container_config_parser_test.cc

// Copyright 2016 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "run_oci/container_config_parser.h"

#include <linux/securebits.h>
#include <stddef.h>
#include <stdint.h>
#include <sys/mount.h>
#include <sys/resource.h>

#include <map>
#include <vector>

#include <base/values.h>
#include <gtest/gtest.h>

#include "run_oci/oci_config.h"

namespace {

const char kBasicJsonData[] = R"json(
    {
        "ociVersion": "1.0.0-rc1",
        "platform": {
            "os": "linux",
            "arch": "amd64"
        },
        "root": {
            "path": "rootfs",
            "readonly": true
        },
        "process": {
            "terminal": true,
            "user": {
                "uid": 0,
                "gid": 0,
                "additionalGids": [1, 2]
            },
            "args": [
                "sh"
            ],
            "env": [
                "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
                "TERM=xterm"
            ],
            "cwd": "/",
            "capabilities": {
                "effective": [
                    "CAP_AUDIT_WRITE",
                    "CAP_KILL",
                    "CAP_NET_BIND_SERVICE"
                ],
                "bounding": [
                    "CAP_AUDIT_WRITE",
                    "CAP_KILL",
                    "CAP_NET_BIND_SERVICE"
                ],
                "inheritable": [
                    "CAP_AUDIT_WRITE",
                    "CAP_KILL",
                    "CAP_NET_BIND_SERVICE"
                ],
                "permitted": [
                    "CAP_AUDIT_WRITE",
                    "CAP_KILL",
                    "CAP_NET_BIND_SERVICE"
                ],
                "ambient": [
                    "CAP_AUDIT_WRITE",
                    "CAP_KILL",
                    "CAP_NET_BIND_SERVICE"
                ]
            },
            "rlimits": [
                {
                    "type": "RLIMIT_NICE",
                    "hard": 12,
                    "soft": 11
                }
            ],
            "noNewPrivileges": true,
            "umask": 0
        },
        "hostname": "tester",
        "mounts": [
            {
                "destination": "/proc",
                "type": "proc",
                "source": "proc"
            },
            {
                "destination": "/dev",
                "type": "tmpfs",
                "source": "tmpfs",
                "options": [
                        "nosuid",
                        "strictatime",
                        "mode=755",
                        "size=65536k"
                ]
            },
            {
                "destination": "/dev/pts",
                "type": "devpts",
                "source": "devpts",
                "options": [
                        "nosuid",
                        "noexec",
                        "newinstance",
                        "ptmxmode=0666",
                        "mode=0620",
                        "gid=5"
                ]
            },
            {
                "destination": "/dev/shm",
                "type": "tmpfs",
                "source": "shm",
                "options": [
                        "nosuid",
                        "noexec",
                        "nodev",
                        "mode=1777",
                        "size=65536k"
                ]
            },
            {
                "destination": "/dev/mqueue",
                "type": "mqueue",
                "source": "mqueue",
                "options": [
                        "nosuid",
                        "noexec",
                        "nodev"
                ]
            },
            {
                "destination": "/sys",
                "type": "sysfs",
                "source": "sysfs",
                "options": [
                        "nosuid",
                        "noexec",
                        "nodev",
                        "ro"
                ]
            },
            {
                "destination": "/sys/fs/cgroup",
                "type": "cgroup",
                "source": "cgroup",
                "options": [
                        "nosuid",
                        "noexec",
                        "nodev",
                        "relatime",
                        "ro"
                ]
            }
        ],
        "hooks" : {
            "precreate": [
                {
                    "path": "/usr/bin/setup-mounts"
                }
            ],
            "prestart": [
                {
                    "path": "/usr/bin/fix-mounts",
                    "args": ["fix-mounts", "arg1", "arg2"],
                    "env":  [ "key1=value1"]
                },
                {
                    "path": "/usr/bin/setup-network"
                }
            ],
            "poststart": [
                {
                    "path": "/usr/bin/notify-start",
                    "timeout": 5
                }
            ],
            "poststop": [
                {
                    "path": "/usr/sbin/cleanup.sh",
                    "args": ["cleanup.sh", "-f"]
                }
            ]
        },
        "linux": {
            "rootfsPropagation": "rprivate",
            "altSyscall": "android",
            "cgroupsPath": "/session_manager_containers",
            "skipSecurebits": [
                "KEEP_CAPS",
                "KEEP_CAPS_LOCKED"
            ],
            "devices": [
                {
                    "path": "/dev/fuse",
                    "type": "c",
                    "major": 10,
                    "minor": 229,
                    "fileMode": 438,
                    "uid": 0,
                    "gid": 3221225472
                },
                {
                    "path": "/dev/sda",
                    "type": "b",
                    "major": 8,
                    "minor": 0,
                    "fileMode": 432,
                    "uid": 0,
                    "gid": 0
                },
                {
                    "path": "/dev/binder",
                    "type": "c",
                    "major": 10,
                    "dynamicMinor": true,
                    "fileMode": 438,
                    "uid": 0,
                    "gid": 0
                }
            ],
            "resources": {
                "devices": [
                    {
                        "allow": false,
                        "access": "rwm"
                    }
                ],
                "network": {
                    "classID": 1048577,
                    "priorities": [
                        {
                            "name": "eth0",
                            "priority": 500
                        },
                        {
                            "name": "eth1",
                            "priority": 1000
                        }
                    ]
                }
            },
            "namespaces": [
                {
                    "type": "pid",
                    "path": "/proc/1234/ns/pid"
                },
                {
                    "type": "network"
                },
                {
                    "type": "ipc"
                },
                {
                    "type": "uts"
                },
                {
                    "type": "mount"
                }
            ],
            "uidMappings": [
                {
                    "hostID": 1000,
                    "containerID": 0,
                    "size": 10
                }
            ],
            "gidMappings": [
                {
                    "hostID": 1000,
                    "containerID": 0,
                    "size": 10
                }
            ],
            "maskedPaths": [
                "/proc/kcore",
                "/proc/latency_stats",
                "/proc/timer_list",
                "/proc/timer_stats",
                "/proc/sched_debug"
            ],
            "readonlyPaths": [
                "/proc/asound",
                "/proc/bus",
                "/proc/fs",
                "/proc/irq",
                "/proc/sys",
                "/proc/sysrq-trigger"
            ],
            "seccomp": {
                "defaultAction": "SCP_ACT_KILL",
                "architectures": [
                    "SCP_ARCH_X86"
                ],
                "syscalls": [
                    {
                        "name": "read",
                        "action": "SCP_ACT_ALLOW"
                    },
                    {
                        "name": "write",
                        "action": "SCP_ACT_ALLOW",
                        "args": [
                            {
                                "index": 1,
                                "value": 255,
                                "value2": 4,
                                "op": "SCMP_CMP_EQ"
                            }
                        ]
                    }
                ]
            },
            "cpu": {
                "shares": 1024,
                "quota": 1000000,
                "period": 500000,
                "realtimeRuntime": 950000,
                "realtimePeriod": 1000000
            }
        }
    }
)json";

