erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-08-08 18:05:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
spiegel_podman/test/e2e
History
Paul Holzinger 574b78291c top: do not depend on ps(1) in container 
This ended up more complicated then expected. Lets start first with the
problem to show why I am doing this:

Currently we simply execute ps(1) in the container. This has some
drawbacks. First, obviously you need to have ps(1) in the container
image. That is no always the case especially in small images. Second,
even if you do it will often be only busybox's ps which supports far
less options.

Now we also have psgo which is used by default but that only supports a
small subset of ps(1) options. Implementing all options there is way to
much work.

Docker on the other hand executes ps(1) directly on the host and tries
to filter pids with `-q` an option which is not supported by busybox's
ps and conflicts with other ps(1) arguments. That means they fall back
to full ps(1) on the host and then filter based on the pid in the
output. This is kinda ugly and fails short because users can modify the
ps output and it may not even include the pid in the output which causes
an error.

So every solution has a different drawback, but what if we can combine
them somehow?! This commit tries exactly that.

We use ps(1) from the host and execute that in the container's pid
namespace.
There are some security concerns that must be addressed:
- mount the executable paths for ps and podman itself readonly to
  prevent the container from overwriting it via /proc/self/exe.
- set NO_NEW_PRIVS, SET_DUMPABLE and PDEATHSIG
- close all non std fds to prevent leaking files in that the caller had
  open
- unset all environment variables to not leak any into the contianer

Technically this could be a breaking change if somebody does not
have ps on the host and only in the container but I find that very
unlikely, we still have the exec in container fallback.

Because this can be insecure when the contianer has CAP_SYS_PTRACE we
still only use the podman exec version in that case.

This updates the docs accordingly, note that podman pod top never falls
back to executing ps in the container as this makes no sense with
multiple containers so I fixed the docs there as well.

