tests/int/mounts_sshfs: fix sshfs setup, test rbind and propagation options by kolyshkin · Pull Request #5557 · opencontainers/runc · GitHub
Skip to content

tests/int/mounts_sshfs: fix sshfs setup, test rbind and propagation options - #5557

Open
kolyshkin wants to merge 2 commits into
opencontainers:mainfrom
kolyshkin:test-bind-no-flag-options
Open

kolyshkin wants to merge 2 commits into
opencontainers:mainfrom
kolyshkin:test-bind-no-flag-options

Conversation

@kolyshkin

Copy link
Copy Markdown
Contributor

Two test-only changes to mounts_sshfs.bats:

  1. Do not pass atime to sshfs. Since libfuse 3.15.0 (libfuse/libfuse@dba6b3983a), atime is not a known mount option, so sshfs fails with fuse: unknown option(s): `-o atime' and the tests silently fall back to tmpfs. The option is a no-op anyway, and the atime flags are reset by mount --bind -o remount right after.

  2. Test rbind and propagation options in the "--bind with no options" test. Options such as rbind, bind,rprivate, rbind,rslave are not mount flags, so, same as with plain bind, the flags of the source must be kept. The test now loops over these (with and without a user namespace) instead of duplicating the checks.

The second change catches a crun bug (containers/crun#2338), where plain bind works but rbind or a propagation option resulted in a remount clearing ro, nosuid, nodev and noexec of the source. Checked locally (tmpfs fallback): passes with runc and with crun with the fix, fails with crun without it.

Since libfuse 3.15.0 (commit dba6b3983a, "Do not pass unsupported mount
options to the kernel"), "atime" is no longer a known mount option, so
sshfs fails with:

	fuse: unknown option(s): `-o atime'

and the tests silently fall back to using tmpfs instead of fuse-sshfs.

The option is a no-op anyway (MS_NOATIME is not set by default), and
the atime flags are reset by "mount --bind -o remount" right after,
so just drop it.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
Bind mount options which are neither mount flags nor clearing flags,
i.e. "rbind" and propagation options such as "rprivate", must not
change the mount flags of the source, as it is with a plain "bind".

Extend the "--bind with no options" test to check these, too. Since
the checks were already duplicated for the user namespace case, use
a loop for that as well.

This catches a bug in crun (see containers/crun#2338), which used to
remount such bind mounts, clearing the ro, nosuid, nodev and noexec
flags of the source.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

@kolyshkin kolyshkin left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

second commit is best reviwed with --ignore-all-space

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant