runtimetest: add validation of mount order #88

cyphar · 2016-06-02T06:08:38Z

In order to make sure that runtimes correctly implement the ordering of
[]spec.Mount, we need to check /proc/1/mountinfo (keeping in mind that
Unix allows a user to mount over the top of an existing mountpoint --
thus masking it). We only run this test if there happen to be two
mountpoints in the list where one is a parent of the other.

An extension of this might be to check all of the nested mounts
specified in the spec.

Signed-off-by: Aleksa Sarai asarai@suse.de

wking · 2016-06-02T06:43:22Z

This seems like it overlaps with the in-flight #81 (but that may be a false-positive based on my quick skim); ping @liangchenye.

cyphar · 2016-06-02T07:37:51Z

I just realised this implementation is way too crazy. We should just iterate through /proc/1/mountinfo and then make sure that (from the bottom to make sure we don't get false positives from the parent processes' mount namespace) the order is right.

liangchenye · 2016-06-02T07:40:59Z

A little overlap :) @wking But luckily I'm working on mount existence validation and Aleksa is working on mount order.
@cyphar I think we can share and use a same mount lib.
In #81 I used docker/pkg/mount at the beginning, now I pull part of that into ocitools/cmd/runtimetest/mount.
The advantage of adding mount sub directory is we could support multiple platforms.
Would you mind to rebase your code once #81 is done?

cyphar · 2016-06-02T07:42:47Z

@liangchenye Sure, but I can't remember if docker/pkg/mount uses mountinfo or mount. We need to use mountinfo if we want to get the right list of mountpoints (specifically for masked ones).

liangchenye · 2016-06-02T07:48:21Z

@cyphar it uses mountinfo, the mountinfo struct also has 'parentID' field.
https://github.com/liangchenye/ocitools/blob/mount/cmd/runtimetest/mount/mountinfo_linux.go

cyphar · 2016-06-02T07:50:09Z

Okay cool, we can use that then. Less work for me. :P

mrunalp · 2016-06-07T22:43:59Z

#81 has been merged so this can be updated. Thanks!

Mashimiao · 2016-10-07T08:38:18Z

ping @cyphar need rebase and update.

cyphar · 2016-10-07T08:52:52Z

I haven't looked at the code in a few months, but I think I've updated this properly. PTAL.

Mashimiao · 2016-10-07T09:00:43Z

cmd/runtimetest/main.go

@@ -489,6 +605,7 @@ func validate(context *cli.Context) error {
 		validateMaskedPaths,
 		validateROPaths,
 		validateOOMScoreAdj,
+		validateMountOrder,


As mount is not Linux specified, I think we'd better put it into defaultValidations.

Yup. Fixed. I forgot that I switched to pkg/mount. :P

Mashimiao · 2016-10-07T09:25:29Z

cmd/runtimetest/main.go

+	}
+
+	cparts := filepath.SplitList(child)
+	for i, part := range filepath.SplitList(parent) {


I think here may be a little problem.
I'm not sure what SplitList() here works for. Is a mount destination can be "pathA:pathB"?
But path in Windows generally looks like "C:\test". And mount path is not allowed nested in Windows.

I'm not sure what SplitList() here works for. Is a mount destination can be "pathA:pathB"?

SplitList splits a path into each component. So "A/B" becomes []string{"A", "B"}. This code is checking if one path is lexically the parent of another. While this isn't bulletproof there isn't a nice way to deal with other cases like symlinks (though I could try using ResolveSymlinks).

But path in Windows generally looks like "C:\test". And mount path is not allowed nested in Windows.

I don't use Windows. If Windows doesn't support nested mounts, then this code is not useful for Windows (there is no meaningful concept of "order" when mounting things if you can't mask mounts with other mounts).

I'm not sure what SplitList() here works for. Is a mount destination can be "pathA:pathB"?

SplitList splits a path into each component. So "A/B" becomes []string{"A", "B"}. This code is checking if one path is lexically the parent of another. While this isn't bulletproof there isn't a nice way to deal with other cases like symlinks (though I could try using ResolveSymlinks).

I think SplitList is not used for that.
In go document's example, it works like "/a/b/c:/usr/bin" becomes []string{"/a/b/c", "/usr/bin"}.
And I tested, it really works like this.
Did I miss something?

But path in Windows generally looks like "C:\test". And mount path is not allowed nested in Windows.

I don't use Windows. If Windows doesn't support nested mounts, then this code is not useful for Windows.

In config.md of runtime-spec, "For the Windows operating system, one mount destination MUST NOT be nested within another mount. (Ex: c:\foo and c:\foo\bar)."
So, I think we should make exception for Windows.

I think SplitList is not used for that.

You're quite right. I've fixed it to use filepath.ToSlash and then strings.Split.

So, I think we should make exception for Windows.

Sure. I've added it using runtime.GOOS -- is that fine?

I think it's fine

In order to make sure that runtimes correctly implement the ordering of []spec.Mount, we need to check /proc/1/mountinfo (keeping in mind that Unix allows a user to mount over the top of an existing mountpoint -- thus masking it). We only run this test if there happen to be two mountpoints in the list where one is a parent of the other. We also don't run it on Windows. An extension of this might be to check all of the nested mounts specified in the spec. Signed-off-by: Aleksa Sarai <asarai@suse.de>

Mashimiao · 2016-10-08T03:59:19Z

cmd/runtimetest/main.go

+		return fmt.Errorf("expected %q to be a mountpoint", A)
+	}
+
+	// B must be a mountpoint iff A was first.


iff == if and only if. It's a mathematical statement which is like a two-way if-then statement. https://en.wikipedia.org/wiki/If_and_only_if

Oh, got it.
But I think using general and easy understood expression may be better.

