From 08fdf875ae019d7c43a1e08da0ef113a8f75b645 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Mon, 2 Oct 2023 13:32:02 +0200 Subject: [PATCH 01/15] Unify the build with RHEL This pulls in an extra patch [1] that's necessary to fix the build on only CentOS Stream 9, not Fedora. While not needed, it also doesn't hurt Fedora and has the added benefit of keeping the build unified with RHEL. There's no need to do a build just for this. [1] Upstream commit f555029304415a06 https://github.com/containers/toolbox/commit/f555029304415a06 https://github.com/containers/toolbox/issues/1246 --- toolbox-Build-fixes.patch | 240 ++++++++++++++++++ ...se-podman-1-when-generating-the-comp.patch | 89 ------- toolbox-Sprinkle-a-debug-log.patch | 22 -- toolbox.spec | 6 +- 4 files changed, 243 insertions(+), 114 deletions(-) create mode 100644 toolbox-Build-fixes.patch delete mode 100644 toolbox-Don-t-use-podman-1-when-generating-the-comp.patch delete mode 100644 toolbox-Sprinkle-a-debug-log.patch diff --git a/toolbox-Build-fixes.patch b/toolbox-Build-fixes.patch new file mode 100644 index 0000000..32164ef --- /dev/null +++ b/toolbox-Build-fixes.patch @@ -0,0 +1,240 @@ +From 424cc42fba3cb182a360dcdda68caf20d9141ae6 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Tue, 28 Feb 2023 17:12:04 +0100 +Subject: [PATCH 1/4] cmd/root: Don't use podman(1) when generating the + completions + +Ever since commit bafbbe81c9220cb3, the shell completions are generated +while building Toolbx using the 'completion' command. This involves +running toolbox(1) itself, and hence invoking 'podman version' to decide +if 'podman system migrate' is needed or not. + +Unfortunately, some build environments, like Fedora's, are set up inside +a chroot(2) or systemd-nspawn(1) or similar, where 'podman version' may +not work because it does various things with namespaces(7) and clone(2) +that can, under certain circumstances, encounter an EPERM. + +Therefore, it's better to avoid using podman(1) when generating the +shell completions, especially, since they are generated by Cobra itself +and podman(1) is not involved at all. + +Note that podman(1) is needed when the generated shell completions are +actually used in interactive command line environments. The shell +completions invoke the hidden '__complete' command to get the results +that are presented to the user, and, if needed, 'podman system migrate' +will continue to be run as part of that. + +This partially reverts commit f3e005d0142d7ec76d5ac8f0a2f331a52fd46011 +because podman(1) is now only an optional runtime dependency for the +system tests. + +https://github.com/containers/podman/issues/17657 +--- + meson.build | 2 +- + src/cmd/root.go | 9 +++++++-- + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/meson.build b/meson.build +index 6f044bb204e3..653a3d3ac588 100644 +--- a/meson.build ++++ b/meson.build +@@ -18,12 +18,12 @@ subid_dep = cc.find_library('subid', has_headers: ['shadow/subid.h']) + + go = find_program('go') + go_md2man = find_program('go-md2man') +-podman = find_program('podman') + + bats = find_program('bats', required: false) + codespell = find_program('codespell', required: false) + htpasswd = find_program('htpasswd', required: false) + openssl = find_program('openssl', required: false) ++podman = find_program('podman', required: false) + shellcheck = find_program('shellcheck', required: false) + skopeo = find_program('skopeo', required: false) + +diff --git a/src/cmd/root.go b/src/cmd/root.go +index 304b03dcd889..9975ccc7a4c8 100644 +--- a/src/cmd/root.go ++++ b/src/cmd/root.go +@@ -166,7 +166,7 @@ func preRun(cmd *cobra.Command, args []string) error { + + logrus.Debugf("TOOLBOX_PATH is %s", toolboxPath) + +- if err := migrate(); err != nil { ++ if err := migrate(cmd, args); err != nil { + return err + } + +@@ -211,13 +211,18 @@ func rootRun(cmd *cobra.Command, args []string) error { + return rootRunImpl(cmd, args) + } + +-func migrate() error { ++func migrate(cmd *cobra.Command, args []string) error { + logrus.Debug("Migrating to newer Podman") + + if utils.IsInsideContainer() { + return nil + } + ++ if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName { ++ logrus.Debugf("Migration not needed: command %s doesn't need it", cmdName) ++ return nil ++ } ++ + configDir, err := os.UserConfigDir() + if err != nil { + logrus.Debugf("Migrating to newer Podman: failed to get the user config directory: %s", err) +-- +2.41.0 + + +From 0723706168a1bde708bc9acc203c5e9870bc94d5 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Wed, 1 Mar 2023 19:41:56 +0100 +Subject: [PATCH 2/4] cmd/root: Sprinkle a debug log + +https://github.com/containers/toolbox/pull/1251 +--- + src/cmd/root.go | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/cmd/root.go b/src/cmd/root.go +index 9975ccc7a4c8..2e7428a20b24 100644 +--- a/src/cmd/root.go ++++ b/src/cmd/root.go +@@ -215,6 +215,7 @@ func migrate(cmd *cobra.Command, args []string) error { + logrus.Debug("Migrating to newer Podman") + + if utils.IsInsideContainer() { ++ logrus.Debug("Migration not needed: running inside a container") + return nil + } + +-- +2.41.0 + + +From 0736db58456bb635854493e28a0c36bda49988ce Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Wed, 1 Mar 2023 19:46:11 +0100 +Subject: [PATCH 3/4] cmd/root: Shuffle some code around and sprinkle some + debug logs + +Having a separate convenience function reduces the indentation levels by +at least one, and sometimes two, and makes it easy to have more detailed +debug logs. + +This will make the subsequent commit easier to read. + +https://github.com/containers/toolbox/issues/1246 +--- + src/cmd/root.go | 32 ++++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +diff --git a/src/cmd/root.go b/src/cmd/root.go +index 2e7428a20b24..9aafe3e0d3be 100644 +--- a/src/cmd/root.go ++++ b/src/cmd/root.go +@@ -1,5 +1,5 @@ + /* +- * Copyright © 2019 – 2022 Red Hat Inc. ++ * Copyright © 2019 – 2023 Red Hat Inc. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. +@@ -139,13 +139,8 @@ func preRun(cmd *cobra.Command, args []string) error { + if !utils.IsInsideContainer() { + logrus.Debugf("Running on a cgroups v%d host", cgroupsVersion) + +- if currentUser.Uid != "0" { +- logrus.Debugf("Looking for sub-GID and sub-UID ranges for user %s", currentUser.Username) +- +- if _, err := utils.ValidateSubIDRanges(currentUser); err != nil { +- logrus.Debugf("Looking for sub-GID and sub-UID ranges: %s", err) +- return newSubIDError() +- } ++ if _, err := validateSubIDRanges(cmd, args, currentUser); err != nil { ++ return err + } + } + +@@ -392,3 +387,24 @@ func setUpLoggers() error { + + return nil + } ++ ++func validateSubIDRanges(cmd *cobra.Command, args []string, user *user.User) (bool, error) { ++ logrus.Debugf("Looking for sub-GID and sub-UID ranges for user %s", user.Username) ++ ++ if user.Uid == "0" { ++ logrus.Debugf("Look-up not needed: user %s doesn't need them", user.Username) ++ return true, nil ++ } ++ ++ if utils.IsInsideContainer() { ++ logrus.Debug("Look-up not needed: running inside a container") ++ return true, nil ++ } ++ ++ if _, err := utils.ValidateSubIDRanges(user); err != nil { ++ logrus.Debugf("Looking for sub-GID and sub-UID ranges: %s", err) ++ return false, newSubIDError() ++ } ++ ++ return true, nil ++} +-- +2.41.0 + + +From 02537eac420f49e96110663794ef5f2511eb6860 Mon Sep 17 00:00:00 2001 +From: Jan Zerebecki +Date: Wed, 1 Mar 2023 19:52:28 +0100 +Subject: [PATCH 4/4] cmd/root: Don't validate subordinate IDs when generating + the completions + +Ever since commit bafbbe81c9220cb3, the shell completions are generated +while building Toolbx using the 'completion' command. This involves +running toolbox(1) itself, and hence validating the subordinate user and +group ID ranges. + +Unfortunately, some build environments, like openSUSE's, don't have +subordinate ID ranges set up. Therefore, it's better to not validate +the subordinate ID ranges when generating the shell completions, since +they are generated by Cobra itself and subordinate ID ranges are not +involved at all. + +Note that subordinate ID ranges may be needed when the generated shell +completions are actually used in interactive command line environments. +The shell completions invoke the hidden '__complete' command to get the +results that are presented to the user, and, if needed, the subordinate +ID ranges will continue to be used by podman(1) as part of that. + +Some changes by Debarshi Ray. + +https://github.com/containers/toolbox/issues/1246 +https://github.com/containers/toolbox/pull/1249 +--- + src/cmd/root.go | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/cmd/root.go b/src/cmd/root.go +index 9aafe3e0d3be..aee9fe026ac3 100644 +--- a/src/cmd/root.go ++++ b/src/cmd/root.go +@@ -401,6 +401,11 @@ func validateSubIDRanges(cmd *cobra.Command, args []string, user *user.User) (bo + return true, nil + } + ++ if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName { ++ logrus.Debugf("Look-up not needed: command %s doesn't need them", cmdName) ++ return true, nil ++ } ++ + if _, err := utils.ValidateSubIDRanges(user); err != nil { + logrus.Debugf("Looking for sub-GID and sub-UID ranges: %s", err) + return false, newSubIDError() +-- +2.41.0 + diff --git a/toolbox-Don-t-use-podman-1-when-generating-the-comp.patch b/toolbox-Don-t-use-podman-1-when-generating-the-comp.patch deleted file mode 100644 index 85c7289..0000000 --- a/toolbox-Don-t-use-podman-1-when-generating-the-comp.patch +++ /dev/null @@ -1,89 +0,0 @@ -From fc5f568c5d82f4a16982268fa67092e52be91fbe Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Tue, 28 Feb 2023 17:12:04 +0100 -Subject: [PATCH] cmd/root: Don't use podman(1) when generating the completions - -Ever since commit bafbbe81c9220cb3, the shell completions are generated -while building Toolbx using the 'completion' command. This involves -running toolbox(1) itself, and hence invoking 'podman version' to decide -if 'podman system migrate' is needed or not. - -Unfortunately, some build environments, like Fedora's, are set up inside -a chroot(2) or systemd-nspawn(1) or similar, where 'podman version' may -not work because it does various things with namespaces(7) and clone(2) -that can, under certain circumstances, encounter an EPERM. - -Therefore, it's better to avoid using podman(1) when generating the -shell completions, especially, since they are generated by Cobra itself -and podman(1) is not involved at all. - -Note that podman(1) is needed when the generated shell completions are -actually used in interactive command line environments. The shell -completions invoke the hidden '__complete' command to get the results -that are presented to the user, and, if needed, 'podman system migrate' -will continue to be run as part of that. - -This partially reverts commit f3e005d0142d7ec76d5ac8f0a2f331a52fd46011 -because podman(1) is now only an optional runtime dependency for the -system tests. - -https://github.com/containers/podman/issues/17657 ---- - meson.build | 2 +- - src/cmd/root.go | 9 +++++++-- - 2 files changed, 8 insertions(+), 3 deletions(-) - -diff --git a/meson.build b/meson.build -index 6f044bb204e3..653a3d3ac588 100644 ---- a/meson.build -+++ b/meson.build -@@ -18,12 +18,12 @@ subid_dep = cc.find_library('subid', has_headers: ['shadow/subid.h']) - - go = find_program('go') - go_md2man = find_program('go-md2man') --podman = find_program('podman') - - bats = find_program('bats', required: false) - codespell = find_program('codespell', required: false) - htpasswd = find_program('htpasswd', required: false) - openssl = find_program('openssl', required: false) -+podman = find_program('podman', required: false) - shellcheck = find_program('shellcheck', required: false) - skopeo = find_program('skopeo', required: false) - -diff --git a/src/cmd/root.go b/src/cmd/root.go -index 304b03dcd889..9975ccc7a4c8 100644 ---- a/src/cmd/root.go -+++ b/src/cmd/root.go -@@ -166,7 +166,7 @@ func preRun(cmd *cobra.Command, args []string) error { - - logrus.Debugf("TOOLBOX_PATH is %s", toolboxPath) - -- if err := migrate(); err != nil { -+ if err := migrate(cmd, args); err != nil { - return err - } - -@@ -211,13 +211,18 @@ func rootRun(cmd *cobra.Command, args []string) error { - return rootRunImpl(cmd, args) - } - --func migrate() error { -+func migrate(cmd *cobra.Command, args []string) error { - logrus.Debug("Migrating to newer Podman") - - if utils.IsInsideContainer() { - return nil - } - -+ if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName { -+ logrus.Debugf("Migration not needed: command %s doesn't need it", cmdName) -+ return nil -+ } -+ - configDir, err := os.UserConfigDir() - if err != nil { - logrus.Debugf("Migrating to newer Podman: failed to get the user config directory: %s", err) --- -2.39.1 - diff --git a/toolbox-Sprinkle-a-debug-log.patch b/toolbox-Sprinkle-a-debug-log.patch deleted file mode 100644 index ba6a3dd..0000000 --- a/toolbox-Sprinkle-a-debug-log.patch +++ /dev/null @@ -1,22 +0,0 @@ -From cafbca996ec4a19f9f80bae109436e2dfc7149a4 Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Wed, 1 Mar 2023 19:41:56 +0100 -Subject: [PATCH] cmd/root: Sprinkle a debug log - -https://github.com/containers/toolbox/pull/1251 ---- - src/cmd/root.go | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/cmd/root.go b/src/cmd/root.go -index 9975ccc7a..2e7428a20 100644 ---- a/src/cmd/root.go -+++ b/src/cmd/root.go -@@ -215,6 +215,7 @@ func migrate(cmd *cobra.Command, args []string) error { - logrus.Debug("Migrating to newer Podman") - - if utils.IsInsideContainer() { -+ logrus.Debug("Migration not needed: running inside a container") - return nil - } - diff --git a/toolbox.spec b/toolbox.spec index 92edc3c..4d34589 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -17,11 +17,12 @@ Summary: Tool for containerized command line environments on Linux License: ASL 2.0 URL: https://containertoolbx.org/ Source0: https://github.com/containers/%{name}/releases/download/%{version}/%{name}-%{version}-vendored.tar.xz + +# RHEL specific Source1: %{name}.conf # Upstream -Patch0: toolbox-Don-t-use-podman-1-when-generating-the-comp.patch -Patch1: toolbox-Sprinkle-a-debug-log.patch +Patch0: toolbox-Build-fixes.patch # Fedora specific Patch100: toolbox-Make-the-build-flags-match-Fedora-s-gobuild.patch @@ -167,7 +168,6 @@ The %{name}-tests package contains system tests for %{name}. %prep %setup -q %patch0 -p1 -%patch1 -p1 %if 0%{?fedora} %ifnarch ppc64 From 02e331098f74c0f908a511fd511ee1e7c679d25d Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Mon, 2 Oct 2023 13:46:15 +0200 Subject: [PATCH 02/15] Add two upstream patches that are already in CentOS Stream 9 --- ...implify-removing-the-user-s-password.patch | 1056 +++++++++++++++++ ...r-Be-aware-of-security-hardened-moun.patch | 76 ++ toolbox.spec | 10 +- 3 files changed, 1141 insertions(+), 1 deletion(-) create mode 100644 toolbox-Simplify-removing-the-user-s-password.patch create mode 100644 toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch diff --git a/toolbox-Simplify-removing-the-user-s-password.patch b/toolbox-Simplify-removing-the-user-s-password.patch new file mode 100644 index 0000000..d10d870 --- /dev/null +++ b/toolbox-Simplify-removing-the-user-s-password.patch @@ -0,0 +1,1056 @@ +From 07d5c061eacec0a3b145947a9b95a11b705ea5d3 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Sat, 12 Aug 2023 14:26:22 +0200 +Subject: [PATCH 1/5] test/system: Test that group and user IDs work + +These tests assume that the group and user information on the host +operating system can be provided by different plugins for the GNU Name +Service Switch (or NSS) functionality of the GNU C Library. eg., on +enterprise FreeIPA set-ups. However, it's expected that everything +inside the Toolbx container will be provided by /etc/group, /etc/passwd, +/etc/shadow, etc.. + +While /etc/group and /etc/passwd can be read by any user, /etc/shadow +can only be read by root. However, it's awkward to use sudo(8) in the +test cases involving /etc/shadow, because they ensure that root and +$USER don't need passwords to authenticate inside the container, and +sudo(8) itself depends on that. If sudo(8) is used, the test suite can +behave unexpectedly if Toolbx didn't set up the container correctly. +eg., it can get blocked waiting for a password. + +Hence, 'podman unshare' is used instead to enter the container's initial +user namespace, where $USER from the host appears as root. This is +sufficient because the test cases only need to read /etc/shadow inside +the Toolbx container. + +https://github.com/containers/toolbox/pull/1355 +--- + test/system/206-user.bats | 520 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 520 insertions(+) + create mode 100644 test/system/206-user.bats + +diff --git a/test/system/206-user.bats b/test/system/206-user.bats +new file mode 100644 +index 000000000000..fdb2a33da88c +--- /dev/null ++++ b/test/system/206-user.bats +@@ -0,0 +1,520 @@ ++# shellcheck shell=bats ++# ++# Copyright © 2023 Red Hat, Inc. ++# ++# Licensed under the Apache License, Version 2.0 (the "License"); ++# you may not use this file except in compliance with the License. ++# You may obtain a copy of the License at ++# ++# http://www.apache.org/licenses/LICENSE-2.0 ++# ++# Unless required by applicable law or agreed to in writing, software ++# distributed under the License is distributed on an "AS IS" BASIS, ++# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++# See the License for the specific language governing permissions and ++# limitations under the License. ++# ++ ++load 'libs/bats-support/load' ++load 'libs/bats-assert/load' ++load 'libs/helpers' ++ ++setup() { ++ bats_require_minimum_version 1.7.0 ++ _setup_environment ++ cleanup_containers ++} ++ ++teardown() { ++ cleanup_containers ++} ++ ++@test "user: separate namespace" { ++ local ns_host ++ ns_host=$(readlink /proc/$$/ns/user) ++ ++ create_default_container ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run sh -c 'readlink /proc/$$/ns/user' ++ ++ assert_success ++ assert_line --index 0 --regexp '^user:\[[[:digit:]]+\]$' ++ refute_line --index 0 "$ns_host" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: root in shadow(5) inside the default container" { ++ local default_container ++ default_container="$(get_system_id)-toolbox-$(get_system_version)" ++ ++ create_default_container ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount "$default_container")" ++ ++ "$TOOLBOX" run true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount "$default_container" ++ ++ assert_success ++ assert_line --regexp '^root::.+$' ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: root in shadow(5) inside Arch Linux" { ++ create_distro_container arch latest arch-toolbox-latest ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount arch-toolbox-latest)" ++ ++ "$TOOLBOX" run --distro arch true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount arch-toolbox-latest ++ ++ assert_success ++ assert_line --regexp '^root::.+$' ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: root in shadow(5) inside Fedora 34" { ++ create_distro_container fedora 34 fedora-toolbox-34 ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount fedora-toolbox-34)" ++ ++ "$TOOLBOX" run --distro fedora --release 34 true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount fedora-toolbox-34 ++ ++ assert_success ++ assert_line --regexp '^root::.+$' ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: root in shadow(5) inside RHEL 8.7" { ++ create_distro_container rhel 8.7 rhel-toolbox-8.7 ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount rhel-toolbox-8.7)" ++ ++ "$TOOLBOX" run --distro rhel --release 8.7 true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount rhel-toolbox-8.7 ++ ++ assert_success ++ assert_line --regexp '^root::.+$' ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: root in shadow(5) inside Ubuntu 16.04" { ++ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-16.04)" ++ ++ "$TOOLBOX" run --distro ubuntu --release 16.04 true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-16.04 ++ ++ assert_success ++ assert_line --regexp '^root::.+$' ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: root in shadow(5) inside Ubuntu 18.04" { ++ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-18.04)" ++ ++ "$TOOLBOX" run --distro ubuntu --release 18.04 true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-18.04 ++ ++ assert_success ++ assert_line --regexp '^root::.+$' ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: root in shadow(5) inside Ubuntu 20.04" { ++ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-20.04)" ++ ++ "$TOOLBOX" run --distro ubuntu --release 20.04 true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-20.04 ++ ++ assert_success ++ assert_line --regexp '^root::.+$' ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in passwd(5) inside the default container" { ++ local user_gecos ++ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" ++ ++ local user_id_real ++ user_id_real="$(id --real --user)" ++ ++ create_default_container ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run sh -c 'cat /etc/passwd' ++ ++ assert_success ++ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in passwd(5) inside Arch Linux" { ++ local user_gecos ++ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" ++ ++ local user_id_real ++ user_id_real="$(id --real --user)" ++ ++ create_distro_container arch latest arch-toolbox-latest ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch sh -c 'cat /etc/passwd' ++ ++ assert_success ++ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in passwd(5) inside Fedora 34" { ++ local user_gecos ++ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" ++ ++ local user_id_real ++ user_id_real="$(id --real --user)" ++ ++ create_distro_container fedora 34 fedora-toolbox-34 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 sh -c 'cat /etc/passwd' ++ ++ assert_success ++ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in passwd(5) inside RHEL 8.7" { ++ local user_gecos ++ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" ++ ++ local user_id_real ++ user_id_real="$(id --real --user)" ++ ++ create_distro_container rhel 8.7 rhel-toolbox-8.7 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 sh -c 'cat /etc/passwd' ++ ++ assert_success ++ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in passwd(5) inside Ubuntu 16.04" { ++ local user_gecos ++ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" ++ ++ local user_id_real ++ user_id_real="$(id --real --user)" ++ ++ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 sh -c 'cat /etc/passwd' ++ ++ assert_success ++ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in passwd(5) inside Ubuntu 18.04" { ++ local user_gecos ++ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" ++ ++ local user_id_real ++ user_id_real="$(id --real --user)" ++ ++ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 sh -c 'cat /etc/passwd' ++ ++ assert_success ++ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in passwd(5) inside Ubuntu 20.04" { ++ local user_gecos ++ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" ++ ++ local user_id_real ++ user_id_real="$(id --real --user)" ++ ++ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 20.04 sh -c 'cat /etc/passwd' ++ ++ assert_success ++ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in shadow(5) inside the default container" { ++ local default_container ++ default_container="$(get_system_id)-toolbox-$(get_system_version)" ++ ++ create_default_container ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount "$default_container")" ++ ++ "$TOOLBOX" run true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount "$default_container" ++ ++ assert_success ++ refute_line --regexp "^$USER:.