github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-01-05 23:47:50 +00:00
Code Issues Projects Releases Wiki Activity

kuberuntime: check the value of RunAsNonRoot when verifying

Browse Source 
The verification function is fixed to check the value of RunAsNonRoot,
not just the existence of it. Also adds unit tests to verify the correct
behavior.
This commit is contained in:
Yu-Ju Hong
2017-06-05 17:36:53 -07:00
parent f893cddfba
commit 07a67c252c
3 changed files with 50 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

95
pkg/kubelet/kuberuntime/security_context_test.go
View File

@@ -45,60 +45,57 @@ func TestVerifyRunAsNonRoot(t *testing.T) {
},
}
err := verifyRunAsNonRoot(pod, &pod.Spec.Containers[0], int64(0))
assert.NoError(t, err)
rootUser := types.UnixUserID(0)
runAsNonRootTrue := true
runAsNonRootFalse := false
runAsUser := types.UnixUserID(0)
RunAsNonRoot := false
podWithContainerSecurityContext := &v1.Pod{
ObjectMeta: metav1.ObjectMeta{
UID: "12345678",
Name: "bar",
Namespace: "new",
for _, test := range []struct {
desc string
sc *v1.SecurityContext
errStr string
}{
{
desc: "Pass if SecurityContext is not set",
sc: nil,
errStr: "",
},
Spec: v1.PodSpec{
Containers: []v1.Container{
{
Name: "foo",
Image: "busybox",
ImagePullPolicy: v1.PullIfNotPresent,
Command: []string{"testCommand"},
WorkingDir: "testWorkingDir",
SecurityContext: &v1.SecurityContext{
RunAsNonRoot: &RunAsNonRoot,
RunAsUser: &runAsUser,
},
},
{
desc: "Pass if RunAsNonRoot is not set",
sc: &v1.SecurityContext{
RunAsUser: &rootUser,
},
errStr: "",
},
}
err2 := verifyRunAsNonRoot(podWithContainerSecurityContext, &podWithContainerSecurityContext.Spec.Containers[0], int64(0))
assert.EqualError(t, err2, "container's runAsUser breaks non-root policy")
RunAsNonRoot = false
podWithContainerSecurityContext = &v1.Pod{
ObjectMeta: metav1.ObjectMeta{
UID: "12345678",
Name: "bar",
Namespace: "new",
},
Spec: v1.PodSpec{
Containers: []v1.Container{
{
Name: "foo",
Image: "busybox",
ImagePullPolicy: v1.PullIfNotPresent,
Command: []string{"testCommand"},
WorkingDir: "testWorkingDir",
SecurityContext: &v1.SecurityContext{
RunAsNonRoot: &RunAsNonRoot,
},
},
{
desc: "Pass if RunAsNonRoot is false",
sc: &v1.SecurityContext{
RunAsNonRoot: &runAsNonRootFalse,
RunAsUser: &rootUser,
},
errStr: "",
},
{
desc: "Fail if container's RunAsUser is root and RunAsNonRoot is true",
sc: &v1.SecurityContext{
RunAsNonRoot: &runAsNonRootTrue,
RunAsUser: &rootUser,
},
errStr: "container's runAsUser breaks non-root policy",
},
{
desc: "Fail if image's user is root and RunAsNonRoot is true",
sc: &v1.SecurityContext{
RunAsNonRoot: &runAsNonRootTrue,
},
errStr: "container has runAsNonRoot and image will run as root",
},
} {
pod.Spec.Containers[0].SecurityContext = test.sc
err := verifyRunAsNonRoot(pod, &pod.Spec.Containers[0], int64(0))
if len(test.errStr) == 0 {
assert.NoError(t, err, test.desc)
} else {
assert.EqualError(t, err, test.errStr, test.desc)
}
}
err3 := verifyRunAsNonRoot(podWithContainerSecurityContext, &podWithContainerSecurityContext.Spec.Containers[0], int64(0))
assert.EqualError(t, err3, "container has runAsNonRoot and image will run as root")
}