github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-24 12:15:52 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #61929 from krmayankk/removcode

Browse Source 
Automatic merge from submit-queue (batch tested with PRs 61929, 61965). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>.

remove unused code in securitycontext

```release-note
none
```
This commit is contained in:
Kubernetes Submit Queue 2018-03-31 01:22:00 -07:00 committed by GitHub
commit 44b30f22c5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 0 additions and 114 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
pkg/securitycontext/util.go
View File

@ -67,27 +67,6 @@ func ParseSELinuxOptions(context string) (*v1.SELinuxOptions, error) {
}, nil
}
// HasNonRootUID returns true if the runAsUser is set and is greater than 0.
func HasRootUID(container *v1.Container) bool {
if container.SecurityContext == nil {
return false
}
if container.SecurityContext.RunAsUser == nil {
return false
}
return *container.SecurityContext.RunAsUser == 0
}
// HasRunAsUser determines if the sc's runAsUser field is set.
func HasRunAsUser(container *v1.Container) bool {
return container.SecurityContext != nil && container.SecurityContext.RunAsUser != nil
}
// HasRootRunAsUser returns true if the run as user is set and it is set to 0.
func HasRootRunAsUser(container *v1.Container) bool {
return HasRunAsUser(container) && HasRootUID(container)
}
func DetermineEffectiveSecurityContext(pod *v1.Pod, container *v1.Container) *v1.SecurityContext {
effectiveSc := securityContextFromPodSecurityContext(pod)
containerSc := container.SecurityContext

93
pkg/securitycontext/util_test.go
View File

@ -84,99 +84,6 @@ func compareContexts(name string, ex, ac *v1.SELinuxOptions, t *testing.T) {
}
}
func containerWithUser(ptr *int64) *v1.Container {
return &v1.Container{SecurityContext: &v1.SecurityContext{RunAsUser: ptr}}
}
func TestHaRootUID(t *testing.T) {
nonRoot := int64(1)
root := int64(0)
tests := map[string]struct {
container *v1.Container
expect bool
}{
"nil sc": {
container: &v1.Container{SecurityContext: nil},
},
"nil runAsuser": {
container: containerWithUser(nil),
},
"runAsUser non-root": {
container: containerWithUser(&nonRoot),
},
"runAsUser root": {
container: containerWithUser(&root),
expect: true,
},
}
for k, v := range tests {
actual := HasRootUID(v.container)
if actual != v.expect {
t.Errorf("%s failed, expected %t but received %t", k, v.expect, actual)
}
}
}
func TestHasRunAsUser(t *testing.T) {
runAsUser := int64(0)
tests := map[string]struct {
container *v1.Container
expect bool
}{
"nil sc": {
container: &v1.Container{SecurityContext: nil},
},
"nil runAsUser": {
container: containerWithUser(nil),
},
"valid runAsUser": {
container: containerWithUser(&runAsUser),
expect: true,
},
}
for k, v := range tests {
actual := HasRunAsUser(v.container)
if actual != v.expect {
t.Errorf("%s failed, expected %t but received %t", k, v.expect, actual)
}
}
}
func TestHasRootRunAsUser(t *testing.T) {
nonRoot := int64(1)
root := int64(0)
tests := map[string]struct {
container *v1.Container
expect bool
}{
"nil sc": {
container: &v1.Container{SecurityContext: nil},
},
"nil runAsuser": {
container: containerWithUser(nil),
},
"runAsUser non-root": {
container: containerWithUser(&nonRoot),
},
"runAsUser root": {
container: containerWithUser(&root),
expect: true,
},
}
for k, v := range tests {
actual := HasRootRunAsUser(v.container)
if actual != v.expect {
t.Errorf("%s failed, expected %t but received %t", k, v.expect, actual)
}
}
}
func TestAddNoNewPrivileges(t *testing.T) {
pfalse := false
ptrue := true