*$" ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in shadow(5) inside Arch Linux" { ++ create_distro_container arch latest arch-toolbox-latest ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount arch-toolbox-latest)" ++ ++ "$TOOLBOX" run --distro arch true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount arch-toolbox-latest ++ ++ assert_success ++ refute_line --regexp "^$USER:.*$" ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in shadow(5) inside Fedora 34" { ++ create_distro_container fedora 34 fedora-toolbox-34 ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount fedora-toolbox-34)" ++ ++ "$TOOLBOX" run --distro fedora --release 34 true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount fedora-toolbox-34 ++ ++ assert_success ++ refute_line --regexp "^$USER:.*$" ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in shadow(5) inside RHEL 8.7" { ++ create_distro_container rhel 8.7 rhel-toolbox-8.7 ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount rhel-toolbox-8.7)" ++ ++ "$TOOLBOX" run --distro rhel --release 8.7 true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount rhel-toolbox-8.7 ++ ++ assert_success ++ refute_line --regexp "^$USER:.*$" ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in shadow(5) inside Ubuntu 16.04" { ++ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-16.04)" ++ ++ "$TOOLBOX" run --distro ubuntu --release 16.04 true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-16.04 ++ ++ assert_success ++ refute_line --regexp "^$USER:.*$" ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in shadow(5) inside Ubuntu 18.04" { ++ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-18.04)" ++ ++ "$TOOLBOX" run --distro ubuntu --release 18.04 true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-18.04 ++ ++ assert_success ++ refute_line --regexp "^$USER:.*$" ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in shadow(5) inside Ubuntu 20.04" { ++ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 ++ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-20.04)" ++ ++ "$TOOLBOX" run --distro ubuntu --release 20.04 true ++ ++ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" ++ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-20.04 ++ ++ assert_success ++ refute_line --regexp "^$USER:.*$" ++ assert [ ${#lines[@]} -gt 0 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in group(5) inside the default container" { ++ create_default_container ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run sh -c 'cat /etc/group' ++ ++ assert_success ++ assert_line --regexp "^(sudo|wheel):x:[[:digit:]]+:$USER$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in group(5) inside Arch Linux" { ++ create_distro_container arch latest arch-toolbox-latest ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch sh -c 'cat /etc/group' ++ ++ assert_success ++ assert_line --regexp "^wheel:x:[[:digit:]]+:$USER$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in group(5) inside Fedora 34" { ++ create_distro_container fedora 34 fedora-toolbox-34 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 sh -c 'cat /etc/group' ++ ++ assert_success ++ assert_line --regexp "^wheel:x:[[:digit:]]+:$USER$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in group(5) inside RHEL 8.7" { ++ create_distro_container rhel 8.7 rhel-toolbox-8.7 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 sh -c 'cat /etc/group' ++ ++ assert_success ++ assert_line --regexp "^wheel:x:[[:digit:]]+:$USER$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in group(5) inside Ubuntu 16.04" { ++ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 sh -c 'cat /etc/group' ++ ++ assert_success ++ assert_line --regexp "^sudo:x:[[:digit:]]+:$USER$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in group(5) inside Ubuntu 18.04" { ++ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 sh -c 'cat /etc/group' ++ ++ assert_success ++ assert_line --regexp "^sudo:x:[[:digit:]]+:$USER$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: $USER in group(5) inside Ubuntu 20.04" { ++ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 20.04 sh -c 'cat /etc/group' ++ ++ assert_success ++ assert_line --regexp "^sudo:x:[[:digit:]]+:$USER$" ++ assert [ ${#lines[@]} -gt 1 ] ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} +-- +2.41.0 + + +From 22ba72f3152650d538437bf298ebde4a63e2adc9 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Wed, 4 Nov 2020 00:55:31 +0100 +Subject: [PATCH 2/5] Deprecate the --monitor-host option of 'init-container' + +The --monitor-host option was added to the 'init-container' command in +commit 8b84b5e4604921fa to accommodate Podman versions older than 1.2.0 +that didn't have the '--dns none' and '--no-hosts' options for +'podman create'. These options are necessary to keep the Toolbx +container's /etc/resolv.conf and /etc/hosts files synchronized with +those of the host. + +Note that Podman 1.2.0 was already available a few months before +commit 8b84b5e4604921fa introduced the --monitor-host option. The +chances of someone using an older Podman back then was already on the +decline, and it's very unlikely that a container created with such a +Podman has survived till this date. + +Commit b6b484fa792b442a raised the minimum required Podman version to +1.4.0, and made the '--dns none' and '--no-hosts' options a hard +requirement. The minimum required Podman version was again raised +recently in commit 8e80dd5db1e6f40b to 1.6.4. Therefore, these days, +there's no need to separately use the --monitor-host option of +'init-container' for newly created containers to indicate that the +Podman version wasn't older than 1.2.0. + +Given all this, it's time to stop using the --monitor-host option of +'init-container', and assume that it's always set. The option is still +accepted to retain compatibility with existing Toolbx containers. + +For containers that were created with the --monitor-host option, a +deprecation notice will be shown as: + $ podman start --attach CONTAINER + Flag --monitor-host has been deprecated, it does nothing + ... + +https://github.com/containers/toolbox/pull/617 +--- + doc/toolbox-init-container.1.md | 32 +++--------- + src/cmd/create.go | 1 - + src/cmd/initContainer.go | 86 ++++++++++++++++----------------- + 3 files changed, 49 insertions(+), 70 deletions(-) + +diff --git a/doc/toolbox-init-container.1.md b/doc/toolbox-init-container.1.md +index 45c9a77939f2..51a7b1ee643d 100644 +--- a/doc/toolbox-init-container.1.md ++++ b/doc/toolbox-init-container.1.md +@@ -9,7 +9,6 @@ toolbox\-init\-container - Initialize a running container + *--home-link* + *--media-link* + *--mnt-link* +- *--monitor-host* + *--shell SHELL* + *--uid UID* + *--user USER* +@@ -76,31 +75,12 @@ Make `/mnt` a symbolic link to `/var/mnt`. + + **--monitor-host** + +-Ensures that certain configuration files inside the toolbox container are kept +-synchronized with their counterparts on the host, and bind mounts some paths +-from the host's file system into the container. +- +-The synchronized files are: +- +-- `/etc/host.conf` +-- `/etc/hosts` +-- `/etc/localtime` +-- `/etc/resolv.conf` +-- `/etc/timezone` +- +-The bind mounted paths are: +- +-- `/etc/machine-id` +-- `/run/libvirt` +-- `/run/systemd/journal` +-- `/run/systemd/resolve` +-- `/run/udev/data` +-- `/tmp` +-- `/var/lib/flatpak` +-- `/var/lib/libvirt` +-- `/var/lib/systemd/coredump` +-- `/var/log/journal` +-- `/var/mnt` ++Deprecated, does nothing. ++ ++Crucial configuration files inside the toolbox container are always kept ++synchronized with their counterparts on the host, and various subsets of the ++host's file system hierarchy are always bind mounted to their corresponding ++locations inside the toolbox container. + + **--shell** SHELL + +diff --git a/src/cmd/create.go b/src/cmd/create.go +index 2a103f01ed2d..6cec99258847 100644 +--- a/src/cmd/create.go ++++ b/src/cmd/create.go +@@ -393,7 +393,6 @@ func createContainer(container, image, release, authFile string, showCommandToEn + "--shell", userShell, + "--uid", currentUser.Uid, + "--user", currentUser.Username, +- "--monitor-host", + } + + entryPoint = append(entryPoint, slashHomeLink...) +diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go +index c4cd1b02d298..cb132bffc817 100644 +--- a/src/cmd/initContainer.go ++++ b/src/cmd/initContainer.go +@@ -107,8 +107,12 @@ func init() { + + flags.BoolVar(&initContainerFlags.monitorHost, + "monitor-host", +- false, +- "Ensure that certain configuration files inside the toolbox container are in sync with the host") ++ true, ++ "Deprecated, does nothing") ++ if err := flags.MarkDeprecated("monitor-host", "it does nothing"); err != nil { ++ panicMsg := fmt.Sprintf("cannot mark --monitor-host as deprecated: %s", err) ++ panic(panicMsg) ++ } + + flags.StringVar(&initContainerFlags.shell, + "shell", +@@ -163,59 +167,55 @@ func initContainer(cmd *cobra.Command, args []string) error { + + defer toolboxEnvFile.Close() + +- if initContainerFlags.monitorHost { +- logrus.Debug("Monitoring host") +- +- if utils.PathExists("/run/host/etc") { +- logrus.Debug("Path /run/host/etc exists") +- +- if _, err := os.Readlink("/etc/host.conf"); err != nil { +- if err := redirectPath("/etc/host.conf", +- "/run/host/etc/host.conf", +- false); err != nil { +- return err +- } +- } ++ if utils.PathExists("/run/host/etc") { ++ logrus.Debug("Path /run/host/etc exists") + +- if _, err := os.Readlink("/etc/hosts"); err != nil { +- if err := redirectPath("/etc/hosts", +- "/run/host/etc/hosts", +- false); err != nil { +- return err +- } ++ if _, err := os.Readlink("/etc/host.conf"); err != nil { ++ if err := redirectPath("/etc/host.conf", ++ "/run/host/etc/host.conf", ++ false); err != nil { ++ return err + } ++ } + +- if localtimeTarget, err := os.Readlink("/etc/localtime"); err != nil || +- localtimeTarget != "/run/host/etc/localtime" { +- if err := redirectPath("/etc/localtime", +- "/run/host/etc/localtime", +- false); err != nil { +- return err +- } ++ if _, err := os.Readlink("/etc/hosts"); err != nil { ++ if err := redirectPath("/etc/hosts", ++ "/run/host/etc/hosts", ++ false); err != nil { ++ return err + } ++ } + +- if err := updateTimeZoneFromLocalTime(); err != nil { ++ if localtimeTarget, err := os.Readlink("/etc/localtime"); err != nil || ++ localtimeTarget != "/run/host/etc/localtime" { ++ if err := redirectPath("/etc/localtime", ++ "/run/host/etc/localtime", ++ false); err != nil { + return err + } ++ } ++ ++ if err := updateTimeZoneFromLocalTime(); err != nil { ++ return err ++ } + +- if _, err := os.Readlink("/etc/resolv.conf"); err != nil { +- if err := redirectPath("/etc/resolv.conf", +- "/run/host/etc/resolv.conf", +- false); err != nil { +- return err +- } ++ if _, err := os.Readlink("/etc/resolv.conf"); err != nil { ++ if err := redirectPath("/etc/resolv.conf", ++ "/run/host/etc/resolv.conf", ++ false); err != nil { ++ return err + } ++ } + +- for _, mount := range initContainerMounts { +- if err := mountBind(mount.containerPath, mount.source, mount.flags); err != nil { +- return err +- } ++ for _, mount := range initContainerMounts { ++ if err := mountBind(mount.containerPath, mount.source, mount.flags); err != nil { ++ return err + } ++ } + +- if utils.PathExists("/sys/fs/selinux") { +- if err := mountBind("/sys/fs/selinux", "/usr/share/empty", ""); err != nil { +- return err +- } ++ if utils.PathExists("/sys/fs/selinux") { ++ if err := mountBind("/sys/fs/selinux", "/usr/share/empty", ""); err != nil { ++ return err + } + } + } +-- +2.41.0 + + +From 66a791ff10234023b858b7a28dd98985b054eca1 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Tue, 7 Mar 2023 16:13:04 +0100 +Subject: [PATCH 3/5] cmd/initContainer: Bind mount locations regardless of + /run/host/etc + +Bind mounting the locations at runtime doesn't really have anything to +do with whether /run/host/etc is present inside the Toolbx container. + +The