Function TEST_F

src/tests/containerizer/linux_nnp_isolator_tests.cpp:76–138

Check that the PR_NO_NEW_PRIVILEGES flag is set.

// Check that the PR_NO_NEW_PRIVILEGES flag is set.
TEST_F(LinuxNNPIsolatorTest, ROOT_CheckNoNewPrivileges)
{
  // This tests requires the NoNewPrivs field present in process
  // status fields which requires Linux kernel version greater than
  // or equal to 4.10.
  Try<Version> version = mesos::kernelVersion();
  ASSERT_SOME(version);
  if (version.get() < Version(4, 10, 0)) {
    LOG(INFO) << "Linux kernel version greater than or equal to 4.10 required";
    return;
  }

  AWAIT_READY(DockerArchive::create(GetRegistryPath(), "test_image"));

  slave::Flags flags = CreateSlaveFlags();

  Fetcher fetcher(flags);

  Try<MesosContainerizer*> create =
    MesosContainerizer::create(flags, true, &fetcher);

  ASSERT_SOME(create);

  Owned<Containerizer> containerizer(create.get());

  ContainerID containerId;
  containerId.set_value(id::UUID::random().toString());

  // Test that the child process inherits the PR_NO_NEW_PRIVS flag.
  // Using parameter expansion to parse the process status file
  // due to minimal docker image. The child process should inherit
  // the PR_NO_NEW_PRIVS flag. Parse the process status file and
  // determine if "NoNewPrivs: 1" is found.
  ExecutorInfo executor = createExecutorInfo(
      "test_executor",
      R"~(
      #!/bin/bash
      x=$(cat /proc/self/status);
      y=${x##*NoNewPrivs:};
      read -a a <<< $y;
      if [ ${a[0]} == "1" ]; then exit 0; else exit 1; fi
      )~");

  executor.mutable_container()->CopyFrom(createContainerInfo("test_image"));

  string directory = path::join(flags.work_dir, "sandbox");
  ASSERT_SOME(os::mkdir(directory));

  Future<Containerizer::LaunchResult> launch = containerizer->launch(
      containerId,
      createContainerConfig(None(), executor, directory),
      map<string, string>(),
      None());

  AWAIT_ASSERT_EQ(Containerizer::LaunchResult::SUCCESS, launch);

  Future<Option<ContainerTermination>> wait = containerizer->wait(containerId);