p4u1/docker-cli
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Mask reads from timer_stats and latency_stats

Browse Source 
These files in /proc should not be able to be read as well
as written to.

Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
Upstream-commit: a7a51306b1459a67da3a9cbbe8c9f80d3950c084
Component: engine
This commit is contained in:
Michael Crosby
2015-04-29 11:20:31 -07:00
committed by Jessica Frazelle
parent 54739fa6d1
commit c87ab46f22
2 changed files with 25 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/engine/daemon/execdriver/native/template/default_template.go
View File

@ -82,16 +82,16 @@ func New() *configs.Config {
},
MaskPaths: []string{
"/proc/kcore",
"/proc/latency_stats",
"/proc/timer_stats",
},
ReadonlyPaths: []string{
"/proc/asound",
"/proc/bus",
"/proc/fs",
"/proc/irq",
"/proc/latency_stats",
"/proc/sys",
"/proc/sysrq-trigger",
"/proc/timer_stats",
},
}

34
components/engine/integration-cli/docker_cli_run_test.go
View File

@ -3078,20 +3078,32 @@ func TestRunWriteToProcAsound(t *testing.T) {
logDone("run - ro write to /proc/asound")
}
func TestRunWriteToProcTimer(t *testing.T) {
func TestRunReadProcTimer(t *testing.T) {
defer deleteAllContainers()
code, err := runCommand(exec.Command(dockerBinary, "run", "busybox", "sh", "-c", "echo 1 >> /proc/timer_stats"))
if err == nil || code == 0 {
t.Fatal("standard container should not be able to write to /proc/timer_stats")
out, code, err := runCommandWithOutput(exec.Command(dockerBinary, "run", "busybox", "cat", "/proc/timer_stats"))
if err != nil || code != 0 {
t.Fatal(err)
}
logDone("run - ro write to /proc/timer_stats")
if strings.Trim(out, "\n ") != "" {
t.Fatalf("expected to receive no output from /proc/timer_stats but received %q", out)
}
logDone("run - read /proc/timer_stats")
}
func TestRunWriteToProcLatency(t *testing.T) {
defer deleteAllContainers()
code, err := runCommand(exec.Command(dockerBinary, "run", "busybox", "sh", "-c", "echo 1 >> /proc/latency_stats"))
if err == nil || code == 0 {
t.Fatal("standard container should not be able to write to /proc/latency_stats")
func TestRunReadProcLatency(t *testing.T) {
// some kernels don't have this configured so skip the test if this file is not found
// on the host running the tests.
if _, err := os.Stat("/proc/latency_stats"); err != nil {
t.Skip()
return
}
logDone("run - ro write to /proc/latency_stats")
defer deleteAllContainers()
out, code, err := runCommandWithOutput(exec.Command(dockerBinary, "run", "busybox", "cat", "/proc/latency_stats"))
if err != nil || code != 0 {
t.Fatal(err)
}
if strings.Trim(out, "\n ") != "" {
t.Fatalf("expected to receive no output from /proc/latency_stats but received %q", out)
}
logDone("run - read /proc/latency_stats")
}