Merge pull request #6554 from tianon/fix-dyntest
Fix dyntest and rename it to dyntest-unit to match the test-unit rename
diff --git a/archive/archive.go b/archive/archive.go
index 76c6e31..1982218 100644
--- a/archive/archive.go
+++ b/archive/archive.go
@@ -262,11 +262,11 @@
ts := []syscall.Timespec{timeToTimespec(hdr.AccessTime), timeToTimespec(hdr.ModTime)}
// syscall.UtimesNano doesn't support a NOFOLLOW flag atm, and
if hdr.Typeflag != tar.TypeSymlink {
- if err := system.UtimesNano(path, ts); err != nil {
+ if err := system.UtimesNano(path, ts); err != nil && err != system.ErrNotSupportedPlatform {
return err
}
} else {
- if err := system.LUtimesNano(path, ts); err != nil {
+ if err := system.LUtimesNano(path, ts); err != nil && err != system.ErrNotSupportedPlatform {
return err
}
}
diff --git a/daemon/execdriver/lxc/driver.go b/daemon/execdriver/lxc/driver.go
index 118eab1..59daf1a 100644
--- a/daemon/execdriver/lxc/driver.go
+++ b/daemon/execdriver/lxc/driver.go
@@ -19,7 +19,6 @@
"github.com/docker/libcontainer/label"
"github.com/docker/libcontainer/mount/nodes"
"github.com/dotcloud/docker/daemon/execdriver"
- "github.com/dotcloud/docker/pkg/system"
"github.com/dotcloud/docker/utils"
)
@@ -37,16 +36,7 @@
if err := setupNetworking(args); err != nil {
return err
}
- if err := setupCapabilities(args); err != nil {
- return err
- }
- if err := setupWorkingDirectory(args); err != nil {
- return err
- }
- if err := system.CloseFdsFrom(3); err != nil {
- return err
- }
- if err := changeUser(args); err != nil {
+ if err := finalizeNamespace(args); err != nil {
return err
}
diff --git a/daemon/execdriver/lxc/init.go b/daemon/execdriver/lxc/init.go
index e687a9d..1af7730 100644
--- a/daemon/execdriver/lxc/init.go
+++ b/daemon/execdriver/lxc/init.go
@@ -11,8 +11,6 @@
"github.com/docker/libcontainer/netlink"
"github.com/dotcloud/docker/daemon/execdriver"
- "github.com/dotcloud/docker/pkg/user"
- "github.com/syndtr/gocapability/capability"
)
// Clear environment pollution introduced by lxc-start
@@ -107,65 +105,6 @@
return nil
}
-// Takes care of dropping privileges to the desired user
-func changeUser(args *execdriver.InitArgs) error {
- uid, gid, suppGids, err := user.GetUserGroupSupplementary(
- args.User,
- syscall.Getuid(), syscall.Getgid(),
- )
- if err != nil {
- return err
- }
-
- if err := syscall.Setgroups(suppGids); err != nil {
- return fmt.Errorf("Setgroups failed: %v", err)
- }
- if err := syscall.Setgid(gid); err != nil {
- return fmt.Errorf("Setgid failed: %v", err)
- }
- if err := syscall.Setuid(uid); err != nil {
- return fmt.Errorf("Setuid failed: %v", err)
- }
-
- return nil
-}
-
-func setupCapabilities(args *execdriver.InitArgs) error {
- if args.Privileged {
- return nil
- }
-
- drop := []capability.Cap{
- capability.CAP_SETPCAP,
- capability.CAP_SYS_MODULE,
- capability.CAP_SYS_RAWIO,
- capability.CAP_SYS_PACCT,
- capability.CAP_SYS_ADMIN,
- capability.CAP_SYS_NICE,
- capability.CAP_SYS_RESOURCE,
- capability.CAP_SYS_TIME,
- capability.CAP_SYS_TTY_CONFIG,
- capability.CAP_AUDIT_WRITE,
- capability.CAP_AUDIT_CONTROL,
- capability.CAP_MAC_OVERRIDE,
- capability.CAP_MAC_ADMIN,
- capability.CAP_NET_ADMIN,
- capability.CAP_SYSLOG,
- }
-
- c, err := capability.NewPid(os.Getpid())
- if err != nil {
- return err
- }
-
- c.Unset(capability.CAPS|capability.BOUNDS, drop...)