only possible exception could have been /etc/machine-id, but it +isn't, because the bind mount is only performed if the source at +/run/host/etc/machine-id is present. + +This is a historical mistake that has persisted for a long time, since, +in practice, /run/host/etc will almost always exist inside the Toolbx +container. It's time to finally correct it. + +Fallout from 9436bbece01d7aa4dc91b4013ed9f80d0b8d34f4 + +https://github.com/containers/toolbox/pull/1255 +--- + src/cmd/initContainer.go | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go +index cb132bffc817..153e5ccb824e 100644 +--- a/src/cmd/initContainer.go ++++ b/src/cmd/initContainer.go +@@ -206,18 +206,6 @@ func initContainer(cmd *cobra.Command, args []string) error { + return err + } + } +- +- for _, mount := range initContainerMounts { +- if err := mountBind(mount.containerPath, mount.source, mount.flags); err != nil { +- return err +- } +- } +- +- if utils.PathExists("/sys/fs/selinux") { +- if err := mountBind("/sys/fs/selinux", "/usr/share/empty", ""); err != nil { +- return err +- } +- } + } + + if initContainerFlags.mediaLink { +@@ -236,6 +224,18 @@ func initContainer(cmd *cobra.Command, args []string) error { + } + } + ++ for _, mount := range initContainerMounts { ++ if err := mountBind(mount.containerPath, mount.source, mount.flags); err != nil { ++ return err ++ } ++ } ++ ++ if utils.PathExists("/sys/fs/selinux") { ++ if err := mountBind("/sys/fs/selinux", "/usr/share/empty", ""); err != nil { ++ return err ++ } ++ } ++ + if _, err := user.Lookup(initContainerFlags.user); err != nil { + if err := configureUsers(initContainerFlags.uid, + initContainerFlags.user, +-- +2.41.0 + + +From d416f1b4abd0782526c011b078442856c733e718 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Tue, 15 Aug 2023 20:57:46 +0200 +Subject: [PATCH 4/5] cmd/initContainer: Simplify code by removing a function + parameter + +Until now, configureUsers() was pushing the burden of deciding whether +to add a new user or modify an existing one on the callers, even though +it can trivially decide itself. Involving the caller loosens the +encapsulation of the user configuration logic by spreading it across +configureUsers() and it's caller, and adds an extra function parameter +that needs to be carefully set and is vulnerable to programmer errors. + +Fallout from 9ea6fe5852ea8f5225114d825e8e6813e2a3cfea + +https://github.com/containers/toolbox/pull/1356 +--- + src/cmd/initContainer.go | 62 ++++++++++++++++------------------------ + 1 file changed, 24 insertions(+), 38 deletions(-) + +diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go +index 153e5ccb824e..02c389635378 100644 +--- a/src/cmd/initContainer.go ++++ b/src/cmd/initContainer.go +@@ -236,24 +236,12 @@ func initContainer(cmd *cobra.Command, args []string) error { + } + } + +- if _, err := user.Lookup(initContainerFlags.user); err != nil { +- if err := configureUsers(initContainerFlags.uid, +- initContainerFlags.user, +- initContainerFlags.home, +- initContainerFlags.shell, +- initContainerFlags.homeLink, +- false); err != nil { +- return err +- } +- } else { +- if err := configureUsers(initContainerFlags.uid, +- initContainerFlags.user, +- initContainerFlags.home, +- initContainerFlags.shell, +- initContainerFlags.homeLink, +- true); err != nil { +- return err +- } ++ if err := configureUsers(initContainerFlags.uid, ++ initContainerFlags.user, ++ initContainerFlags.home, ++ initContainerFlags.shell, ++ initContainerFlags.homeLink); err != nil { ++ return err + } + + if utils.PathExists("/etc/krb5.conf.d") && !utils.PathExists("/etc/krb5.conf.d/kcm_default_ccache") { +@@ -386,9 +374,7 @@ func initContainerHelp(cmd *cobra.Command, args []string) { + } + } + +-func configureUsers(targetUserUid int, +- targetUser, targetUserHome, targetUserShell string, +- homeLink, targetUserExists bool) error { ++func configureUsers(targetUserUid int, targetUser, targetUserHome, targetUserShell string, homeLink bool) error { + if homeLink { + if err := redirectPath("/home", "/var/home", true); err != nil { + return err +@@ -400,45 +386,45 @@ func configureUsers(targetUserUid int, + return fmt.Errorf("failed to get group for sudo: %w", err) + } + +- if targetUserExists { +- logrus.Debugf("Modifying user %s with UID %d:", targetUser, targetUserUid) ++ if _, err := user.Lookup(targetUser); err != nil { ++ logrus.Debugf("Adding user %s with UID %d:", targetUser, targetUserUid) + +- usermodArgs := []string{ +- "--append", ++ useraddArgs := []string{ + "--groups", sudoGroup, +- "--home", targetUserHome, ++ "--home-dir", targetUserHome, ++ "--no-create-home", + "--shell", targetUserShell, + "--uid", fmt.Sprint(targetUserUid), + targetUser, + } + +- logrus.Debug("usermod") +- for _, arg := range usermodArgs { ++ logrus.Debug("useradd") ++ for _, arg := range useraddArgs { + logrus.Debugf("%s", arg) + } + +- if err := shell.Run("usermod", nil, nil, nil, usermodArgs...); err != nil { +- return fmt.Errorf("failed to modify user %s with UID %d: %w", targetUser, targetUserUid, err) ++ if err := shell.Run("useradd", nil, nil, nil, useraddArgs...); err != nil { ++ return fmt.Errorf("failed to add user %s with UID %d: %w", targetUser, targetUserUid, err) + } + } else { +- logrus.Debugf("Adding user %s with UID %d:", targetUser, targetUserUid) ++ logrus.Debugf("Modifying user %s with UID %d:", targetUser, targetUserUid) + +- useraddArgs := []string{ ++ usermodArgs := []string{ ++ "--append", + "--groups", sudoGroup, +- "--home-dir", targetUserHome, +- "--no-create-home", ++ "--home", targetUserHome, + "--shell", targetUserShell, + "--uid", fmt.Sprint(targetUserUid), + targetUser, + } + +- logrus.Debug("useradd") +- for _, arg := range useraddArgs { ++ logrus.Debug("usermod") ++ for _, arg := range usermodArgs { + logrus.Debugf("%s", arg) + } + +- if err := shell.Run("useradd", nil, nil, nil, useraddArgs...); err != nil { +- return fmt.Errorf("failed to add user %s with UID %d: %w", targetUser, targetUserUid, err) ++ if err := shell.Run("usermod", nil, nil, nil, usermodArgs...); err != nil { ++ return fmt.Errorf("failed to modify user %s with UID %d: %w", targetUser, targetUserUid, err) + } + } + +-- +2.41.0 + + +From e673dc792438c64683237d26b21d005ffb008fd5 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Tue, 22 Aug 2023 23:29:43 +0200 +Subject: [PATCH 5/5] cmd/initContainer: Simplify removing the user's password + +It's one less invocation of an external command, which is good because +spawning a new process is generally expensive. + +One positive side-effect of this is that on some Active Directory +set-ups, the entry point no longer fails with: + Error: failed to remove password for user login@company.com: failed + to invoke passwd(1) + +... because of: + # passwd --delete login@company.com + passwd: Libuser error at line: 210 - name contains invalid char `@'. + +This is purely an accident, and isn't meant to be an intential change to +support Active Directory. Tools like useradd(8) and usermod(8) from +Shadow aren't meant to work with Active Directory users, and, hence, it +can still break in other ways. For that, one option is to expose $USER +from the host operating system to the Toolbx container through a Varlink +interface that can be used by nss-systemd inside the container. + +Based on an idea from Si. + +https://github.com/containers/toolbox/issues/585 +--- + src/cmd/initContainer.go | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go +index 02c389635378..91b53cee7d0d 100644 +--- a/src/cmd/initContainer.go ++++ b/src/cmd/initContainer.go +@@ -393,6 +393,7 @@ func configureUsers(targetUserUid int, targetUser, targetUserHome, targetUserShe + "--groups", sudoGroup, + "--home-dir", targetUserHome, + "--no-create-home", ++ "--password", "", + "--shell", targetUserShell, + "--uid", fmt.Sprint(targetUserUid), + targetUser, +@@ -413,6 +414,7 @@ func configureUsers(targetUserUid int, targetUser, targetUserHome, targetUserShe + "--append", + "--groups", sudoGroup, + "--home", targetUserHome, ++ "--password", "", + "--shell", targetUserShell, + "--uid", fmt.Sprint(targetUserUid), + targetUser, +@@ -428,12 +430,6 @@ func configureUsers(targetUserUid int, targetUser, targetUserHome, targetUserShe + } + } + +- logrus.Debugf("Removing password for user %s", targetUser) +- +- if err := shell.Run("passwd", nil, nil, nil, "--delete", targetUser); err != nil { +- return fmt.Errorf("failed to remove password for user %s: %w", targetUser, err) +- } +- + logrus.Debug("Removing password for user root") + + if err := shell.Run("passwd", nil, nil, nil, "--delete", "root"); err != nil { +-- +2.41.0 + diff --git a/toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch b/toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch new file mode 100644 index 0000000..adf39a3 --- /dev/null +++ b/toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch @@ -0,0 +1,76 @@ +From 1fde98456652ddbcb750ade2121c5ceec93fbfae Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Thu, 13 Jul 2023 13:08:40 +0200 +Subject: [PATCH] cmd/initContainer: Be aware of security hardened mount points + +Sometimes locations such as /var/lib/flatpak, /var/lib/systemd/coredump +and /var/log/journal sit on security hardened mount points that are +marked as 'nosuid,nodev,noexec' [1]. In such cases, when Toolbx is used +rootless, an attempt to bind mount these locations read-only at runtime +with mount(8) fails because of permission problems: + # mount --rbind -o ro + mount: : filesystem was mounted, but any subsequent + operation failed: Unknown error 5005. + +(Note that the above error message from mount(8) was subsequently +improved to show something more meaningful than 'Unknown error' [2].) + +The problem is that 'init-container' is running inside the container's +mount and user namespace, and the source paths were mounted inside the +host's namespace with 'nosuid,nodev,noexec'. The above mount(8) call +tries to remove the 'nosuid,nodev,noexec' flags from the mount point and +replace them with only 'ro', which is something that can't be done from +a child namespace. + +Note that this doesn't fail when Toolbx is running as root. This is +because the container uses the host's user namespace and is able to +remove the 'nosuid,nodev,noexec' flags from the mount point and replace +them with only 'ro'. Even though it doesn't fail, the flags shouldn't +get replaced like that inside the container, because it removes the +security hardening of those mount points. + +There's actually no benefit in bind mounting these paths as read-only. +It was historically done this way 'just to be safe' because a user isn't +expected to write to these locations from inside a container. However, +Toolbx doesn't intend to provide any heightened security beyond what's +already available on the host. + +Hence, it's better to get out of the way and leave it to the permissions +on the source location from the host operating system to guard the +castle. This is accomplished by not passing any file system options to +mount(8) [1]. + +Based on an idea from Si. + +[1] https://man7.org/linux/man-pages/man8/mount.8.html + +[2] util-linux commit 9420ca34dc8b6f0f + https://github.com/util-linux/util-linux/commit/9420ca34dc8b6f0f + https://github.com/util-linux/util-linux/pull/2376 + +https://github.com/containers/toolbox/issues/911 +--- + src/cmd/initContainer.go | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go +index 465ac063b210..c4cd1b02d298 100644 +--- a/src/cmd/initContainer.go ++++ b/src/cmd/initContainer.go +@@ -62,10 +62,10 @@ var ( + {"/run/udev/data", "/run/host/run/udev/data", ""}, + {"/run/udev/tags", "/run/host/run/udev/tags", ""}, + {"/tmp", "/run/host/tmp", "rslave"}, +- {"/var/lib/flatpak", "/run/host/var/lib/flatpak", "ro"}, ++ {"/var/lib/flatpak", "/run/host/var/lib/flatpak", ""}, + {"/var/lib/libvirt", "/run/host/var/lib/libvirt", ""}, +- {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", "ro"}, +- {"/var/log/journal", "/run/host/var/log/journal", "ro"}, ++ {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", ""}, ++ {"/var/log/journal", "/run/host/var/log/journal", ""}, + {"/var/mnt", "/run/host/var/mnt", "rslave"}, + } + ) +-- +2.41.0 + diff --git a/toolbox.spec b/toolbox.spec index 4d34589..459dbbf 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -11,7 +11,7 @@ Version: 0.0.99.4 %gometa -f %endif -Release: 2%{?dist} +Release: 3%{?dist} Summary: Tool for containerized command line environments on Linux License: ASL 2.0 @@ -23,6 +23,8 @@ Source1: %{name}.conf # Upstream Patch0: toolbox-Build-fixes.patch +Patch1: toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch +Patch2: toolbox-Simplify-removing-the-user-s-password.patch # Fedora specific Patch100: toolbox-Make-the-build-flags-match-Fedora-s-gobuild.patch @@ -168,6 +170,8 @@ The %{name}-tests package contains system tests for %{name}. %prep %setup -q %patch0 -p1 +%patch1 -p1 +%patch2 -p1 %if 0%{?fedora} %ifnarch ppc64 @@ -246,6 +250,10 @@ install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf %changelog +* Mon Oct 02 2023 Debarshi Ray - 0.0.99.4-3 +- Be aware of security hardened mount points +- Simplify removing the user's password + * Wed Mar 8 2023 Nieves Montero - 0.0.99.4-2 - Sprinkle a debug log From 0243af25bac1b1fea502e15cc69fe80f8259b9c6 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Mon, 2 Oct 2023 14:02:29 +0200 Subject: [PATCH 03/15] Drop github.com/coreos/toolbox compatibility from RHEL 10 onwards Some limited compatibility with github.com/coreos/toolbox was added to RHEL 8.5 when the implementation of the toolbox RPM was changed from github.com/coreos/toolbox to github.com/containers/toolbox. This was carried forward to RHEL 9 to give everybody some extra time to adjust. This compatibility involved setting the HOST environment variable inside the Toolbx containers for 'sos report' to work, and replicating the command line interface from github.com/coreos/toolbox. The problem with setting the HOST environment variable in Toolbx containers is that it's a very generic name without any namespacing. Not every user is going to use 'sos report', and it can easily conflict with a variable of the same name being used for a different purpose. This is similar to the NAME and VERSION environment variables that used to be set inside Toolbx containers due to outdated or wrong information in Fedora's container guidelines [1]. They were a constant source of complaints and were recently fixed [2]. The same logic applies to HOST. Instead of expecting the Toolbx container to have the HOST environment variable, sos(1) should be taught how to work inside a Toolbx container without requiring any extra configuration [3]. The problem with replicating the command line interface from github.com/coreos/toolbox is that it's difficult to document it, because it's so different from the native interface that users on non-RHEL operating systems, including Fedora, have come to expect. So, it's an undocumented easter egg that receives very limited, if any, testing. RHEL 8.5 was released on the 9th of November in 2021, which was almost two years ago. RHEL 10 is going to be a fresh new operating system. It's time to ship a version of sos(1) in RHEL that works without any extra configuration inside Toolbx containers, and to inform RHEL users to adapt to the native command line interface. [1] https://docs.fedoraproject.org/en-US/containers/guidelines/creation/ [2] Upstream commit 9506173f88dc26bf https://github.com/containers/toolbox/commit/9506173f88dc26bf https://github.com/containers/toolbox/issues/188 [3] https://github.com/sosreport/sos/pull/3370 --- toolbox.spec | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/toolbox.spec b/toolbox.spec index 459dbbf..3f080f8 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -11,7 +11,7 @@ Version: 0.0.99.4 %gometa -f %endif -Release: 3%{?dist} +Release: 4%{?dist} Summary: Tool for containerized command line environments on Linux License: ASL 2.0 @@ -188,8 +188,10 @@ The %{name}-tests package contains system tests for %{name}. %patch201 -p1 %endif +%if 0%{?rhel} <= 9 %patch202 -p1 %endif +%endif %gomkdir -s %{_builddir}/%{extractdir}/src %{?rhel:-k} @@ -202,7 +204,9 @@ export CGO_CFLAGS="%{optflags} -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_ %meson \ %if 0%{?rhel} -Dfish_completions_dir=%{_datadir}/fish/vendor_completions.d \ +%if 0%{?rhel} <= 9 -Dmigration_path_for_coreos_toolbox=true \ +%endif %endif -Dprofile_dir=%{_sysconfdir}/profile.d \ -Dtmpfiles_dir=%{_tmpfilesdir} \ @@ -250,6 +254,9 @@ install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf %changelog +* Mon Oct 02 2023 Debarshi Ray - 0.0.99.4-4 +- Drop github.com/coreos/toolbox compatibility from RHEL 10 onwards + * Mon Oct 02 2023 Debarshi Ray - 0.0.99.4-3 - Be aware of security hardened mount points - Simplify removing the user's password From 5ae6f8c470de7c65c899b9584bb891a804acb648 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Thu, 9 Nov 2023 12:05:46 +0100 Subject: [PATCH 04/15] Silence 'rpminspect --tests=annocheck' and 'rpminspect --tests=runpath' The DT_RPATH or DT_RUNPATH value of /run/host%{_libdir} that's present in %{_bindir}/toolbox is intentional [1]. [1] Upstream commit 6063eb27b9893994 https://github.com/containers/toolbox/commit/6063eb27b9893994 https://github.com/containers/toolbox/issues/821 --- rpminspect.yaml | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 rpminspect.yaml diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..a0938f7 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,11 @@ +# https://github.com/rpminspect/rpminspect/blob/master/data/generic.yaml +# https://github.com/rpminspect/rpminspect-data-fedora/blob/main/fedora.yaml + +--- + +annocheck: + - hardened: --ignore-unknown --verbose --skip-run-path + +runpath: + allowed_paths: + - /run/host/usr/lib64 From 219b17881c21252c0fee17ae191e7998d1ae7004 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Fri, 10 Nov 2023 16:01:17 +0100 Subject: [PATCH 05/15] Silence 'rpminspect --tests=runpath' on i686 --- rpminspect.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/rpminspect.yaml b/rpminspect.yaml index a0938f7..924e431 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -8,4 +8,5 @@ annocheck: runpath: allowed_paths: + - /run/host/usr/lib - /run/host/usr/lib64 From 864fea28d55b06cbea38e7166943a591a96afabd Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Thu, 9 Nov 2023 17:07:29 +0100 Subject: [PATCH 06/15] Clarify that %golang_arches_future are meant for RHEL 10 Since the RHEL conditional was only targeting RHEL 9, it wasn't clear whether it needed updating for RHEL 10. So, it's better to say that %golang_arches are for RHEL 9 and older, and %golang_arches_future are for Fedora and RHEL 10 onwards. This doesn't change any behaviour of the built artifacts, because the build is only shared with RHEL 9 onwards. Hence, a conditional checking for RHEL 9 is the same as one checking for RHEL 9 and older. There's no need to do a build just for this. --- toolbox.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/toolbox.spec b/toolbox.spec index 3f080f8..62f1a57 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -5,7 +5,7 @@ Version: 0.0.99.4 %global goipath github.com/containers/%{name} -%if 0%{?rhel} == 9 +%if 0%{?rhel} <= 9 %gometa %else %gometa -f From e30100fd71d55d95e2050ba84db05850f6387271 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Tue, 5 Dec 2023 15:14:49 +0100 Subject: [PATCH 07/15] Fix the conditionals for 'if RHEL <= 9' '%if 0%{?rhel} <= 9' is the wrong way to express 'if RHEL <= 9'. On Fedora, %rhel won't be defined. So, %{?rhel} will expand to nothing, and leave only a 0 on the left hand side, making the condition TRUE on Fedora. Note, that conditions like '%if 0%{?rhel}', and other relational operators like ==, > and >= work as expected. The problem is only with < and <=. There's no need to do a build just for this, because this regression didn't make it into any previous build. Fallout from 864fea28d55b06cbea38e7166943a591a96afabd --- toolbox.spec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/toolbox.spec b/toolbox.spec index 62f1a57..1a4042e 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -5,11 +5,17 @@ Version: 0.0.99.4 %global goipath github.com/containers/%{name} +%if 0%{?fedora} +%gometa -f +%endif + +%if 0%{?rhel} %if 0%{?rhel} <= 9 %gometa %else %gometa -f %endif +%endif Release: 4%{?dist} Summary: Tool for containerized command line environments on Linux From ee8ec7a10f58202fb78944767167bb278a8441fb Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Tue, 5 Dec 2023 17:02:24 +0100 Subject: [PATCH 08/15] Drop the custom /etc/containers/toolbox.conf from RHEL 10 onwards Complete support for RHEL Toolbx images based on the Red Hat Universal Base Images (or UBI) was only recently added to Toolbx [1], in version 0.0.99.4. Before that, Toolbx would only pick the image for RHEL 8, and even before that, it would pick the base 'ubi8' image, which isn't designed for interactive command line use. Due to this, RHEL >= 8.5 shipped a custom configuration file in /etc/containers/toolbox.conf to specify the image. However, that's not necessary anymore. RHEL 10 is going to be a fresh new operating system, and it will be better if we don't ship any custom configuration that's not needed, because it will ensure consistency with non-RHEL operating systems, including Fedora. There's no need to do a build just for this. [1] Upstream commit 0a29b374e649437 https://github.com/containers/toolbox/commit/0a29b374e649437 https://github.com/containers/toolbox/issues/1065 --- toolbox.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/toolbox.spec b/toolbox.spec index 1a4042e..9a3e272 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -229,8 +229,10 @@ export CGO_CFLAGS="%{optflags} -D_GNU_SOURCE -D_LARGEFILE_SOURCE -D_LARGEFILE64_ %meson_install %if 0%{?rhel} +%if 0%{?rhel} <= 9 install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf %endif +%endif %files From 540420181b35d1518d6c9e411db758dc77187135 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Wed, 6 Dec 2023 10:45:50 -0800 Subject: [PATCH 09/15] tests subpackage: require httpd-tools for htpasswd https://src.fedoraproject.org/rpms/toolbox/pull-request/17 --- toolbox.spec | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/toolbox.spec b/toolbox.spec index 9a3e272..a69e776 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -17,7 +17,7 @@ Version: 0.0.99.4 %endif %endif -Release: 4%{?dist} +Release: 5%{?dist} Summary: Tool for containerized command line environments on Linux License: ASL 2.0 @@ -164,6 +164,8 @@ Requires: %{name}%{?_isa} = %{version}-%{release} Requires: coreutils Requires: gawk Requires: grep +# for htpasswd +Requires: httpd-tools Requires: skopeo %if ! 0%{?rhel} Requires: bats @@ -262,6 +264,9 @@ install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf %changelog +* Wed Dec 06 2023 Adam Williamson - 0.0.99.4-5 +- tests subpackage: require httpd-tools for htpasswd + * Mon Oct 02 2023 Debarshi Ray - 0.0.99.4-4 - Drop github.com/coreos/toolbox compatibility from RHEL 10 onwards From 1460581a238453b663c91c9aea2f21c31165afad Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Tue, 19 Dec 2023 13:18:49 +0100 Subject: [PATCH 10/15] Require openssl(1) for the system tests in the tests subpackage https://src.fedoraproject.org/rpms/toolbox/pull-request/17 --- toolbox.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/toolbox.spec b/toolbox.spec index a69e776..d0bbe8f 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -17,7 +17,7 @@ Version: 0.0.99.4 %endif %endif -Release: 5%{?dist} +Release: 6%{?dist} Summary: Tool for containerized command line environments on Linux License: ASL 2.0 @@ -166,6 +166,7 @@ Requires: gawk Requires: grep # for htpasswd Requires: httpd-tools +Requires: openssl Requires: skopeo %if ! 