//go:build linux
// +build linux
/*
Copyright 2020 The Kubernetes Authors.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package volume
import (
"fmt"
"os"
"path/filepath"
"syscall"
"testing"
v1 "k8s.io/api/core/v1"
utiltesting "k8s.io/client-go/util/testing"
)
type localFakeMounter struct {
path string
attributes Attributes
}
func (l *localFakeMounter) GetPath() string {
return l.path
}
func (l *localFakeMounter) GetAttributes() Attributes {
return l.attributes
}
func (l *localFakeMounter) SetUp(mounterArgs MounterArgs) error {
return nil
}
func (l *localFakeMounter) SetUpAt(dir string, mounterArgs MounterArgs) error {
return nil
}
func (l *localFakeMounter) GetMetrics() (*Metrics, error) {
return nil, nil
}
func TestSkipPermissionChange(t *testing.T) {
always := v1.FSGroupChangeAlways
onrootMismatch := v1.FSGroupChangeOnRootMismatch
tests := []struct {
description string
fsGroupChangePolicy *v1.PodFSGroupChangePolicy
gidOwnerMatch bool
permissionMatch bool
sgidMatch bool
skipPermssion bool
}{
{
description: "skippermission=false, policy=nil",
skipPermssion: false,
},
{
description: "skippermission=false, policy=always",
fsGroupChangePolicy: &always,
skipPermssion: false,
},
{
description: "skippermission=false, policy=always, gidmatch=true",
fsGroupChangePolicy: &always,
skipPermssion: false,
gidOwnerMatch: true,
},
{
description: "skippermission=false, policy=nil, gidmatch=true",
fsGroupChangePolicy: nil,
skipPermssion: false,
gidOwnerMatch: true,
},
{
description: "skippermission=false, policy=onrootmismatch, gidmatch=false",
fsGroupChangePolicy: &onrootMismatch,
gidOwnerMatch: false,
skipPermssion: false,
},
{
description: "skippermission=false, policy=onrootmismatch, gidmatch=true, permmatch=false",
fsGroupChangePolicy: &onrootMismatch,
gidOwnerMatch: true,
permissionMatch: false,
skipPermssion: false,
},
{
description: "skippermission=false, policy=onrootmismatch, gidmatch=true, permmatch=true",
fsGroupChangePolicy: &onrootMismatch,
gidOwnerMatch: true,
permissionMatch: true,
skipPermssion: false,
},
{
description: "skippermission=false, policy=onrootmismatch, gidmatch=true, permmatch=true, sgidmatch=true",
fsGroupChangePolicy: &onrootMismatch,
gidOwnerMatch: true,
permissionMatch: true,
sgidMatch: true,
skipPermssion: true,
},
}
for _, test := range tests {
t.Run(test.description, func(t *testing.T) {
tmpDir, err := utiltesting.MkTmpdir("volume_linux_test")
if err != nil {
t.Fatalf("error creating temp dir: %v", err)
}
defer os.RemoveAll(tmpDir)
info, err := os.Lstat(tmpDir)
if err != nil {
t.Fatalf("error reading permission of tmpdir: %v", err)
}
stat, ok := info.Sys().(*syscall.Stat_t)
if !ok || stat == nil {
t.Fatalf("error reading permission stats for tmpdir: %s", tmpDir)
}
gid := stat.Gid
var expectedGid int64
if test.gidOwnerMatch {
expectedGid = int64(gid)
} else {
expectedGid = int64(gid + 3000)
}
mask := rwMask
if test.permissionMatch {
mask |= execMask
}
if test.sgidMatch {
mask |= os.ModeSetgid
mask = info.Mode() | mask
} else {
nosgidPerm := info.Mode() &^ os.ModeSetgid
mask = nosgidPerm | mask
}
err = os.Chmod(tmpDir, mask)
if err != nil {
t.Errorf("Chmod failed on %v: %v", tmpDir, err)
}
mounter := &localFakeMounter{path: tmpDir}
ok = skipPermissionChange(mounter, tmpDir, &expectedGid, test.fsGroupChangePolicy)
if ok != test.skipPermssion {
t.Errorf("for %s expected skipPermission to be %v got %v", test.description, test.skipPermssion, ok)
}
})
}
}
func TestSetVolumeOwnershipMode(t *testing.T) {
always := v1.FSGroupChangeAlways
