Function testUpdateDevices

libcontainer/integration/update_test.go:13–86

(t *testing.T, systemd bool)

)

func testUpdateDevices(t *testing.T, systemd bool) {
	if testing.Short() {
		return
	}
	config := newTemplateConfig(t, &tParam{systemd: systemd})
	container, err := newContainer(t, config)
	ok(t, err)
	defer destroyContainer(container)

	// Execute a first process in the container
	stdinR, stdinW, err := os.Pipe()
	ok(t, err)
	process := &libcontainer.Process{
		Cwd:   "/",
		Args:  []string{"cat"},
		Env:   standardEnvironment,
		Stdin: stdinR,
		Init:  true,
	}
	err = container.Run(process)
	_ = stdinR.Close()
	defer func() {
		_ = stdinW.Close()
		if _, err := process.Wait(); err != nil {
			t.Log(err)
		}
	}()
	ok(t, err)

	var buf strings.Builder
	devCheck := &libcontainer.Process{
		Cwd:    "/",
		Args:   []string{"/bin/sh", "-c", "echo > /dev/full; cat /dev/null; true"},
		Env:    standardEnvironment,
		Stderr: &buf,
	}
	isAllowed := true
	expected := map[bool][]string{
		true: {
			"write error: No space left on device", // from write to /dev/full
			// no error from cat /dev/null
		},
		false: {
			"/dev/full: Operation not permitted",
			`cat: can't open '/dev/null': Operation not permitted`,
		},
	}
	defaultDevices := config.Cgroups.Resources.Devices

	for i := range 300 {
		// Check the access
		buf.Reset()
		err = container.Run(devCheck)
		ok(t, err)
		waitProcess(devCheck, t)

		for _, exp := range expected[isAllowed] {
			if !strings.Contains(buf.String(), exp) {