0%{?rhel} Requires: bats @@ -264,6 +265,9 @@ install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf %changelog +* Tue Dec 19 2023 Debarshi Ray - 0.0.99.4-6 +- Require openssl(1) for the system tests in the tests subpackage + * Wed Dec 06 2023 Adam Williamson - 0.0.99.4-5 - tests subpackage: require httpd-tools for htpasswd From ffcb738dfa57ff6a196d5c9cf2f7d4ff69740f2f Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Tue, 19 Dec 2023 13:24:23 +0100 Subject: [PATCH 11/15] tests: Remove redundant environment variable There's no need to explicitly set the PODMAN environment variable to its default value of /usr/bin/podman. https://src.fedoraproject.org/rpms/toolbox/pull-request/17 --- tests/tests.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/tests/tests.yml b/tests/tests.yml index 0048a3e..98d6a17 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -9,7 +9,5 @@ tests: - name: toolbox package: toolbox - environment: - PODMAN: /usr/bin/podman become: true \ No newline at end of file From d33e1d938be102f30ad3d243f3cb5a6553669717 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Tue, 19 Dec 2023 13:25:48 +0100 Subject: [PATCH 12/15] tests: Remove trailing whitespace https://src.fedoraproject.org/rpms/toolbox/pull-request/17 --- tests/tests.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/tests/tests.yml b/tests/tests.yml index 98d6a17..e7ff188 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -10,4 +10,3 @@ - name: toolbox package: toolbox become: true - \ No newline at end of file From 0446d7052efe4aa2cd7bb8f575fb1add4dd1451d Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Tue, 19 Dec 2023 12:43:59 +0100 Subject: [PATCH 13/15] Update to 0.0.99.5 Start using Toolbx as the name of the project, instead of Toolbox. https://src.fedoraproject.org/rpms/toolbox/pull-request/17 --- .gitignore | 1 + sources | 2 +- toolbox-Build-fixes.patch | 240 ---- ...ags-match-Fedora-s-gobuild-for-PPC64.patch | 4 +- ...e-build-flags-match-Fedora-s-gobuild.patch | 4 +- ...implify-removing-the-user-s-password.patch | 1056 ----------------- ...r-Be-aware-of-security-hardened-moun.patch | 76 -- toolbox.spec | 45 +- 8 files changed, 30 insertions(+), 1398 deletions(-) delete mode 100644 toolbox-Build-fixes.patch delete mode 100644 toolbox-Simplify-removing-the-user-s-password.patch delete mode 100644 toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch diff --git a/.gitignore b/.gitignore index 3db2fe9..6787941 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,4 @@ /toolbox-0.0.99.3.tar.xz /toolbox-0.0.99.3-vendor.tar.xz /toolbox-0.0.99.4-vendored.tar.xz +/toolbox-0.0.99.5-vendored.tar.xz diff --git a/sources b/sources index a8351c5..df91c99 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (toolbox-0.0.99.4-vendored.tar.xz) = 882cd6ec1c1a193af8774dfdfd0aff72d376c4fec3e0cc702e2d524353c051e408eab2ac3fb43ec00fe622b46ac89fdbe97aca2f7cfbe3822e5d3ff1743f2fd0 +SHA512 (toolbox-0.0.99.5-vendored.tar.xz) = d82666e9abcbac2d01de440dfb8d57801bb97ec0854a9859c64689c47c6a1344b846fb151ffa9371d0a9a2c85c8f61c96cf8f546449ec63c9a44d85ef328b745 diff --git a/toolbox-Build-fixes.patch b/toolbox-Build-fixes.patch deleted file mode 100644 index 32164ef..0000000 --- a/toolbox-Build-fixes.patch +++ /dev/null @@ -1,240 +0,0 @@ -From 424cc42fba3cb182a360dcdda68caf20d9141ae6 Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Tue, 28 Feb 2023 17:12:04 +0100 -Subject: [PATCH 1/4] cmd/root: Don't use podman(1) when generating the - completions - -Ever since commit bafbbe81c9220cb3, the shell completions are generated -while building Toolbx using the 'completion' command. This involves -running toolbox(1) itself, and hence invoking 'podman version' to decide -if 'podman system migrate' is needed or not. - -Unfortunately, some build environments, like Fedora's, are set up inside -a chroot(2) or systemd-nspawn(1) or similar, where 'podman version' may -not work because it does various things with namespaces(7) and clone(2) -that can, under certain circumstances, encounter an EPERM. - -Therefore, it's better to avoid using podman(1) when generating the -shell completions, especially, since they are generated by Cobra itself -and podman(1) is not involved at all. - -Note that podman(1) is needed when the generated shell completions are -actually used in interactive command line environments. The shell -completions invoke the hidden '__complete' command to get the results -that are presented to the user, and, if needed, 'podman system migrate' -will continue to be run as part of that. - -This partially reverts commit f3e005d0142d7ec76d5ac8f0a2f331a52fd46011 -because podman(1) is now only an optional runtime dependency for the -system tests. - -https://github.com/containers/podman/issues/17657 ---- - meson.build | 2 +- - src/cmd/root.go | 9 +++++++-- - 2 files changed, 8 insertions(+), 3 deletions(-) - -diff --git a/meson.build b/meson.build -index 6f044bb204e3..653a3d3ac588 100644 ---- a/meson.build -+++ b/meson.build -@@ -18,12 +18,12 @@ subid_dep = cc.find_library('subid', has_headers: ['shadow/subid.h']) - - go = find_program('go') - go_md2man = find_program('go-md2man') --podman = find_program('podman') - - bats = find_program('bats', required: false) - codespell = find_program('codespell', required: false) - htpasswd = find_program('htpasswd', required: false) - openssl = find_program('openssl', required: false) -+podman = find_program('podman', required: false) - shellcheck = find_program('shellcheck', required: false) - skopeo = find_program('skopeo', required: false) - -diff --git a/src/cmd/root.go b/src/cmd/root.go -index 304b03dcd889..9975ccc7a4c8 100644 ---- a/src/cmd/root.go -+++ b/src/cmd/root.go -@@ -166,7 +166,7 @@ func preRun(cmd *cobra.Command, args []string) error { - - logrus.Debugf("TOOLBOX_PATH is %s", toolboxPath) - -- if err := migrate(); err != nil { -+ if err := migrate(cmd, args); err != nil { - return err - } - -@@ -211,13 +211,18 @@ func rootRun(cmd *cobra.Command, args []string) error { - return rootRunImpl(cmd, args) - } - --func migrate() error { -+func migrate(cmd *cobra.Command, args []string) error { - logrus.Debug("Migrating to newer Podman") - - if utils.IsInsideContainer() { - return nil - } - -+ if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName { -+ logrus.Debugf("Migration not needed: command %s doesn't need it", cmdName) -+ return nil -+ } -+ - configDir, err := os.UserConfigDir() - if err != nil { - logrus.Debugf("Migrating to newer Podman: failed to get the user config directory: %s", err) --- -2.41.0 - - -From 0723706168a1bde708bc9acc203c5e9870bc94d5 Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Wed, 1 Mar 2023 19:41:56 +0100 -Subject: [PATCH 2/4] cmd/root: Sprinkle a debug log - -https://github.com/containers/toolbox/pull/1251 ---- - src/cmd/root.go | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/src/cmd/root.go b/src/cmd/root.go -index 9975ccc7a4c8..2e7428a20b24 100644 ---- a/src/cmd/root.go -+++ b/src/cmd/root.go -@@ -215,6 +215,7 @@ func migrate(cmd *cobra.Command, args []string) error { - logrus.Debug("Migrating to newer Podman") - - if utils.IsInsideContainer() { -+ logrus.Debug("Migration not needed: running inside a container") - return nil - } - --- -2.41.0 - - -From 0736db58456bb635854493e28a0c36bda49988ce Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Wed, 1 Mar 2023 19:46:11 +0100 -Subject: [PATCH 3/4] cmd/root: Shuffle some code around and sprinkle some - debug logs - -Having a separate convenience function reduces the indentation levels by -at least one, and sometimes two, and makes it easy to have more detailed -debug logs. - -This will make the subsequent commit easier to read. - -https://github.com/containers/toolbox/issues/1246 ---- - src/cmd/root.go | 32 ++++++++++++++++++++++++-------- - 1 file changed, 24 insertions(+), 8 deletions(-) - -diff --git a/src/cmd/root.go b/src/cmd/root.go -index 2e7428a20b24..9aafe3e0d3be 100644 ---- a/src/cmd/root.go -+++ b/src/cmd/root.go -@@ -1,5 +1,5 @@ - /* -- * Copyright © 2019 – 2022 Red Hat Inc. -+ * Copyright © 2019 – 2023 Red Hat Inc. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. -@@ -139,13 +139,8 @@ func preRun(cmd *cobra.Command, args []string) error { - if !utils.IsInsideContainer() { - logrus.Debugf("Running on a cgroups v%d host", cgroupsVersion) - -- if currentUser.Uid != "0" { -- logrus.Debugf("Looking for sub-GID and sub-UID ranges for user %s", currentUser.Username) -- -- if _, err := utils.ValidateSubIDRanges(currentUser); err != nil { -- logrus.Debugf("Looking for sub-GID and sub-UID ranges: %s", err) -- return newSubIDError() -- } -+ if _, err := validateSubIDRanges(cmd, args, currentUser); err != nil { -+ return err - } - } - -@@ -392,3 +387,24 @@ func setUpLoggers() error { - - return nil - } -+ -+func validateSubIDRanges(cmd *cobra.Command, args []string, user *user.User) (bool, error) { -+ logrus.Debugf("Looking for sub-GID and sub-UID ranges for user %s", user.Username) -+ -+ if user.Uid == "0" { -+ logrus.Debugf("Look-up not needed: user %s doesn't need them", user.Username) -+ return true, nil -+ } -+ -+ if utils.IsInsideContainer() { -+ logrus.Debug("Look-up not needed: running inside a container") -+ return true, nil -+ } -+ -+ if _, err := utils.ValidateSubIDRanges(user); err != nil { -+ logrus.Debugf("Looking for sub-GID and sub-UID ranges: %s", err) -+ return false, newSubIDError() -+ } -+ -+ return true, nil -+} --- -2.41.0 - - -From 02537eac420f49e96110663794ef5f2511eb6860 Mon Sep 17 00:00:00 2001 -From: Jan Zerebecki -Date: Wed, 1 Mar 2023 19:52:28 +0100 -Subject: [PATCH 4/4] cmd/root: Don't validate subordinate IDs when generating - the completions - -Ever since commit bafbbe81c9220cb3, the shell completions are generated -while building Toolbx using the 'completion' command. This involves -running toolbox(1) itself, and hence validating the subordinate user and -group ID ranges. - -Unfortunately, some build environments, like openSUSE's, don't have -subordinate ID ranges set up. Therefore, it's better to not validate -the subordinate ID ranges when generating the shell completions, since -they are generated by Cobra itself and subordinate ID ranges are not -involved at all. - -Note that subordinate ID ranges may be needed when the generated shell -completions are actually used in interactive command line environments. -The shell completions invoke the hidden '__complete' command to get the -results that are presented to the user, and, if needed, the subordinate -ID ranges will continue to be used by podman(1) as part of that. - -Some changes by Debarshi Ray. - -https://github.com/containers/toolbox/issues/1246 -https://github.com/containers/toolbox/pull/1249 ---- - src/cmd/root.go | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/src/cmd/root.go b/src/cmd/root.go -index 9aafe3e0d3be..aee9fe026ac3 100644 ---- a/src/cmd/root.go -+++ b/src/cmd/root.go -@@ -401,6 +401,11 @@ func validateSubIDRanges(cmd *cobra.Command, args []string, user *user.User) (bo - return true, nil - } - -+ if cmdName, completionCmdName := cmd.Name(), completionCmd.Name(); cmdName == completionCmdName { -+ logrus.Debugf("Look-up not needed: command %s doesn't need them", cmdName) -+ return true, nil -+ } -+ - if _, err := utils.ValidateSubIDRanges(user); err != nil { - logrus.Debugf("Looking for sub-GID and sub-UID ranges: %s", err) - return false, newSubIDError() --- -2.41.0 - diff --git a/toolbox-Make-the-build-flags-match-Fedora-s-gobuild-for-PPC64.patch b/toolbox-Make-the-build-flags-match-Fedora-s-gobuild-for-PPC64.patch index afb5193..35ecc83 100644 --- a/toolbox-Make-the-build-flags-match-Fedora-s-gobuild-for-PPC64.patch +++ b/toolbox-Make-the-build-flags-match-Fedora-s-gobuild-for-PPC64.patch @@ -1,4 +1,4 @@ -From 865f58881c17c233f288b8978faaeba8b4b2c2f0 Mon Sep 17 00:00:00 2001 +From 