onrootMismatch := v1.FSGroupChangeOnRootMismatch
expectedMask := rwMask | os.ModeSetgid | execMask
tests := []struct {
description string
fsGroupChangePolicy *v1.PodFSGroupChangePolicy
setupFunc func(path string) error
assertFunc func(path string) error
}{
{
description: "featuregate=on, fsgroupchangepolicy=always",
fsGroupChangePolicy: &always,
setupFunc: func(path string) error {
info, err := os.Lstat(path)
if err != nil {
return err
}
// change mode of root folder to be right
err = os.Chmod(path, info.Mode()|expectedMask)
if err != nil {
return err
}
// create a subdirectory with invalid permissions
rogueDir := filepath.Join(path, "roguedir")
nosgidPerm := info.Mode() &^ os.ModeSetgid
err = os.Mkdir(rogueDir, nosgidPerm)
if err != nil {
return err
}
return nil
},
assertFunc: func(path string) error {
rogueDir := filepath.Join(path, "roguedir")
hasCorrectPermissions := verifyDirectoryPermission(rogueDir, false /*readOnly*/)
if !hasCorrectPermissions {
return fmt.Errorf("invalid permissions on %s", rogueDir)
}
return nil
},
},
{
description: "featuregate=on, fsgroupchangepolicy=onrootmismatch,rootdir=validperm",
fsGroupChangePolicy: &onrootMismatch,
setupFunc: func(path string) error {
info, err := os.Lstat(path)
if err != nil {
return err
}
// change mode of root folder to be right
err = os.Chmod(path, info.Mode()|expectedMask)
if err != nil {
return err
}
// create a subdirectory with invalid permissions
rogueDir := filepath.Join(path, "roguedir")
err = os.Mkdir(rogueDir, rwMask)
if err != nil {
return err
}
return nil
},
assertFunc: func(path string) error {
rogueDir := filepath.Join(path, "roguedir")
hasCorrectPermissions := verifyDirectoryPermission(rogueDir, false /*readOnly*/)
if hasCorrectPermissions {
return fmt.Errorf("invalid permissions on %s", rogueDir)
}
return nil
},
},
{
description: "featuregate=on, fsgroupchangepolicy=onrootmismatch,rootdir=invalidperm",
fsGroupChangePolicy: &onrootMismatch,
setupFunc: func(path string) error {
// change mode of root folder to be right
err := os.Chmod(path, 0770)
if err != nil {
return err
}
// create a subdirectory with invalid permissions
rogueDir := filepath.Join(path, "roguedir")
err = os.Mkdir(rogueDir, rwMask)
if err != nil {
return err
}
return nil
},
assertFunc: func(path string) error {
rogueDir := filepath.Join(path, "roguedir")
hasCorrectPermissions := verifyDirectoryPermission(rogueDir, false /*readOnly*/)
if !hasCorrectPermissions {
return fmt.Errorf("invalid permissions on %s", rogueDir)
}
return nil
},
},
}
for _, test := range tests {
t.Run(test.description, func(t *testing.T) {
tmpDir, err := utiltesting.MkTmpdir("volume_linux_ownership")
if err != nil {
t.Fatalf("error creating temp dir: %v", err)
}
defer os.RemoveAll(tmpDir)
info, err := os.Lstat(tmpDir)
if err != nil {
t.Fatalf("error reading permission of tmpdir: %v", err)
}
stat, ok := info.Sys().(*syscall.Stat_t)
if !ok || stat == nil {
t.Fatalf("error reading permission stats for tmpdir: %s", tmpDir)
}
var expectedGid int64 = int64(stat.Gid)
err = test.setupFunc(tmpDir)
if err != nil {
t.Errorf("for %s error running setup with: %v", test.description, err)
}
mounter := &localFakeMounter{path: "FAKE_DIR_DOESNT_EXIST"} // SetVolumeOwnership() must rely on tmpDir
err = SetVolumeOwnership(mounter, tmpDir, &expectedGid, test.fsGroupChangePolicy, nil)
if err != nil {
t.Errorf("for %s error changing ownership with: %v", test.description, err)
}
err = test.assertFunc(tmpDir)
if err != nil {
t.Errorf("for %s error verifying permissions with: %v", test.description, err)