const char kStrippedJsonData[] = R"json(
    {
        "ociVersion": "1.0.0-rc1",
        "platform": {
            "os": "linux",
            "arch": "amd64"
        },
        "root": {
            "path": "rootfs",
            "readonly": true
        },
        "process": {
            "terminal": true,
            "user": {
                "uid": 0,
                "gid": 0
            },
            "args": [
                "sh"
            ],
            "cwd": "/",
            "noNewPrivileges": true
        },
        "hostname": "tester",
        "mounts": [
            {
                "destination": "/proc",
                "type": "proc",
                "source": "proc"
            }
        ],
        "linux": {
            "uidMappings": [
                {
                    "hostID": 1000,
                    "containerID": 0,
                    "size": 10
                }
            ],
            "gidMappings": [
                {
                    "hostID": 1000,
                    "containerID": 0,
                    "size": 10
                }
            ]
        }
    }
)json";

const char kInvalidHostnameJsonData[] = R"json(
    {
        "ociVersion": "1.0.0-rc1",
        "platform": {
            "os": "linux",
            "arch": "amd64"
        },
        "root": {
            "path": "rootfs",
            "readonly": true
        },
        "process": {
            "terminal": true,
            "user": {
                "uid": 0,
                "gid": 0
            },
            "args": [
                "sh"
            ],
            "cwd": "/",
            "noNewPrivileges": true
        },
        "hostname": "../secrets",
        "mounts": [
            {
                "destination": "/proc",
                "type": "proc",
                "source": "proc"
            }
        ],
        "linux": {
            "uidMappings": [
                {
                    "hostID": 1000,
                    "containerID": 0,
                    "size": 10
                }
            ],
            "gidMappings": [
                {
                    "hostID": 1000,
                    "containerID": 0,
                    "size": 10
                }
            ]
        }
    }
)json";

