Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rkt: Set default 'User', 'Group' to root if it's not specified. #20233

Merged
merged 1 commit into from
Feb 2, 2016
Merged

rkt: Set default 'User', 'Group' to root if it's not specified. #20233

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 11 additions & 0 deletions pkg/kubelet/rkt/rkt.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -434,6 +434,17 @@ func setApp(app *appctypes.App, c *api.Container, opts *kubecontainer.RunContain
}
setSupplementaryGIDs(app, podCtx)

// If 'User' or 'Group' are still empty at this point,
// then apply the root UID and GID.
// TODO(yifan): Instead of using root GID, we should use
// the GID which the user is in.
if app.User == "" {
app.User = "0"
}
if app.Group == "" {
app.Group = "0"
}

// Set working directory.
if len(c.WorkingDir) > 0 {
app.WorkingDirectory = c.WorkingDir
Expand Down
16 changes: 10 additions & 6 deletions pkg/kubelet/rkt/rkt_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -703,8 +703,6 @@ func generateMemoryIsolator(t *testing.T, request, limit string) appctypes.Isola
func baseApp(t *testing.T) *appctypes.App {
return &appctypes.App{
Exec: appctypes.Exec{"/bin/foo"},
User: "0",
Group: "22",
SupplementaryGIDs: []int{4, 5, 6},
WorkingDirectory: "/foo",
Environment: []appctypes.EnvironmentVariable{
Expand All @@ -725,6 +723,12 @@ func baseApp(t *testing.T) *appctypes.App {
}
}

func baseAppWithRootUserGroup(t *testing.T) *appctypes.App {
app := baseApp(t)
app.User, app.Group = "0", "0"
return app
}

type envByName []appctypes.EnvironmentVariable

func (s envByName) Len() int { return len(s) }
Expand Down Expand Up @@ -776,13 +780,13 @@ func TestSetApp(t *testing.T) {
expect *appctypes.App
err error
}{
// Nothing should change.
// Nothing should change, but the "User" and "Group" should be filled.
{
container: &api.Container{},
opts: &kubecontainer.RunContainerOptions{},
ctx: nil,
podCtx: nil,
expect: baseApp(t),
expect: baseAppWithRootUserGroup(t),
err: nil,
},

Expand Down Expand Up @@ -836,7 +840,7 @@ func TestSetApp(t *testing.T) {
expect: &appctypes.App{
Exec: appctypes.Exec{"/bin/bar", "hello", "world"},
User: "42",
Group: "22",
Group: "0",
SupplementaryGIDs: []int{1, 2, 3},
WorkingDirectory: tmpDir,
Environment: []appctypes.EnvironmentVariable{
Expand Down Expand Up @@ -898,7 +902,7 @@ func TestSetApp(t *testing.T) {
expect: &appctypes.App{
Exec: appctypes.Exec{"/bin/bar", "foo", "hello", "world", "bar"},
User: "42",
Group: "22",
Group: "0",
SupplementaryGIDs: []int{1, 2, 3},
WorkingDirectory: tmpDir,
Environment: []appctypes.EnvironmentVariable{
Expand Down