Change for running as a non-root user (#276)

* Enable running container as mqm * Fix merge problem * Don't force root usage * RHEL image runs as mqm instead of root * Build on host with SELinux enabled * Enable building on node in an OpenShift cluster * Enable running container as mqm * Fix merge problem * Don't force root usage * Merge lastest changes from master * RHEL image runs as mqm instead of root * Fix merge issues * Test changes for non-root * Make timeout properly, and more non-root test fixes * Run tests with fewer/no capabilities * Correct usage docs for non-root * Add security docs * Add temporary debug output * Remove debug code * Fixes for termination-log * Allow init container to run as root * Fixes for CentOS build * Fixes for RHEL build * Logging improvements * Fix Dockerfile RHEL/CentOS build * Fix bash error * Make all builds specify UID * Use redist client for Go SDK * Inspect image before running tests * New test for init container * Log container runtime in runmqdevserver * Add extra capabilities if using a RHEL image
2019-02-25 15:44:14 +00:00
parent 2dbee560fe
commit cc0f072908
35 changed files with 871 additions and 504 deletions
--- a/internal/containerruntime/runtime_linux.go
+++ b/internal/containerruntime/runtime_linux.go
@@ -0,0 +1,126 @@
+// +build linux
+
+/*
+© Copyright IBM Corporation 2017, 2019
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+package runtime
+
+import (
+	"golang.org/x/sys/unix"
+)
+
+// fsTypes contains file system identifier codes.
+// This code will not compile on some operating systems - Linux only.
+var fsTypes = map[int64]string{
+	0x61756673: "aufs",
+	0xef53:     "ext",
+	0x6969:     "nfs",
+	0x65735546: "fuse",
+	0x9123683e: "btrfs",
+	0x01021994: "tmpfs",
+	0x794c7630: "overlayfs",
+	0x58465342: "xfs",
+	// less popular codes
+	0xadf5:     "adfs",
+	0xadff:     "affs",
+	0x5346414F: "afs",
+	0x0187:     "autofs",
+	0x73757245: "coda",
+	0x28cd3d45: "cramfs",
+	0x453dcd28: "cramfs",
+	0x64626720: "debugfs",
+	0x73636673: "securityfs",
+	0xf97cff8c: "selinux",
+	0x43415d53: "smack",
+	0x858458f6: "ramfs",
+	0x958458f6: "hugetlbfs",
+	0x73717368: "squashfs",
+	0xf15f:     "ecryptfs",
+	0x414A53:   "efs",
+	0xabba1974: "xenfs",
+	0x3434:     "nilfs",
+	0xF2F52010: "f2fs",
+	0xf995e849: "hpfs",
+	0x9660:     "isofs",
+	0x72b6:     "jffs2",
+	0x6165676C: "pstorefs",
+	0xde5e81e4: "efivarfs",
+	0x00c0ffee: "hostfs",
+	0x137F:     "minix_14",  // minix v1 fs, 14 char names
+	0x138F:     "minix_30",  // minix v1 fs, 30 char names
+	0x2468:     "minix2_14", // minix v2 fs, 14 char names
+	0x2478:     "minix2_30", // minix v2 fs, 30 char names
+	0x4d5a:     "minix3_60", // minix v3 fs, 60 char names
+	0x4d44:     "msdos",
+	0x564c:     "ncp",
+	0x7461636f: "ocfs2",
+	0x9fa1:     "openprom",
+	0x002f:     "qnx4",
+	0x68191122: "qnx6",
+	0x6B414653: "afs_fs",
+	0x52654973: "reiserfs",
+	0x517B:     "smb",
+	0x27e0eb:   "cgroup",
+	0x63677270: "cgroup2",
+	0x7655821:  "rdtgroup",
+	0x57AC6E9D: "stack_end",
+	0x74726163: "tracefs",
+	0x01021997: "v9fs",
+	0x62646576: "bdevfs",
+	0x64646178: "daxfs",
+	0x42494e4d: "binfmtfs",
+	0x1cd1:     "devpts",
+	0xBAD1DEA:  "futexfs",
+	0x50495045: "pipefs",
+	0x9fa0:     "proc",
+	0x534F434B: "sockfs",
+	0x62656572: "sysfs",
+	0x9fa2:     "usbdevice",
+	0x11307854: "mtd_inode",
+	0x09041934: "anon_inode",
+	0x73727279: "btrfs",
+	0x6e736673: "nsfs",
+	0xcafe4a11: "bpf",
+	0x5a3c69f0: "aafs",
+	0x15013346: "udf",
+	0x13661366: "balloon_kvm",
+	0x58295829: "zsmalloc",
+}
+
+// GetFilesystem returns the filesystem type for the specified path
+func GetFilesystem(path string) (string, error) {
+	statfs := &unix.Statfs_t{}
+	err := unix.Statfs(path, statfs)
+	if err != nil {
+		return "", err
+	}
+	// Use a type conversion to make type an int64.  On s390x it's a uint32.
+	t, ok := fsTypes[int64(statfs.Type)]
+	if !ok {
+		return "unknown", nil
+		// log.Printf("WARNING: detected %v has unknown filesystem type %x", path, statfs.Type)
+	}
+	return t, nil
+}
+
+// SupportedFilesystem returns true if the supplied filesystem type is supported for MQ data
+func SupportedFilesystem(fsType string) bool {
+	switch fsType {
+	case "aufs", "overlayfs", "tmpfs":
+		return false
+	default:
+		return true
+	}
+}