Unpack filesystem and whitelist from /proc/self/mountinfo

pkg/util/fs_util.go

@@ -0,0 +1,82 @@
+/*
+Copyright 2018 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"bufio"
+	pkgutil "github.com/GoogleCloudPlatform/container-diff/pkg/util"
+	"github.com/GoogleCloudPlatform/k8s-container-builder/pkg/constants"
+	"github.com/containers/image/docker"
+	"github.com/sirupsen/logrus"
+	"io"
+	"os"
+	"strings"
+)
+
+// ExtractFileSystemFromImage pulls an image and unpacks it to a file system at root
+func ExtractFileSystemFromImage(img string) error {
+	ref, err := docker.ParseReference("//" + img)
+	if err != nil {
+		return err
+	}
+	imgSrc, err := ref.NewImageSource(nil)
+	if err != nil {
+		return err
+	}
+	whitelist, err := fileSystemWhitelist(constants.WhitelistPath)
+	if err != nil {
+		return err
+	}
+	logrus.Infof("Whitelisted directories are %s", whitelist)
+	return pkgutil.GetFileSystemFromReference(ref, imgSrc, constants.RootDir, whitelist)
+}
+
+// Get whitelist from roots of mounted files
+// Each line of /proc/self/mountinfo is in the form:
+// 36 35 98:0 /mnt1 /mnt2 rw,noatime master:1 - ext3 /dev/root rw,errors=continue
+// (1)(2)(3)   (4)   (5)      (6)      (7)   (8) (9)   (10)         (11)
+// Where (5) is the mount point relative to the process's root
+// From: https://www.kernel.org/doc/Documentation/filesystems/proc.txt
+func fileSystemWhitelist(path string) ([]string, error) {
+	whitelist := []string{"/work-dir", "/dockerfile"}
+	f, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer f.Close()
+	reader := bufio.NewReader(f)
+	for {
+		line, err := reader.ReadString('\n')
+		if err != nil && err != io.EOF {
+			return nil, err
+		}
+		lineArr := strings.Split(line, " ")
+		if len(lineArr) < 5 {
+			if err == io.EOF {
+				break
+			}
+			continue
+		}
+		if lineArr[4] != constants.RootDir {
+			whitelist = append(whitelist, lineArr[4])
+		}
+		if err == io.EOF {
+			break
+		}
+	}
+	return whitelist, nil
+}

pkg/util/fs_util_test.go

@@ -0,0 +1,53 @@
+/*
+Copyright 2018 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package util
+
+import (
+	"github.com/GoogleCloudPlatform/k8s-container-builder/testutil"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"sort"
+	"testing"
+)
+
+func Test_fileSystemWhitelist(t *testing.T) {
+	testDir, err := ioutil.TempDir("", "")
+	if err != nil {
+		t.Fatalf("Error creating tempdir: %s", err)
+	}
+	fileContents := `
+	228 122 0:90 / / rw,relatime - aufs none rw,si=f8e2406af90782bc,dio,dirperm1
+	229 228 0:98 / /proc rw,nosuid,nodev,noexec,relatime - proc proc rw
+	230 228 0:99 / /dev rw,nosuid - tmpfs tmpfs rw,size=65536k,mode=755
+	231 230 0:100 / /dev/pts rw,nosuid,noexec,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=666
+	232 228 0:101 / /sys ro,nosuid,nodev,noexec,relatime - sysfs sysfs ro`
+
+	path := filepath.Join(testDir, "mountinfo")
+	if err := os.MkdirAll(filepath.Dir(path), 0750); err != nil {
+		t.Fatalf("Error creating tempdir: %s", err)
+	}
+	if err := ioutil.WriteFile(path, []byte(fileContents), 0644); err != nil {
+		t.Fatalf("Error writing file contents to %s: %s", path, err)
+	}
+
+	actualWhitelist, err := fileSystemWhitelist(path)
+	expectedWhitelist := []string{"/work-dir", "/dockerfile", "/proc", "/dev", "/dev/pts", "/sys"}
+	sort.Strings(actualWhitelist)
+	sort.Strings(expectedWhitelist)
+	testutil.CheckErrorAndDeepEqual(t, false, err, expectedWhitelist, actualWhitelist)
+}