I'll write out the words "if and only if" if it'll make you feel better. The reason I wrote it like that is because the test is testing that precise statement, namely that B will only be a mountpoint if A was first (and that if A is first then B will be a mountpoint).

Mashimiao · 2016-10-08T04:03:38Z

cmd/runtimetest/main.go

+	cparts := strings.Split(child, "/")
+	for i, part := range strings.Split(parent, "/") {
+		if cparts[i] != part {
+			return false


maybe we use filepath.Rel() can reduce the loop

Sure. I remember that I didn't use it for /some/ reason but I can't remember what it was -- so we'll just switch it.

Mashimiao · 2016-10-08T04:13:59Z

It seems currently we can just check one pair of parent and child mount points.
For the whole case, how about:
first, find all pairs of parent, child mount points
second , check whether all pairs are mounted in valid order

@cyphar how do you think about it?

cyphar · 2016-10-08T11:18:23Z

We could do that. It's just probably going to be a bit tricky to track which orderings matter (if you have mountpoints for /a, /a/b, /a/b/c in arbitrary orders what is an efficient way to check it correctly). I'm also quite busy with other patches at the moment, so if you want to carry it yourself feel free.

As I said in the actual patch, that is something we could do. It's just a bit tricky to actually test properly. I can probably take a look at it in a few weeks. Right now I'm swamped with cri-o and some runC PRs. And also university exams.

Mashimiao · 2016-10-09T01:34:42Z

@cyphar OK, got it.

Mashimiao · 2017-09-06T03:55:53Z

close in favour of #444 and #456

liangchenye mentioned this pull request Jun 2, 2016

runtimespec VS ocitools #66

Closed

76 tasks

wking mentioned this pull request Jul 22, 2016

Update runtime-spec package #140

Merged

cyphar force-pushed the add-mount-order-check branch from 8eb8d60 to 165cccf Compare October 7, 2016 08:52

cyphar force-pushed the add-mount-order-check branch from 165cccf to 428cc80 Compare October 7, 2016 08:58

Mashimiao reviewed Oct 7, 2016

View reviewed changes

cyphar force-pushed the add-mount-order-check branch from 428cc80 to 06fff77 Compare October 7, 2016 09:02

Mashimiao reviewed Oct 7, 2016

View reviewed changes

cyphar force-pushed the add-mount-order-check branch 3 times, most recently from d9dddea to a282e7c Compare October 7, 2016 09:47

Mashimiao reviewed Oct 8, 2016

View reviewed changes

liangchenye mentioned this pull request Jun 29, 2017

my oci wip liangchenye/update-service#5

Open

58 tasks

Mashimiao closed this Sep 6, 2017

cyphar deleted the add-mount-order-check branch September 6, 2017 13:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

runtimetest: add validation of mount order #88

runtimetest: add validation of mount order #88

cyphar commented Jun 2, 2016

wking commented Jun 2, 2016 via email

cyphar commented Jun 2, 2016

liangchenye commented Jun 2, 2016

cyphar commented Jun 2, 2016 •

edited

Loading

liangchenye commented Jun 2, 2016

cyphar commented Jun 2, 2016

mrunalp commented Jun 7, 2016

Mashimiao commented Oct 7, 2016

cyphar commented Oct 7, 2016

Mashimiao Oct 7, 2016

cyphar Oct 7, 2016

Mashimiao Oct 7, 2016

cyphar Oct 7, 2016 •

edited

Loading

Mashimiao Oct 7, 2016 •

edited

Loading

cyphar Oct 7, 2016

Mashimiao Oct 8, 2016

Mashimiao Oct 8, 2016

cyphar Oct 8, 2016 •

edited

Loading

Mashimiao Oct 8, 2016

cyphar Oct 8, 2016

Mashimiao Oct 8, 2016

cyphar Oct 8, 2016

Mashimiao commented Oct 8, 2016

cyphar commented Oct 8, 2016 •

edited

Loading

Mashimiao commented Oct 9, 2016

Mashimiao commented Sep 6, 2017

runtimetest: add validation of mount order #88

runtimetest: add validation of mount order #88

Conversation

cyphar commented Jun 2, 2016

wking commented Jun 2, 2016 via email

cyphar commented Jun 2, 2016

liangchenye commented Jun 2, 2016

cyphar commented Jun 2, 2016 • edited Loading

liangchenye commented Jun 2, 2016

cyphar commented Jun 2, 2016

mrunalp commented Jun 7, 2016

Mashimiao commented Oct 7, 2016

cyphar commented Oct 7, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cyphar Oct 7, 2016 • edited Loading

Choose a reason for hiding this comment

Mashimiao Oct 7, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

cyphar Oct 8, 2016 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Mashimiao commented Oct 8, 2016

cyphar commented Oct 8, 2016 • edited Loading

Mashimiao commented Oct 9, 2016

Mashimiao commented Sep 6, 2017

cyphar commented Jun 2, 2016 •

edited

Loading

cyphar Oct 7, 2016 •

edited

Loading

Mashimiao Oct 7, 2016 •

edited

Loading

cyphar Oct 8, 2016 •

edited

Loading

cyphar commented Oct 8, 2016 •

edited

Loading