}  // anonymous namespace

namespace run_oci {

TEST(OciConfigParserTest, TestBasicConfig) {
  OciConfigPtr basic_config(new OciConfig());
  ASSERT_TRUE(ParseContainerConfig(kBasicJsonData, basic_config));

  EXPECT_EQ(basic_config->ociVersion, "1.0.0-rc1");
  EXPECT_EQ(basic_config->platform.os, "linux");
  EXPECT_EQ(basic_config->root.path, base::FilePath("rootfs"));
  EXPECT_EQ(basic_config->root.readonly, true);
  EXPECT_EQ(basic_config->process.terminal, true);
  EXPECT_EQ(basic_config->process.user.uid, 0);
  EXPECT_EQ(basic_config->process.user.gid, 0);
  EXPECT_EQ(basic_config->process.user.additionalGids,
            std::vector<uint32_t>({1, 2}));
  EXPECT_EQ(basic_config->process.args.size(), 1);
  EXPECT_EQ(basic_config->process.args[0], "sh");
  EXPECT_EQ(basic_config->process.env.size(), 2);
  EXPECT_EQ(
      basic_config->process.env,
      (OciEnvironment{
          {"PATH",
           "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"},
          {"TERM", "xterm"}}));
  EXPECT_EQ(basic_config->process.cwd, base::FilePath("/"));
  EXPECT_EQ(basic_config->process.rlimits.size(), 1);
  EXPECT_EQ(basic_config->process.rlimits[0].type, RLIMIT_NICE);
  EXPECT_EQ(basic_config->process.rlimits[0].soft, 11);
  EXPECT_EQ(basic_config->process.rlimits[0].hard, 12);
  EXPECT_EQ(basic_config->process.umask, 0);
  EXPECT_EQ(basic_config->hostname, "tester");
  ASSERT_EQ(basic_config->mounts.size(), 7);
  EXPECT_EQ(basic_config->mounts[0].options.size(), 0);
  EXPECT_EQ(basic_config->mounts[1].destination, base::FilePath("/dev"));
  EXPECT_EQ(basic_config->mounts[2].options.size(), 6);
  EXPECT_EQ(MS_PRIVATE | MS_REC, basic_config->linux_config.rootfsPropagation);
  EXPECT_EQ("android", basic_config->linux_config.altSyscall);
  EXPECT_EQ(base::FilePath("/session_manager_containers"),
            basic_config->linux_config.cgroupsPath);
  EXPECT_EQ(SECBIT_KEEP_CAPS | SECBIT_KEEP_CAPS_LOCKED,
            basic_config->linux_config.skipSecurebits);
  // Devices
  ASSERT_EQ(3, basic_config->linux_config.devices.size());
  OciLinuxDevice* dev = &basic_config->linux_config.devices[0];
  EXPECT_EQ(dev->type, "c");
  EXPECT_EQ(dev->path, base::FilePath("/dev/fuse"));
  EXPECT_EQ(dev->fileMode, 438);
  EXPECT_EQ(dev->uid, 0);
  EXPECT_EQ(dev->gid, 3221225472);  // INT32_MAX < id < UINT32_MAX
  dev = &basic_config->linux_config.devices[2];
  EXPECT_EQ(dev->type, "c");
  EXPECT_EQ(dev->path, base::FilePath("/dev/binder"));
  EXPECT_EQ(dev->fileMode, 438);
  EXPECT_EQ(dev->major, 10);
  EXPECT_EQ(dev->minor, 0);
  EXPECT_EQ(dev->dynamicMinor, true);
  // Namespaces
  ASSERT_EQ(5, basic_config->linux_config.namespaces.size());
  EXPECT_EQ(basic_config->linux_config.namespaces[0].type, "pid");
  EXPECT_EQ(basic_config->linux_config.namespaces[0].path,
            base::FilePath("/proc/1234/ns/pid"));
  EXPECT_EQ(basic_config->linux_config.namespaces[1].type, "network");
