Skip to content

Commit 0c5d7d7

Browse files
cdouglascdouglas
committed
HADOOP-15195. With SELinux enabled, directories mounted with start-build-env.sh may not be accessible. Contributed by Grigori Rybkine
1 parent 9cc6d1d commit 0c5d7d7

File tree

2 files changed

+131
-3
lines changed

2 files changed

+131
-3
lines changed

‎hadoop-common-project/hadoop-common/src/test/scripts/start-build-env.bats

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
# Licensed to the Apache Software Foundation (ASF) under one or more
2+
# contributor license agreements. See the NOTICE file distributed with
3+
# this work for additional information regarding copyright ownership.
4+
# The ASF licenses this file to You under the Apache License, Version 2.0
5+
# (the "License"); you may not use this file except in compliance with
6+
# the License. You may obtain a copy of the License at
7+
#
8+
# http://www.apache.org/licenses/LICENSE-2.0
9+
#
10+
# Unless required by applicable law or agreed to in writing, software
11+
# distributed under the License is distributed on an "AS IS" BASIS,
12+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
# See the License for the specific language governing permissions and
14+
# limitations under the License.
15+
16+
load hadoop-functions_test_helper
17+
18+
# Mock docker command
19+
docker () {
20+
if [ "$1" = "-v" ]; then
21+
shift
22+
echo Docker version ${DCKR_MOCK_VER:?}
23+
elif [ "$1" = run ]; then
24+
shift
25+
until [ $# -eq 0 ]; do
26+
if [ "$1" = -v ]; then
27+
shift
28+
echo "$1"|awk -F':' '{if (NF == 3 && $3 == "z")
29+
printf "Mounted %s with z option.\n", $1
30+
else if (NF == 2)
31+
printf "Mounted %s without z option.\n", $1}'
32+
fi
33+
shift
34+
done
35+
fi
36+
}
37+
export -f docker
38+
export DCKR_MOCK_VER
39+
40+
# Mock a SELinux enabled system
41+
enable_selinux () {
42+
mkdir -p "${TMP}/bin"
43+
echo true >"${TMP}/bin"/selinuxenabled
44+
chmod a+x "${TMP}/bin"/selinuxenabled
45+
if [ "${PATH#${TMP}/bin}" = "${PATH}" ]; then
46+
PATH="${TMP}/bin":"$PATH"
47+
fi
48+
}
49+
50+
setup_user () {
51+
if [ -z "$(printenv USER)" ]; then
52+
if [ -z "$USER" ]; then
53+
USER=${HOME##*/}
54+
fi
55+
export USER
56+
fi
57+
}
58+
59+
# Mock stat command as used in start-build-env.sh
60+
stat () {
61+
if [ "$1" = --printf='%C' -a $# -eq 2 ]; then
62+
printf 'mock_u:mock_r:mock_t:s0'
63+
else
64+
command stat "$@"
65+
fi
66+
}
67+
export -f stat
68+
69+
# Verify that host directories get mounted without z option
70+
# and INFO messages get printed out
71+
@test "start-build-env.sh (Docker without z mount option)" {
72+
if [ "$(uname -s)" != "Linux" ]; then
73+
skip "Not on Linux platform"
74+
fi
75+
enable_selinux
76+
setup_user
77+
DCKR_MOCK_VER=1.4
78+
run "${BATS_TEST_DIRNAME}/../../../../../start-build-env.sh"
79+
[ "$status" -eq 0 ]
80+
[[ ${lines[0]} == "INFO: SELinux is enabled." ]]
81+
[[ ${lines[1]} =~ \
82+
"Mounted ".*" may not be accessible to the container." ]]
83+
[[ ${lines[2]} == \
84+
"INFO: If so, on the host, run the following command:" ]]
85+
[[ ${lines[3]} =~ "# chcon -Rt svirt_sandbox_file_t " ]]
86+
[[ ${lines[-2]} =~ "Mounted ".*" without z option." ]]
87+
[[ ${lines[-1]} =~ "Mounted ".*" without z option." ]]
88+
}
89+
90+
# Verify that host directories get mounted with z option
91+
@test "start-build-env.sh (Docker with z mount option)" {
92+
if [ "$(uname -s)" != "Linux" ]; then
93+
skip "Not on Linux platform"
94+
fi
95+
enable_selinux
96+
setup_user
97+
DCKR_MOCK_VER=1.7
98+
run "${BATS_TEST_DIRNAME}/../../../../../start-build-env.sh"
99+
[ "$status" -eq 0 ]
100+
[[ ${lines[-2]} =~ "Mounted ".*" with z option." ]]
101+
[[ ${lines[-1]} =~ "Mounted ".*" with z option." ]]
102+
}

‎start-build-env.sh

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,36 @@ cd "$(dirname "$0")" # connect to root
2121

2222
docker build -t hadoop-build dev-support/docker
2323

24-
if [ "$(uname -s)" == "Linux" ]; then
24+
if [ "$(uname -s)" = "Linux" ]; then
2525
USER_NAME=${SUDO_USER:=$USER}
2626
USER_ID=$(id -u "${USER_NAME}")
2727
GROUP_ID=$(id -g "${USER_NAME}")
28+
# man docker-run
29+
# When using SELinux, mounted directories may not be accessible
30+
# to the container. To work around this, with Docker prior to 1.7
31+
# one needs to run the "chcon -Rt svirt_sandbox_file_t" command on
32+
# the directories. With Docker 1.7 and later the z mount option
33+
# does this automatically.
34+
if command -v selinuxenabled >/dev/null && selinuxenabled; then
35+
DCKR_VER=$(docker -v|
36+
awk '$1 == "Docker" && $2 == "version" {split($3,ver,".");print ver[1]"."ver[2]}')
37+
DCKR_MAJ=${DCKR_VER%.*}
38+
DCKR_MIN=${DCKR_VER#*.}
39+
if [ "${DCKR_MAJ}" -eq 1 ] && [ "${DCKR_MIN}" -ge 7 ] ||
40+
[ "${DCKR_MAJ}" -gt 1 ]; then
41+
V_OPTS=:z
42+
else
43+
for d in "${PWD}" "${HOME}/.m2"; do
44+
ctx=$(stat --printf='%C' "$d"|cut -d':' -f3)
45+
if [ "$ctx" != svirt_sandbox_file_t ] && [ "$ctx" != container_file_t ]; then
46+
printf 'INFO: SELinux is enabled.\n'
47+
printf '\tMounted %s may not be accessible to the container.\n' "$d"
48+
printf 'INFO: If so, on the host, run the following command:\n'
49+
printf '\t# chcon -Rt svirt_sandbox_file_t %s\n' "$d"
50+
fi
51+
done
52+
fi
53+
fi
2854
else # boot2docker uid and gid
2955
USER_NAME=$USER
3056
USER_ID=1000
@@ -45,8 +71,8 @@ UserSpecificDocker
4571
# system. And this also is a significant speedup in subsequent
4672
# builds because the dependencies are downloaded only once.
4773
docker run --rm=true -t -i \
48-
-v "${PWD}:/home/${USER_NAME}/hadoop" \
74+
-v "${PWD}:/home/${USER_NAME}/hadoop${V_OPTS:-}" \
4975
-w "/home/${USER_NAME}/hadoop" \
50-
-v "${HOME}/.m2:/home/${USER_NAME}/.m2" \
76+
-v "${HOME}/.m2:/home/${USER_NAME}/.m2${V_OPTS:-}" \
5177
-u "${USER_NAME}" \
5278
"hadoop-build-${USER_ID}"

0 commit comments

Comments
 (0)