-
- if err := c.Apply(capability.CAPS | capability.BOUNDS); err != nil {
- return err
- }
- return nil
-}
-
func getEnv(args *execdriver.InitArgs, key string) string {
for _, kv := range args.Env {
parts := strings.SplitN(kv, "=", 2)
diff --git a/daemon/execdriver/lxc/lxc_init_linux.go b/daemon/execdriver/lxc/lxc_init_linux.go
index 7288f58..3b15d09 100644
--- a/daemon/execdriver/lxc/lxc_init_linux.go
+++ b/daemon/execdriver/lxc/lxc_init_linux.go
@@ -3,9 +3,60 @@
package lxc
import (
+ "fmt"
"syscall"
+
+ "github.com/docker/libcontainer/namespaces"
+ "github.com/docker/libcontainer/security/capabilities"
+ "github.com/docker/libcontainer/utils"
+ "github.com/dotcloud/docker/daemon/execdriver"
+ "github.com/dotcloud/docker/daemon/execdriver/native/template"
+ "github.com/dotcloud/docker/pkg/system"
)
func setHostname(hostname string) error {
return syscall.Sethostname([]byte(hostname))
}
+
+func finalizeNamespace(args *execdriver.InitArgs) error {
+ if err := utils.CloseExecFrom(3); err != nil {
+ return err
+ }
+
+ // We use the native drivers default template so that things like caps are consistent
+ // across both drivers
+ container := template.New()
+
+ if !args.Privileged {
+ // drop capabilities in bounding set before changing user
+ if err := capabilities.DropBoundingSet(container); err != nil {
+ return fmt.Errorf("drop bounding set %s", err)
+ }
+
+ // preserve existing capabilities while we change users
+ if err := system.SetKeepCaps(); err != nil {
+ return fmt.Errorf("set keep caps %s", err)
+ }
+ }
+
+ if err := namespaces.SetupUser(args.User); err != nil {
+ return fmt.Errorf("setup user %s", err)
+ }
+
+ if !args.Privileged {
+ if err := system.ClearKeepCaps(); err != nil {
+ return fmt.Errorf("clear keep caps %s", err)
+ }
+
+ // drop all other capabilities
+ if err := capabilities.DropCapabilities(container); err != nil {
+ return fmt.Errorf("drop capabilities %s", err)
+ }
+ }
+
+ if err := setupWorkingDirectory(args); err != nil {
+ return err
+ }
+
+ return nil
+}
diff --git a/daemon/execdriver/lxc/lxc_init_unsupported.go b/daemon/execdriver/lxc/lxc_init_unsupported.go
index d68cb91..079446e 100644
--- a/daemon/execdriver/lxc/lxc_init_unsupported.go
+++ b/daemon/execdriver/lxc/lxc_init_unsupported.go
@@ -2,6 +2,12 @@
package lxc
+import "github.com/dotcloud/docker/daemon/execdriver"
+
func setHostname(hostname string) error {
panic("Not supported on darwin")
}
+
+func finalizeNamespace(args *execdriver.InitArgs) error {
+ panic("Not supported on darwin")
+}
diff --git a/pkg/graphdb/graphdb.go b/pkg/graphdb/graphdb.go
index 46a23b1..d0e049b 100644
--- a/pkg/graphdb/graphdb.go
+++ b/pkg/graphdb/graphdb.go
@@ -64,6 +64,11 @@
if strings.Contains(str, "UNIQUE constraint failed") && strings.Contains(str, "edge.name") {
return true
}
+ // sqlite-3.6.20-1.el6 returns:
+ // Set failure: Abort due to constraint violation: constraint failed
+ if strings.HasSuffix(str, "constraint failed") {
+ return true
+ }
return false
}
diff --git a/pkg/system/unsupported.go b/pkg/system/unsupported.go
index 96ebc85..aea4b69 100644
--- a/pkg/system/unsupported.go
+++ b/pkg/system/unsupported.go
@@ -28,3 +28,11 @@
func CreateMasterAndConsole() (*os.File, string, error) {
return nil, "", ErrNotSupportedPlatform
}
+
+func SetKeepCaps() error {
+ return ErrNotSupportedPlatform
+}
+
+func ClearKeepCaps() error {
+ return ErrNotSupportedPlatform
+}
diff --git a/pkg/system/utimes_darwin.go b/pkg/system/utimes_darwin.go
new file mode 100644
index 0000000..4c6002f
--- /dev/null
+++ b/pkg/system/utimes_darwin.go
@@ -0,0 +1,11 @@
+package system
+
+import "syscall"
+
+func LUtimesNano(path string, ts []syscall.Timespec) error {
+ return ErrNotSupportedPlatform
+}
+
+func UtimesNano(path string, ts []syscall.Timespec) error {
+ return syscall.UtimesNano(path, ts)
+}
diff --git a/pkg/system/utimes_linux.go b/pkg/system/utimes_linux.go
index c00f402..8f90298 100644
--- a/pkg/system/utimes_linux.go
+++ b/pkg/system/utimes_linux.go
@@ -24,8 +24,5 @@
}
func UtimesNano(path string, ts []syscall.Timespec) error {
- if err := syscall.UtimesNano(path, ts); err != nil {
- return err
- }
- return nil
+ return syscall.UtimesNano(path, ts)
}
diff --git a/pkg/system/utimes_unsupported.go b/pkg/system/utimes_unsupported.go
index 9a8cf9c..adf2734 100644
--- a/pkg/system/utimes_unsupported.go
+++ b/pkg/system/utimes_unsupported.go
@@ -1,4 +1,4 @@
-// +build !linux,!freebsd
+// +build !linux,!freebsd,!darwin
package system