  EXPECT_EQ(basic_config->linux_config.namespaces[1].path, base::FilePath(""));
  // Namespace Maps
  ASSERT_EQ(1, basic_config->linux_config.uidMappings.size());
  OciLinuxNamespaceMapping* id_map = &basic_config->linux_config.uidMappings[0];
  EXPECT_EQ(id_map->hostID, 1000);
  EXPECT_EQ(id_map->containerID, 0);
  EXPECT_EQ(id_map->size, 10);
  // seccomp
  OciSeccomp* seccomp = &basic_config->linux_config.seccomp;
  EXPECT_EQ(seccomp->defaultAction, "SCP_ACT_KILL");
  EXPECT_EQ(seccomp->architectures[0], "SCP_ARCH_X86");
  EXPECT_EQ(seccomp->syscalls[0].name, "read");
  EXPECT_EQ(seccomp->syscalls[0].action, "SCP_ACT_ALLOW");
  EXPECT_EQ(seccomp->syscalls[1].name, "write");
  EXPECT_EQ(seccomp->syscalls[1].action, "SCP_ACT_ALLOW");
  EXPECT_EQ(seccomp->syscalls[1].args[0].index, 1);
  EXPECT_EQ(seccomp->syscalls[1].args[0].value, 255);
  EXPECT_EQ(seccomp->syscalls[1].args[0].value2, 4);
  EXPECT_EQ(seccomp->syscalls[1].args[0].op, "SCMP_CMP_EQ");
  // cpu
  OciCpu* cpu = &basic_config->linux_config.cpu;
  EXPECT_EQ(cpu->shares, 1024);
  EXPECT_EQ(cpu->quota, 1000000);
  EXPECT_EQ(cpu->period, 500000);
  EXPECT_EQ(cpu->realtimeRuntime, 950000);
  EXPECT_EQ(cpu->realtimePeriod, 1000000);
  // capabilities
  const auto effective_capset =
      basic_config->process.capabilities.find("effective");
  EXPECT_NE(effective_capset, basic_config->process.capabilities.end());
  EXPECT_EQ(effective_capset->second.to_ullong(),
            (1ull << CAP_AUDIT_WRITE) | (1ull << CAP_KILL) |
                (1ull << CAP_NET_BIND_SERVICE));
  // hooks
  std::vector<OciHook>* pre_create_hooks = &basic_config->pre_create_hooks;
  ASSERT_EQ(pre_create_hooks->size(), 1);
  EXPECT_EQ((*pre_create_hooks)[0].path,
            base::FilePath("/usr/bin/setup-mounts"));
  std::vector<OciHook>* pre_start_hooks = &basic_config->pre_start_hooks;
  EXPECT_EQ(pre_start_hooks->size(), 2);
  EXPECT_EQ((*pre_start_hooks)[0].path, base::FilePath("/usr/bin/fix-mounts"));
  EXPECT_EQ((*pre_start_hooks)[0].args,
            (std::vector<std::string>{"fix-mounts", "arg1", "arg2"}));
  EXPECT_EQ((*pre_start_hooks)[0].env, (OciEnvironment{{"key1", "value1"}}));
  EXPECT_EQ((*pre_start_hooks)[1].path,
            base::FilePath("/usr/bin/setup-network"));
  std::vector<OciHook>* post_start_hooks = &basic_config->post_start_hooks;
  EXPECT_EQ(post_start_hooks->size(), 1);
  EXPECT_EQ((*post_start_hooks)[0].path,
            base::FilePath("/usr/bin/notify-start"));
  EXPECT_EQ((*post_start_hooks)[0].timeout, base::TimeDelta::FromSeconds(5));
}

TEST(OciConfigParserTest, TestStrippedConfig) {
  OciConfigPtr stripped_config(new OciConfig());
  ASSERT_TRUE(ParseContainerConfig(kStrippedJsonData, stripped_config));
}

TEST(OciConfigParserTest, TestInvalidHostnameConfig) {
  OciConfigPtr invalid_config(new OciConfig());
  ASSERT_FALSE(ParseContainerConfig(kInvalidHostnameJsonData, invalid_config));
}

}  // namespace run_oci