Function TestProcessUser

internal/cri/server/container_create_linux_test.go:1046–1158

(t *testing.T)

}

func TestProcessUser(t *testing.T) {
	testID := "test-id"
	testSandboxID := "sandbox-id"
	testContainerName := "container-name"
	testPid := uint32(1234)
	ociRuntime := config.Runtime{}
	c := newTestCRIService()
	testContainer := &containers.Container{ID: "64ddfe361f0099f8d59075398feeb3dcb3863b6851df7b946744755066c03e9d"}
	ctx := context.Background()

	etcPasswd := `
root:x:0:0:root:/root:/bin/sh
alice:x:1000:1000:alice:/home/alice:/bin/sh
` // #nosec G101
	etcGroup := `
root:x:0
alice:x:1000:
additional-group-for-alice:x:11111:alice
additional-group-for-root:x:22222:root
`
	tempRootDir := t.TempDir()
	require.NoError(t,
		os.MkdirAll(filepath.Join(tempRootDir, "etc"), 0755),
	)
	require.NoError(t,
		os.WriteFile(filepath.Join(tempRootDir, "etc", "passwd"), []byte(etcPasswd), 0644),
	)
	require.NoError(t,
		os.WriteFile(filepath.Join(tempRootDir, "etc", "group"), []byte(etcGroup), 0644),
	)

	for _, test := range []struct {
		desc            string
		imageConfigUser string
		securityContext *runtime.LinuxContainerSecurityContext
		expected        runtimespec.User
	}{
		{
			desc: "[SupplementalGroupsPolicy=Merge(default)] Only SecurityContext was set, SecurityContext defines User",
			securityContext: &runtime.LinuxContainerSecurityContext{
				RunAsUser:          &runtime.Int64Value{Value: 1000},
				RunAsGroup:         &runtime.Int64Value{Value: 2000},
				SupplementalGroups: []int64{3333},
			},
			expected: runtimespec.User{UID: 1000, GID: 2000, AdditionalGids: []uint32{2000, 3333, 11111}},
		},
		{
			desc:            "[SupplementalGroupsPolicy=Merge(default)] Only imageConfig.User was set, imageConfig.User defines User",
			imageConfigUser: "1000",
			securityContext: nil,
			expected:        runtimespec.User{UID: 1000, GID: 1000, AdditionalGids: []uint32{1000, 11111}},
		},
		{
			desc:            "[SupplementalGroupsPolicy=Merge(default)] Both SecurityContext and ImageConfig.User were set, SecurityContext defines User",
			imageConfigUser: "0",
			securityContext: &runtime.LinuxContainerSecurityContext{
				RunAsUser:          &runtime.Int64Value{Value: 1000},
				RunAsGroup:         &runtime.Int64Value{Value: 2000},