}
})
}
}
// verifyDirectoryPermission checks if given path has directory permissions
// that is expected by k8s. If returns true if it does otherwise false
func verifyDirectoryPermission(path string, readonly bool) bool {
info, err := os.Lstat(path)
if err != nil {
return false
}
stat, ok := info.Sys().(*syscall.Stat_t)
if !ok || stat == nil {
return false
}
unixPerms := rwMask
if readonly {
unixPerms = roMask
}
unixPerms |= execMask
filePerm := info.Mode().Perm()
if (unixPerms&filePerm == unixPerms) && (info.Mode()&os.ModeSetgid != 0) {
return true
}
return false
}
func TestSetVolumeOwnershipOwner(t *testing.T) {
fsGroup := int64(3000)
currentUid := os.Geteuid()
if currentUid != 0 {
t.Skip("running as non-root")
}
currentGid := os.Getgid()
tests := []struct {
description string
fsGroup *int64
setupFunc func(path string) error
assertFunc func(path string) error
}{
{
description: "fsGroup=nil",
fsGroup: nil,
setupFunc: func(path string) error {
filename := filepath.Join(path, "file.txt")
file, err := os.OpenFile(filename, os.O_RDWR|os.O_CREATE, 0755)
if err != nil {
return err
}
file.Close()
return nil
},
assertFunc: func(path string) error {
filename := filepath.Join(path, "file.txt")
if !verifyFileOwner(filename, currentUid, currentGid) {
return fmt.Errorf("invalid owner on %s", filename)
}
return nil
},
},
{
description: "*fsGroup=3000",
fsGroup: &fsGroup,
setupFunc: func(path string) error {
filename := filepath.Join(path, "file.txt")
file, err := os.OpenFile(filename, os.O_RDWR|os.O_CREATE, 0755)
if err != nil {
return err
}
file.Close()
return nil
},
assertFunc: func(path string) error {
filename := filepath.Join(path, "file.txt")
if !verifyFileOwner(filename, currentUid, int(fsGroup)) {
return fmt.Errorf("invalid owner on %s", filename)
}
return nil
},
},
{
description: "symlink",
fsGroup: &fsGroup,
setupFunc: func(path string) error {
filename := filepath.Join(path, "file.txt")
file, err := os.OpenFile(filename, os.O_RDWR|os.O_CREATE, 0755)
if err != nil {
return err
}
file.Close()
symname := filepath.Join(path, "file_link.txt")
err = os.Symlink(filename, symname)
if err != nil {
return err
}
return nil
},
assertFunc: func(path string) error {
symname := filepath.Join(path, "file_link.txt")
if !verifyFileOwner(symname, currentUid, int(fsGroup)) {
return fmt.Errorf("invalid owner on %s", symname)
}
return nil
},
},
}
for _, test := range tests {
t.Run(test.description, func(t *testing.T) {
tmpDir, err := utiltesting.MkTmpdir("volume_linux_ownership")
if err != nil {
t.Fatalf("error creating temp dir: %v", err)
}
defer os.RemoveAll(tmpDir)
err = test.setupFunc(tmpDir)
if err != nil {
t.Errorf("for %s error running setup with: %v", test.description, err)
}
mounter := &localFakeMounter{path: tmpDir}
always := v1.FSGroupChangeAlways
err = SetVolumeOwnership(mounter, tmpDir, test.fsGroup, &always, nil)
if err != nil {
t.Errorf("for %s error changing ownership with: %v", test.description, err)
}
err = test.assertFunc(tmpDir)
if err != nil {
t.Errorf("for %s error verifying permissions with: %v", test.description, err)
}
})
}
}
// verifyFileOwner checks if given path is owned by uid and gid.
// It returns true if it is otherwise false.
func verifyFileOwner(path string, uid, gid int) bool {
info, err := os.Lstat(path)
if err != nil {
return false
}
stat, ok := info.Sys().(*syscall.Stat_t)
if !ok || stat == nil {
return false
}
if int(stat.Uid) != uid || int(stat.Gid) != gid {
return false
}
return true
}
Codebase Browser
kubernetes