7 @@ nodeunitShim({
},

'custom entrypoint is passed through to docker exec'(test: Test) {
sinon.stub(process, 'platform').value('darwin');
const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
status: 0,
stderr: Buffer.from('stderr'),
Expand Down Expand Up @@ -343,7 +345,9 @@ nodeunitShim({
test.done();
},

'adding user provided securit-opt'(test: Test) {
'adding user provided security-opt'(test: Test) {
// GIVEN
sinon.stub(process, 'platform').value('darwin');
const spawnSyncStub = sinon.stub(child_process, 'spawnSync').returns({
status: 0,
stderr: Buffer.from('stderr'),
Expand All @@ -352,8 +356,9 @@ nodeunitShim({
output: ['stdout', 'stderr'],
signal: null,
});

const image = DockerImage.fromRegistry('alpine');

// GIVEN
image.run({
command: ['cool', 'command'],
environment: {
Expand All @@ -379,4 +384,129 @@ nodeunitShim({
], { stdio: ['ignore', process.stderr, 'inherit'] }));
test.done();
},

'ensure selinux docker mount'(test: Test) {
// GIVEN
sinon.stub(process, 'platform').value('linux');
const spawnSyncStub = sinon.stub(child_process, 'spawnSync');
spawnSyncStub.onFirstCall().returns({
status: 0,
stderr: Buffer.from('stderr'),
stdout: Buffer.from('stdout'),
pid: 123,
output: ['selinuxenable-command', 'stderr'],
signal: null,
});
spawnSyncStub.onSecondCall().returns({
status: 0,
stderr: Buffer.from('stderr'),
stdout: Buffer.from('stdout'),
pid: 124,
output: ['docker run command', 'stderr'],
signal: null,
});

// WHEN
const image = DockerImage.fromRegistry('alpine');
image.run({
command: ['cool', 'command'],
volumes: [{ hostPath: '/host-path', containerPath: '/container-path' }],
workingDirectory: '/working-directory',
user: 'user:group',
});

// THEN
test.ok(spawnSyncStub.secondCall.calledWith('docker', [
'run', '--rm',
'-u', 'user:group',
'-v', '/host-path:/container-path:z,delegated',
'-w', '/working-directory',
'alpine',
'cool', 'command',
], { stdio: ['ignore', process.stderr, 'inherit'] }));
test.done();
},

'ensure selinux docker mount on linux with selinux disabled'(test: Test) {
// GIVEN
sinon.stub(process, 'platform').value('linux');
const spawnSyncStub = sinon.stub(child_process, 'spawnSync');
spawnSyncStub.onFirstCall().returns({
status: 1,
stderr: Buffer.from('stderr'),
stdout: Buffer.from('stdout'),
pid: 123,
output: ['selinuxenabled output', 'stderr'],
signal: null,
});
spawnSyncStub.onSecondCall().returns({
status: 0,
stderr: Buffer.from('stderr'),
stdout: Buffer.from('stdout'),
pid: 124,
output: ['docker run command', 'stderr'],
signal: null,
});

// WHEN
const image = DockerImage.fromRegistry('alpine');
image.run({
command: ['cool', 'command'],
volumes: [{ hostPath: '/host-path', containerPath: '/container-path' }],
workingDirectory: '/working-directory',
user: 'user:group',
});

// THEN
test.ok(spawnSyncStub.secondCall.calledWith('docker', [
'run', '--rm',
'-u', 'user:group',
'-v', '/host-path:/container-path:delegated',
'-w', '/working-directory',
'alpine',
'cool', 'command',
], { stdio: ['ignore', process.stderr, 'inherit'] }));
test.done();
},
'ensure no selinux docker mount if selinuxenabled isn\'t an available command'(test: Test) {
// GIVEN
sinon.stub(process, 'platform').value('linux');
const spawnSyncStub = sinon.stub(child_process, 'spawnSync');
spawnSyncStub.onFirstCall().returns({
status: 127,
stderr: Buffer.from('stderr'),
stdout: Buffer.from('stdout'),
pid: 123,
output: ['selinuxenabled output', 'stderr'],
signal: null,
});
spawnSyncStub.onSecondCall().returns({
status: 0,
stderr: Buffer.from('stderr'),
stdout: Buffer.from('stdout'),
pid: 124,
output: ['docker run command', 'stderr'],
signal: null,
});

// WHEN
const image = DockerImage.fromRegistry('alpine');
image.run({
command: ['cool', 'command'],
volumes: [{ hostPath: '/host-path', containerPath: '/container-path' }],
workingDirectory: '/working-directory',
user: 'user:group',
});

// THEN
test.ok(spawnSyncStub.secondCall.calledWith('docker', [
'run', '--rm',
'-u', 'user:group',
'-v', '/host-path:/container-path:delegated',
'-w', '/working-directory',
'alpine',
'cool', 'command',
], { stdio: ['ignore', process.stderr, 'inherit'] }));
test.done();
},
});