4f8b443ab925c84d059d894ddcfcf4dcf66a747e Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Mon, 29 Jun 2020 17:57:47 +0200 Subject: [PATCH] build: Make the build flags match Fedora's %{gobuildflags} @@ -50,5 +50,5 @@ index c572d6dfb02b..cae2de426a96 100755 exit "$?" -- -2.39.2 +2.43.0 diff --git a/toolbox-Make-the-build-flags-match-Fedora-s-gobuild.patch b/toolbox-Make-the-build-flags-match-Fedora-s-gobuild.patch index d88c845..c290d36 100644 --- a/toolbox-Make-the-build-flags-match-Fedora-s-gobuild.patch +++ b/toolbox-Make-the-build-flags-match-Fedora-s-gobuild.patch @@ -1,4 +1,4 @@ -From f4582e4748a15c462eac229f9bd9214415f166c9 Mon Sep 17 00:00:00 2001 +From 3175ef2fab1f61f5784361070ac338dabda3c04e Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Mon, 29 Jun 2020 17:57:47 +0200 Subject: [PATCH] build: Make the build flags match Fedora's %{gobuildflags} @@ -50,5 +50,5 @@ index c572d6dfb02b..0e6a2efa6853 100755 exit "$?" -- -2.39.2 +2.43.0 diff --git a/toolbox-Simplify-removing-the-user-s-password.patch b/toolbox-Simplify-removing-the-user-s-password.patch deleted file mode 100644 index d10d870..0000000 --- a/toolbox-Simplify-removing-the-user-s-password.patch +++ /dev/null @@ -1,1056 +0,0 @@ -From 07d5c061eacec0a3b145947a9b95a11b705ea5d3 Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Sat, 12 Aug 2023 14:26:22 +0200 -Subject: [PATCH 1/5] test/system: Test that group and user IDs work - -These tests assume that the group and user information on the host -operating system can be provided by different plugins for the GNU Name -Service Switch (or NSS) functionality of the GNU C Library. eg., on -enterprise FreeIPA set-ups. However, it's expected that everything -inside the Toolbx container will be provided by /etc/group, /etc/passwd, -/etc/shadow, etc.. - -While /etc/group and /etc/passwd can be read by any user, /etc/shadow -can only be read by root. However, it's awkward to use sudo(8) in the -test cases involving /etc/shadow, because they ensure that root and -$USER don't need passwords to authenticate inside the container, and -sudo(8) itself depends on that. If sudo(8) is used, the test suite can -behave unexpectedly if Toolbx didn't set up the container correctly. -eg., it can get blocked waiting for a password. - -Hence, 'podman unshare' is used instead to enter the container's initial -user namespace, where $USER from the host appears as root. This is -sufficient because the test cases only need to read /etc/shadow inside -the Toolbx container. - -https://github.com/containers/toolbox/pull/1355 ---- - test/system/206-user.bats | 520 ++++++++++++++++++++++++++++++++++++++ - 1 file changed, 520 insertions(+) - create mode 100644 test/system/206-user.bats - -diff --git a/test/system/206-user.bats b/test/system/206-user.bats -new file mode 100644 -index 000000000000..fdb2a33da88c ---- /dev/null -+++ b/test/system/206-user.bats -@@ -0,0 +1,520 @@ -+# shellcheck shell=bats -+# -+# Copyright © 2023 Red Hat, Inc. -+# -+# Licensed under the Apache License, Version 2.0 (the "License"); -+# you may not use this file except in compliance with the License. -+# You may obtain a copy of the License at -+# -+# http://www.apache.org/licenses/LICENSE-2.0 -+# -+# Unless required by applicable law or agreed to in writing, software -+# distributed under the License is distributed on an "AS IS" BASIS, -+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+# See the License for the specific language governing permissions and -+# limitations under the License. -+# -+ -+load 'libs/bats-support/load' -+load 'libs/bats-assert/load' -+load 'libs/helpers' -+ -+setup() { -+ bats_require_minimum_version 1.7.0 -+ _setup_environment -+ cleanup_containers -+} -+ -+teardown() { -+ cleanup_containers -+} -+ -+@test "user: separate namespace" { -+ local ns_host -+ ns_host=$(readlink /proc/$$/ns/user) -+ -+ create_default_container -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run sh -c 'readlink /proc/$$/ns/user' -+ -+ assert_success -+ assert_line --index 0 --regexp '^user:\[[[:digit:]]+\]$' -+ refute_line --index 0 "$ns_host" -+ -+ if check_bats_version 1.10.0; then -+ assert [ ${#lines[@]} -eq 1 ] -+ else -+ assert [ ${#lines[@]} -eq 2 ] -+ fi -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: root in shadow(5) inside the default container" { -+ local default_container -+ default_container="$(get_system_id)-toolbox-$(get_system_version)" -+ -+ create_default_container -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount "$default_container")" -+ -+ "$TOOLBOX" run true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount "$default_container" -+ -+ assert_success -+ assert_line --regexp '^root::.+$' -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: root in shadow(5) inside Arch Linux" { -+ create_distro_container arch latest arch-toolbox-latest -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount arch-toolbox-latest)" -+ -+ "$TOOLBOX" run --distro arch true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount arch-toolbox-latest -+ -+ assert_success -+ assert_line --regexp '^root::.+$' -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: root in shadow(5) inside Fedora 34" { -+ create_distro_container fedora 34 fedora-toolbox-34 -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount fedora-toolbox-34)" -+ -+ "$TOOLBOX" run --distro fedora --release 34 true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount fedora-toolbox-34 -+ -+ assert_success -+ assert_line --regexp '^root::.+$' -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: root in shadow(5) inside RHEL 8.7" { -+ create_distro_container rhel 8.7 rhel-toolbox-8.7 -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount rhel-toolbox-8.7)" -+ -+ "$TOOLBOX" run --distro rhel --release 8.7 true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount rhel-toolbox-8.7 -+ -+ assert_success -+ assert_line --regexp '^root::.+$' -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: root in shadow(5) inside Ubuntu 16.04" { -+ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-16.04)" -+ -+ "$TOOLBOX" run --distro ubuntu --release 16.04 true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-16.04 -+ -+ assert_success -+ assert_line --regexp '^root::.+$' -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: root in shadow(5) inside Ubuntu 18.04" { -+ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-18.04)" -+ -+ "$TOOLBOX" run --distro ubuntu --release 18.04 true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-18.04 -+ -+ assert_success -+ assert_line --regexp '^root::.+$' -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: root in shadow(5) inside Ubuntu 20.04" { -+ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-20.04)" -+ -+ "$TOOLBOX" run --distro ubuntu --release 20.04 true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-20.04 -+ -+ assert_success -+ assert_line --regexp '^root::.+$' -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in passwd(5) inside the default container" { -+ local user_gecos -+ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" -+ -+ local user_id_real -+ user_id_real="$(id --real --user)" -+ -+ create_default_container -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run sh -c 'cat /etc/passwd' -+ -+ assert_success -+ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in passwd(5) inside Arch Linux" { -+ local user_gecos -+ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" -+ -+ local user_id_real -+ user_id_real="$(id --real --user)" -+ -+ create_distro_container arch latest arch-toolbox-latest -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch sh -c 'cat /etc/passwd' -+ -+ assert_success -+ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in passwd(5) inside Fedora 34" { -+ local user_gecos -+ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" -+ -+ local user_id_real -+ user_id_real="$(id --real --user)" -+ -+ create_distro_container fedora 34 fedora-toolbox-34 -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 sh -c 'cat /etc/passwd' -+ -+ assert_success -+ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in passwd(5) inside RHEL 8.7" { -+ local user_gecos -+ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" -+ -+ local user_id_real -+ user_id_real="$(id --real --user)" -+ -+ create_distro_container rhel 8.7 rhel-toolbox-8.7 -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 sh -c 'cat /etc/passwd' -+ -+ assert_success -+ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in passwd(5) inside Ubuntu 16.04" { -+ local user_gecos -+ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" -+ -+ local user_id_real -+ user_id_real="$(id --real --user)" -+ -+ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 sh -c 'cat /etc/passwd' -+ -+ assert_success -+ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in passwd(5) inside Ubuntu 18.04" { -+ local user_gecos -+ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" -+ -+ local user_id_real -+ user_id_real="$(id --real --user)" -+ -+ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 sh -c 'cat /etc/passwd' -+ -+ assert_success -+ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in passwd(5) inside Ubuntu 20.04" { -+ local user_gecos -+ user_gecos="$(getent passwd "$USER" | cut --delimiter : --fields 5)" -+ -+ local user_id_real -+ user_id_real="$(id --real --user)" -+ -+ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 20.04 sh -c 'cat /etc/passwd' -+ -+ assert_success -+ assert_line --regexp "^$USER::$user_id_real:$user_id_real:$user_gecos:$HOME:$SHELL$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in shadow(5) inside the default container" { -+ local default_container -+ default_container="$(get_system_id)-toolbox-$(get_system_version)" -+ -+ create_default_container -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount "$default_container")" -+ -+ "$TOOLBOX" run true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount "$default_container" -+ -+ assert_success -+ refute_line --regexp "^$USER:.*$" -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in shadow(5) inside Arch Linux" { -+ create_distro_container arch latest arch-toolbox-latest -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount arch-toolbox-latest)" -+ -+ "$TOOLBOX" run --distro arch true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount arch-toolbox-latest -+ -+ assert_success -+ refute_line --regexp "^$USER:.*$" -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in shadow(5) inside Fedora 34" { -+ create_distro_container fedora 34 fedora-toolbox-34 -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount fedora-toolbox-34)" -+ -+ "$TOOLBOX" run --distro fedora --release 34 true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount fedora-toolbox-34 -+ -+ assert_success -+ refute_line --regexp "^$USER:.*$" -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in shadow(5) inside RHEL 8.7" { -+ create_distro_container rhel 8.7 rhel-toolbox-8.7 -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount rhel-toolbox-8.7)" -+ -+ "$TOOLBOX" run --distro rhel --release 8.7 true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount rhel-toolbox-8.7 -+ -+ assert_success -+ refute_line --regexp "^$USER:.*$" -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in shadow(5) inside Ubuntu 16.04" { -+ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-16.04)" -+ -+ "$TOOLBOX" run --distro ubuntu --release 16.04 true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-16.04 -+ -+ assert_success -+ refute_line --regexp "^$USER:.*$" -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in shadow(5) inside Ubuntu 18.04" { -+ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-18.04)" -+ -+ "$TOOLBOX" run --distro ubuntu --release 18.04 true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-18.04 -+ -+ assert_success -+ refute_line --regexp "^$USER:.