Skip to content
This repository has been archived by the owner on May 12, 2021. It is now read-only.

Commit

Permalink
Merge pull request #788 from amshinde/agent-pid-for-container
Browse files Browse the repository at this point in the history
namespaces: Allow container with agent PID namespace
  • Loading branch information
amshinde authored Jul 30, 2020
2 parents 2e94561 + abb006c commit e921aa3
Show file tree
Hide file tree
Showing 6 changed files with 284 additions and 190 deletions.
1 change: 1 addition & 0 deletions agent.go
Original file line number Diff line number Diff line change
Expand Up @@ -111,6 +111,7 @@ type container struct {
processes map[string]*process
mounts []string
useSandboxPidNs bool
agentPidNs bool
ctx context.Context
}

Expand Down
1 change: 0 additions & 1 deletion config.go
Original file line number Diff line number Diff line change
Expand Up @@ -162,7 +162,6 @@ func parseCmdlineOption(option string) error {
}

return nil

}

func enableTracing(traceMode, traceType string) {
Expand Down
8 changes: 8 additions & 0 deletions grpc.go
Original file line number Diff line number Diff line change
Expand Up @@ -520,6 +520,13 @@ func (a *agentGRPC) updateContainerConfigNamespaces(config *configs.Config, ctr
config.Namespaces = append(config.Namespaces, newUTSNs)
}

// If container needs to be in the agent PID namespace, do not create a new
// PID namespace.
if ctr.agentPidNs {
agentLog.Warnf("Container shares Pid namespace with the agent, allowing container access to the agent process")
return
}

// Update PID namespace.
var pidNsPath string

Expand Down Expand Up @@ -643,6 +650,7 @@ func (a *agentGRPC) CreateContainer(ctx context.Context, req *pb.CreateContainer
processes: make(map[string]*process),
mounts: mountList,
useSandboxPidNs: req.SandboxPidns,
agentPidNs: req.AgentPidns,
ctx: ctx,
}

Expand Down
40 changes: 37 additions & 3 deletions grpc_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -39,14 +39,18 @@ var testSharedUTSNs = "testSharedUTSNs"
var testSharedIPCNs = "testSharedIPCNs"

func testUpdateContainerConfigNamespacesSharedPid(t *testing.T, sharedPidNs, sharedUTSNs, sharedIPCNs string, config, expected configs.Config) {
testUpdateContainerConfigNamespaces(t, sharedPidNs, sharedUTSNs, sharedIPCNs, config, expected, true)
testUpdateContainerConfigNamespaces(t, sharedPidNs, sharedUTSNs, sharedIPCNs, config, expected, true, false)
}

func testUpdateContainerConfigNamespacesNonSharedPid(t *testing.T, sharedPidNs, sharedUTSNs, sharedIPCNs string, config, expected configs.Config) {
testUpdateContainerConfigNamespaces(t, sharedPidNs, sharedUTSNs, sharedIPCNs, config, expected, false)
testUpdateContainerConfigNamespaces(t, sharedPidNs, sharedUTSNs, sharedIPCNs, config, expected, false, false)
}

func testUpdateContainerConfigNamespaces(t *testing.T, sharedPidNs, sharedUTSNs, sharedIPCNs string, config, expected configs.Config, sharedPid bool) {
func testUpdateContainerConfigNamespacesAgentPid(t *testing.T, sharedPidNs, sharedUTSNs, sharedIPCNs string, config, expected configs.Config) {
testUpdateContainerConfigNamespaces(t, sharedPidNs, sharedUTSNs, sharedIPCNs, config, expected, false, true)
}

func testUpdateContainerConfigNamespaces(t *testing.T, sharedPidNs, sharedUTSNs, sharedIPCNs string, config, expected configs.Config, sharedPid, agentPid bool) {
s := &sandbox{
sharedPidNs: namespace{
path: sharedPidNs,
Expand All @@ -64,6 +68,7 @@ func testUpdateContainerConfigNamespaces(t *testing.T, sharedPidNs, sharedUTSNs,
ctr := &container{
id: contID,
useSandboxPidNs: sharedPid,
agentPidNs: agentPid,
}

s.containers[contID] = ctr
Expand Down Expand Up @@ -171,6 +176,35 @@ func TestUpdateContainerConfigNamespacesEmptyConfig(t *testing.T) {
testUpdateContainerConfigNamespacesNonSharedPid(t, testSharedPidNs, testSharedUTSNs, testSharedIPCNs, configs.Config{}, expectedConfig)
}

func TestUpdateContainerConfigNamespacesAgentPidConfig(t *testing.T) {
config := configs.Config{
Namespaces: []configs.Namespace{
{
Type: configs.NEWIPC,
},
{
Type: configs.NEWUTS,
},
},
}

expectedConfig := configs.Config{
Namespaces: []configs.Namespace{
{
Type: configs.NEWIPC,
Path: testSharedIPCNs,
},
{
Type: configs.NEWUTS,
Path: testSharedUTSNs,
},
},
}

testUpdateContainerConfigNamespacesAgentPid(t, testSharedPidNs, testSharedUTSNs, testSharedIPCNs, config, expectedConfig)

}

func testUpdateContainerConfigPrivileges(t *testing.T, spec *specs.Spec, config, expected configs.Config) {
a := &agentGRPC{}

Expand Down
Loading

0 comments on commit e921aa3

Please sign in to comment.