Fixes #19001
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2215572

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2023-07-20 15:46:28 -04:00
..
build Do not include image annotations when building spec 2023-05-11 23:48:23 -04:00
cdi build(deps): bump github.com/container-orchestrated-devices/container-device-interface 2023-02-20 14:51:04 +01:00
config Read kube_generate_type from containers.conf 2023-04-11 09:15:05 -04:00
quadlet Trim whitespace from unit files while parsing 2023-07-13 09:05:56 -04:00
sign e2e: reduce dependency on /tmp for e2e tests 2023-01-26 22:20:15 +09:00
testdata Add (podman {image,manifest} push --sign-by-sigstore=param-file.yaml) 2023-01-27 16:47:32 +01:00
attach_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
build_test.go Support podman --remote when Containerfile is not in context directory 2023-05-22 11:58:36 -04:00
checkpoint_image_test.go e2e: GetSafeIPAddress() replaces GetRandomIPAddress 2023-06-15 11:06:40 -06:00
checkpoint_test.go GetSafeIPAddress(): discourage its use 2023-06-21 07:47:00 -06:00
cleanup_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
commit_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
common_test.go test/e2e: wait for socket 2023-07-13 09:05:56 -04:00
config.go *: migrate image registry to registry.k8s.io 2023-04-11 10:30:43 -04:00
config_amd64.go e2e tests: stop using UBI images 2023-01-06 08:21:50 -07:00
config_arm64.go e2e tests: stop using UBI images 2023-01-06 08:21:50 -07:00
config_ppc64le.go e2e tests: cleanup: capitalize CONSTANTS 2022-07-05 15:36:08 -06:00
container_clone_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
container_create_volume_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
container_inspect_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
containers_conf_test.go rootless: use default_rootless_network_cmd config 2023-07-01 14:19:57 -04:00
cp_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
create_staticip_test.go e2e: GetSafeIPAddress() replaces GetRandomIPAddress 2023-06-15 11:06:40 -06:00
create_staticmac_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
create_test.go e2e --authfile test: fix test condition 2023-06-20 08:54:09 +02:00
diff_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
events_test.go fix: podman event --filter volume=vol-name should compare the event name with volume name 2023-05-22 19:11:15 +05:30
exec_test.go Podmansh: Better error, increase timeout to 30s 2023-07-18 18:52:16 +00:00
exists_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
export_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
generate_kube_test.go Use constants for mount types 2023-07-20 15:46:27 -04:00
generate_spec_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
generate_systemd_test.go generate systemd: error on init containers 2023-05-17 14:50:23 +02:00
healthcheck_run_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
history_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
image_scp_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
image_sign_test.go e2e: refactor and document serialization 2023-05-16 04:48:55 -06:00
images_test.go make lint: re-enable ginkgolinter 2023-06-19 15:09:34 +02:00
import_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
info_test.go libpod: Podman info output more network information 2023-06-13 11:19:29 +09:00
init_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
inspect_test.go make lint: re-enable ginkgolinter 2023-06-19 15:09:34 +02:00
kill_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
libpod_suite_remote_test.go test/e2e: wait for socket 2023-07-13 09:05:56 -04:00
libpod_suite_test.go test/e2e: switch to GinkgoWriter 2023-05-02 11:27:38 +02:00
load_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
login_logout_test.go manifest inspect: support authentication 2023-07-13 09:05:56 -04:00
logs_test.go e2e: fix one of the many log flakes 2023-06-21 06:58:05 -06:00
manifest_test.go tests: fix "Storing signatures" check 2023-07-01 14:07:58 -04:00
mount_rootless_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
mount_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
negative_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
network_connect_disconnect_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
network_create_test.go network create --ip-range allow for custom range 2023-06-16 17:57:17 +02:00
network_test.go make lint: re-enable ginkgolinter 2023-06-19 15:09:34 +02:00
pause_test.go make lint: re-enable ginkgolinter 2023-06-19 15:09:34 +02:00
play_build_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
play_kube_test.go Use constants for mount types 2023-07-20 15:46:27 -04:00
pod_clone_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_create_test.go e2e: use parallel-safe /dev subdirectories 2023-06-21 13:43:19 -06:00
pod_infra_container_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_initcontainers_test.go source code comments and docs: fix typos, language, Markdown layout 2023-05-22 07:52:16 +02:00
pod_inspect_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_kill_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_pause_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_pod_namespaces_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_prune_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_ps_test.go test/e2e: add regression testing for comma-containing labels 2023-05-25 22:56:27 +02:00
pod_restart_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_rm_test.go Fix an expected error message from pod removal 2023-06-07 14:09:12 -04:00
pod_start_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_stats_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_stop_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
pod_top_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
port_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
prune_test.go make lint: re-enable ginkgolinter 2023-06-19 15:09:34 +02:00
ps_test.go test/e2e: add regression testing for comma-containing labels 2023-05-25 22:56:27 +02:00
pull_test.go podman: add support for splitting imagestore 2023-06-17 08:51:08 +05:30
push_test.go tests: fix "Storing signatures" check 2023-07-01 14:07:58 -04:00
quadlet_test.go quadlet should exit non zero on failures 2023-06-15 19:12:17 -04:00
rename_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
restart_test.go make lint: re-enable ginkgolinter 2023-06-19 15:09:34 +02:00
rm_test.go make lint: re-enable ginkgolinter 2023-06-19 15:09:34 +02:00
rmi_test.go In a concurrent removal test, don't remove concurrently with builds 2023-05-23 18:14:33 +02:00
run_aardvark_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_apparmor_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_cgroup_parent_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_cleanup_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_cpu_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_device_test.go e2e: use parallel-safe /dev subdirectories 2023-06-21 13:43:19 -06:00
run_dns_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_entrypoint_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_env_test.go run,create: modify --env-merge behavior for non-existent vars 2023-06-22 15:42:55 +05:30
run_exit_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_memory_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_networking_test.go netavark: macvlan networks keep custom nameservers 2023-07-13 09:05:56 -04:00
run_ns_test.go Revert "test/e2e: fix "podman run ipcns ipcmk container test"" 2023-06-01 16:27:27 -04:00
run_passwd_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_privileged_test.go e2e: use parallel-safe /dev subdirectories 2023-06-21 13:43:19 -06:00
run_restart_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_seccomp_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_security_labels_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_selinux_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_signal_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_staticip_test.go e2e: GetSafeIPAddress() replaces GetRandomIPAddress 2023-06-15 11:06:40 -06:00
run_test.go Use constants for mount types 2023-07-20 15:46:27 -04:00
run_transient_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_userns_test.go run: ignore PODMAN_USERNS with --pod 2023-05-17 16:49:16 +02:00
run_volume_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
run_working_dir_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
runlabel_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
save_test.go Merge pull request #18563 from vrothberg/fix-15897 2023-05-15 13:20:18 -04:00
search_test.go fix(command): ignore --format in podman search --list-tags 2023-06-30 10:18:15 -04:00
secret_test.go test/e2e: add regression testing for comma-containing labels 2023-05-25 22:56:27 +02:00
start_test.go make lint: re-enable ginkgolinter 2023-06-19 15:09:34 +02:00
stats_test.go stats: get mem limit from the cgroup 2023-05-19 14:59:43 +02:00
stop_test.go make lint: re-enable ginkgolinter 2023-06-19 15:09:34 +02:00
system_connection_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
system_df_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
system_dial_stdio_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
system_reset_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
system_service_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
systemd_activate_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
systemd_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
tag_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
toolbox_test.go Use constants for mount types 2023-07-20 15:46:27 -04:00
top_test.go top: do not depend on ps(1) in container 2023-07-20 15:46:28 -04:00
tree_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
trust_test.go e2e: add ginkgo decorators to address flakes 2023-06-07 07:10:25 -06:00
unshare_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
untag_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
update_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
version_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
volume_create_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
volume_exists_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
volume_inspect_test.go Use constants for mount types 2023-07-20 15:46:27 -04:00
volume_ls_test.go Fix multiple filter options logic for podman volume ls 2023-07-20 15:46:27 -04:00
volume_plugin_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
volume_prune_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
volume_rm_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00
wait_test.go test/e2e: dedup Before/AfterEach nodes 2023-05-15 16:56:18 +02:00