Function TEST_P

src/tests/containerizer/linux_devices_isolator_tests.cpp:81–141

TEST_P(LinuxDevicesIsolatorTest,
       ROOT_UNPRIVILEGED_USER_PopulateWhitelistedDevices)
{
  // Verify that all the necessary devices are present on the host.
  // All reasonable Linux configuration should have these devices.
  ASSERT_TRUE(os::exists("/dev/kmsg"));
  ASSERT_TRUE(os::exists("/dev/loop-control"));
  ASSERT_TRUE(os::exists("/dev/net/tun"));

  slave::Flags flags = CreateSlaveFlags();

  flags.isolation = "linux/devices,filesystem/linux,docker/runtime";
  flags.docker_registry =  path::join(sandbox.get(), "registry");
  flags.docker_store_dir = path::join(sandbox.get(), "store");
  flags.image_providers = "docker";

  flags.allowed_devices =
    flags::parse<DeviceWhitelist>(param.allowedDevices).get();

  AWAIT_READY(DockerArchive::create(flags.docker_registry, "test_image"));

  Fetcher fetcher(flags);

  Try<MesosContainerizer*> create =
    MesosContainerizer::create(flags, true, &fetcher);

  ASSERT_SOME(create);

  Owned<Containerizer> containerizer(create.get());

  ContainerID containerId;
  containerId.set_value(id::UUID::random().toString());

  ExecutorInfo executor = createExecutorInfo(
      "test_executor",
      strings::join(";", "ls -l /dev", param.containerCheck));

  executor.mutable_container()->CopyFrom(createContainerInfo("test_image"));

  string directory = path::join(flags.work_dir, "sandbox");
  ASSERT_SOME(os::mkdir(directory));

  // Launch the container check command as the non-root user. All the
  // check commands are testing for device file access, but root will
  // always have access.
  Future<Containerizer::LaunchResult> launch = containerizer->launch(
      containerId,
      createContainerConfig(
          None(), executor, directory, os::getenv("SUDO_USER").get()),
      map<string, string>(),
      None());

  AWAIT_ASSERT_EQ(Containerizer::LaunchResult::SUCCESS, launch);

  Future<Option<ContainerTermination>> wait = containerizer->wait(containerId);

  AWAIT_READY(wait);
  ASSERT_SOME(wait.get());