Parameterized test confirming the behavior of the capabilities isolator. We here use the fact has `ping` has `NET_RAW` and `NET_ADMIN` in its file capabilities. This test should be instantiated with above `TestParam` struct.
| 213 | // `NET_ADMIN` in its file capabilities. This test should be |
| 214 | // instantiated with above `TestParam` struct. |
| 215 | TEST_P(LinuxCapabilitiesIsolatorTest, ROOT_Ping) |
| 216 | { |
| 217 | Try<Owned<cluster::Master>> master = StartMaster(); |
| 218 | ASSERT_SOME(master); |
| 219 | |
| 220 | slave::Flags flags = CreateSlaveFlags(); |
| 221 | flags.isolation = "linux/capabilities"; |
| 222 | flags.effective_capabilities = param.operator_effective; |
| 223 | flags.bounding_capabilities = param.operator_bounding; |
| 224 | |
| 225 | if (param.useImage == TestParam::WITH_IMAGE) { |
| 226 | const string registry = path::join(sandbox.get(), "registry"); |
| 227 | AWAIT_READY(DockerArchive::create(registry, "test_image")); |
| 228 | |
| 229 | flags.docker_registry = registry; |
| 230 | flags.docker_store_dir = path::join(os::getcwd(), "store"); |
| 231 | flags.image_providers = "docker"; |
| 232 | flags.isolation += ",docker/runtime,filesystem/linux"; |
| 233 | } |
| 234 | |
| 235 | Owned<MasterDetector> detector = master.get()->createDetector(); |
| 236 | |
| 237 | Try<Owned<cluster::Slave>> slave = StartSlave(detector.get(), flags); |
| 238 | ASSERT_SOME(slave); |
| 239 | |
| 240 | MockScheduler sched; |
| 241 | |
| 242 | MesosSchedulerDriver driver( |
| 243 | &sched, |
| 244 | DEFAULT_FRAMEWORK_INFO, |
| 245 | master.get()->pid, |
| 246 | DEFAULT_CREDENTIAL); |
| 247 | |
| 248 | EXPECT_CALL(sched, registered(_, _, _)); |
| 249 | |
| 250 | Future<vector<Offer>> offers; |
| 251 | EXPECT_CALL(sched, resourceOffers(_, _)) |
| 252 | .WillOnce(FutureArg<1>(&offers)) |
| 253 | .WillRepeatedly(Return()); // Ignore subsequent offers. |
| 254 | |
| 255 | driver.start(); |
| 256 | |
| 257 | AWAIT_READY(offers); |
| 258 | ASSERT_FALSE(offers->empty()); |
| 259 | |
| 260 | // We use 'ping' as the command since it has file capabilities |
| 261 | // (`NET_RAW` and `NET_ADMIN` in permitted set). This allows us to |
| 262 | // test if capabilities are properly set. |
| 263 | CommandInfo command; |
| 264 | command.set_shell(false); |
| 265 | command.set_value("/bin/ping"); |
| 266 | command.add_arguments("ping"); |
| 267 | command.add_arguments("-c"); |
| 268 | command.add_arguments("1"); |
| 269 | command.add_arguments("127.0.0.1"); |
| 270 | |
| 271 | TaskInfo task = createTask( |
| 272 | offers.get()[0].slave_id(), |
nothing calls this directly
no test coverage detected