*$" -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in shadow(5) inside Ubuntu 20.04" { -+ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 -+ container_root_file_system="$("$PODMAN" unshare "$PODMAN" mount ubuntu-toolbox-20.04)" -+ -+ "$TOOLBOX" run --distro ubuntu --release 20.04 true -+ -+ run --keep-empty-lines --separate-stderr "$PODMAN" unshare cat "$container_root_file_system/etc/shadow" -+ "$PODMAN" unshare "$PODMAN" unmount ubuntu-toolbox-20.04 -+ -+ assert_success -+ refute_line --regexp "^$USER:.*$" -+ assert [ ${#lines[@]} -gt 0 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in group(5) inside the default container" { -+ create_default_container -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run sh -c 'cat /etc/group' -+ -+ assert_success -+ assert_line --regexp "^(sudo|wheel):x:[[:digit:]]+:$USER$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in group(5) inside Arch Linux" { -+ create_distro_container arch latest arch-toolbox-latest -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch sh -c 'cat /etc/group' -+ -+ assert_success -+ assert_line --regexp "^wheel:x:[[:digit:]]+:$USER$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in group(5) inside Fedora 34" { -+ create_distro_container fedora 34 fedora-toolbox-34 -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 sh -c 'cat /etc/group' -+ -+ assert_success -+ assert_line --regexp "^wheel:x:[[:digit:]]+:$USER$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in group(5) inside RHEL 8.7" { -+ create_distro_container rhel 8.7 rhel-toolbox-8.7 -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 sh -c 'cat /etc/group' -+ -+ assert_success -+ assert_line --regexp "^wheel:x:[[:digit:]]+:$USER$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in group(5) inside Ubuntu 16.04" { -+ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 sh -c 'cat /etc/group' -+ -+ assert_success -+ assert_line --regexp "^sudo:x:[[:digit:]]+:$USER$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in group(5) inside Ubuntu 18.04" { -+ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 sh -c 'cat /etc/group' -+ -+ assert_success -+ assert_line --regexp "^sudo:x:[[:digit:]]+:$USER$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} -+ -+@test "user: $USER in group(5) inside Ubuntu 20.04" { -+ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 -+ -+ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 20.04 sh -c 'cat /etc/group' -+ -+ assert_success -+ assert_line --regexp "^sudo:x:[[:digit:]]+:$USER$" -+ assert [ ${#lines[@]} -gt 1 ] -+ -+ # shellcheck disable=SC2154 -+ assert [ ${#stderr_lines[@]} -eq 0 ] -+} --- -2.41.0 - - -From 22ba72f3152650d538437bf298ebde4a63e2adc9 Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Wed, 4 Nov 2020 00:55:31 +0100 -Subject: [PATCH 2/5] Deprecate the --monitor-host option of 'init-container' - -The --monitor-host option was added to the 'init-container' command in -commit 8b84b5e4604921fa to accommodate Podman versions older than 1.2.0 -that didn't have the '--dns none' and '--no-hosts' options for -'podman create'. These options are necessary to keep the Toolbx -container's /etc/resolv.conf and /etc/hosts files synchronized with -those of the host. - -Note that Podman 1.2.0 was already available a few months before -commit 8b84b5e4604921fa introduced the --monitor-host option. The -chances of someone using an older Podman back then was already on the -decline, and it's very unlikely that a container created with such a -Podman has survived till this date. - -Commit b6b484fa792b442a raised the minimum required Podman version to -1.4.0, and made the '--dns none' and '--no-hosts' options a hard -requirement. The minimum required Podman version was again raised -recently in commit 8e80dd5db1e6f40b to 1.6.4. Therefore, these days, -there's no need to separately use the --monitor-host option of -'init-container' for newly created containers to indicate that the -Podman version wasn't older than 1.2.0. - -Given all this, it's time to stop using the --monitor-host option of -'init-container', and assume that it's always set. The option is still -accepted to retain compatibility with existing Toolbx containers. - -For containers that were created with the --monitor-host option, a -deprecation notice will be shown as: - $ podman start --attach CONTAINER - Flag --monitor-host has been deprecated, it does nothing - ... - -https://github.com/containers/toolbox/pull/617 ---- - doc/toolbox-init-container.1.md | 32 +++--------- - src/cmd/create.go | 1 - - src/cmd/initContainer.go | 86 ++++++++++++++++----------------- - 3 files changed, 49 insertions(+), 70 deletions(-) - -diff --git a/doc/toolbox-init-container.1.md b/doc/toolbox-init-container.1.md -index 45c9a77939f2..51a7b1ee643d 100644 ---- a/doc/toolbox-init-container.1.md -+++ b/doc/toolbox-init-container.1.md -@@ -9,7 +9,6 @@ toolbox\-init\-container - Initialize a running container - *--home-link* - *--media-link* - *--mnt-link* -- *--monitor-host* - *--shell SHELL* - *--uid UID* - *--user USER* -@@ -76,31 +75,12 @@ Make `/mnt` a symbolic link to `/var/mnt`. - - **--monitor-host** - --Ensures that certain configuration files inside the toolbox container are kept --synchronized with their counterparts on the host, and bind mounts some paths --from the host's file system into the container. -- --The synchronized files are: -- --- `/etc/host.conf` --- `/etc/hosts` --- `/etc/localtime` --- `/etc/resolv.conf` --- `/etc/timezone` -- --The bind mounted paths are: -- --- `/etc/machine-id` --- `/run/libvirt` --- `/run/systemd/journal` --- `/run/systemd/resolve` --- `/run/udev/data` --- `/tmp` --- `/var/lib/flatpak` --- `/var/lib/libvirt` --- `/var/lib/systemd/coredump` --- `/var/log/journal` --- `/var/mnt` -+Deprecated, does nothing. -+ -+Crucial configuration files inside the toolbox container are always kept -+synchronized with their counterparts on the host, and various subsets of the -+host's file system hierarchy are always bind mounted to their corresponding -+locations inside the toolbox container. - - **--shell** SHELL - -diff --git a/src/cmd/create.go b/src/cmd/create.go -index 2a103f01ed2d..6cec99258847 100644 ---- a/src/cmd/create.go -+++ b/src/cmd/create.go -@@ -393,7 +393,6 @@ func createContainer(container, image, release, authFile string, showCommandToEn - "--shell", userShell, - "--uid", currentUser.Uid, - "--user", currentUser.Username, -- "--monitor-host", - } - - entryPoint = append(entryPoint, slashHomeLink...) -diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go -index c4cd1b02d298..cb132bffc817 100644 ---- a/src/cmd/initContainer.go -+++ b/src/cmd/initContainer.go -@@ -107,8 +107,12 @@ func init() { - - flags.BoolVar(&initContainerFlags.monitorHost, - "monitor-host", -- false, -- "Ensure that certain configuration files inside the toolbox container are in sync with the host") -+ true, -+ "Deprecated, does nothing") -+ if err := flags.MarkDeprecated("monitor-host", "it does nothing"); err != nil { -+ panicMsg := fmt.Sprintf("cannot mark --monitor-host as deprecated: %s", err) -+ panic(panicMsg) -+ } - - flags.StringVar(&initContainerFlags.shell, - "shell", -@@ -163,59 +167,55 @@ func initContainer(cmd *cobra.Command, args []string) error { - - defer toolboxEnvFile.Close() - -- if initContainerFlags.monitorHost { -- logrus.Debug("Monitoring host") -- -- if utils.PathExists("/run/host/etc") { -- logrus.Debug("Path /run/host/etc exists") -- -- if _, err := os.Readlink("/etc/host.conf"); err != nil { -- if err := redirectPath("/etc/host.conf", -- "/run/host/etc/host.conf", -- false); err != nil { -- return err -- } -- } -+ if utils.PathExists("/run/host/etc") { -+ logrus.Debug("Path /run/host/etc exists") - -- if _, err := os.Readlink("/etc/hosts"); err != nil { -- if err := redirectPath("/etc/hosts", -- "/run/host/etc/hosts", -- false); err != nil { -- return err -- } -+ if _, err := os.Readlink("/etc/host.conf"); err != nil { -+ if err := redirectPath("/etc/host.conf", -+ "/run/host/etc/host.conf", -+ false); err != nil { -+ return err - } -+ } - -- if localtimeTarget, err := os.Readlink("/etc/localtime"); err != nil || -- localtimeTarget != "/run/host/etc/localtime" { -- if err := redirectPath("/etc/localtime", -- "/run/host/etc/localtime", -- false); err != nil { -- return err -- } -+ if _, err := os.Readlink("/etc/hosts"); err != nil { -+ if err := redirectPath("/etc/hosts", -+ "/run/host/etc/hosts", -+ false); err != nil { -+ return err - } -+ } - -- if err := updateTimeZoneFromLocalTime(); err != nil { -+ if localtimeTarget, err := os.Readlink("/etc/localtime"); err != nil || -+ localtimeTarget != "/run/host/etc/localtime" { -+ if err := redirectPath("/etc/localtime", -+ "/run/host/etc/localtime", -+ false); err != nil { - return err - } -+ } -+ -+ if err := updateTimeZoneFromLocalTime(); err != nil { -+ return err -+ } - -- if _, err := os.Readlink("/etc/resolv.conf"); err != nil { -- if err := redirectPath("/etc/resolv.conf", -- "/run/host/etc/resolv.conf", -- false); err != nil { -- return err -- } -+ if _, err := os.Readlink("/etc/resolv.conf"); err != nil { -+ if err := redirectPath("/etc/resolv.conf", -+ "/run/host/etc/resolv.conf", -+ false); err != nil { -+ return err - } -+ } - -- for _, mount := range initContainerMounts { -- if err := mountBind(mount.containerPath, mount.source, mount.flags); err != nil { -- return err -- } -+ for _, mount := range initContainerMounts { -+ if err := mountBind(mount.containerPath, mount.source, mount.flags); err != nil { -+ return err - } -+ } - -- if utils.PathExists("/sys/fs/selinux") { -- if err := mountBind("/sys/fs/selinux", "/usr/share/empty", ""); err != nil { -- return err -- } -+ if utils.PathExists("/sys/fs/selinux") { -+ if err := mountBind("/sys/fs/selinux", "/usr/share/empty", ""); err != nil { -+ return err - } - } - } --- -2.41.0 - - -From 66a791ff10234023b858b7a28dd98985b054eca1 Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Tue, 7 Mar 2023 16:13:04 +0100 -Subject: [PATCH 3/5] cmd/initContainer: Bind mount locations regardless of - /run/host/etc - -Bind mounting the locations at runtime doesn't really have anything to -do with whether /run/host/etc is present inside the Toolbx container. - -The only possible exception could have been /etc/machine-id, but it -isn't, because the bind mount is only performed if the source at -/run/host/etc/machine-id is present. - -This is a historical mistake that has persisted for a long time, since, -in practice, /run/host/etc will almost always exist inside the Toolbx -container. It's time to finally correct it. - -Fallout from 9436bbece01d7aa4dc91b4013ed9f80d0b8d34f4 - -https://github.com/containers/toolbox/pull/1255 ---- - src/cmd/initContainer.go | 24 ++++++++++++------------ - 1 file changed, 12 insertions(+), 12 deletions(-) - -diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go -index cb132bffc817..153e5ccb824e 100644 ---- a/src/cmd/initContainer.go -+++ b/src/cmd/initContainer.go -@@ -206,18 +206,6 @@ func initContainer(cmd *cobra.Command, args []string) error { - return err - } - } -- -- for _, mount := range initContainerMounts { -- if err := mountBind(mount.containerPath, mount.source, mount.flags); err != nil { -- return err -- } -- } -- -- if utils.PathExists("/sys/fs/selinux") { -- if err := mountBind("/sys/fs/selinux", "/usr/share/empty", ""); err != nil { -- return err -- } -- } - } - - if initContainerFlags.mediaLink { -@@ -236,6 +224,18 @@ func initContainer(cmd *cobra.Command, args []string) error { - } - } - -+ for _, mount := range initContainerMounts { -+ if err := mountBind(mount.containerPath, mount.source, mount.flags); err != nil { -+ return err -+ } -+ } -+ -+ if utils.PathExists("/sys/fs/selinux") { -+ if err := mountBind("/sys/fs/selinux", "/usr/share/empty", ""); err != nil { -+ return err -+ } -+ } -+ - if _, err := user.Lookup(initContainerFlags.user); err != nil { - if err := configureUsers(initContainerFlags.uid, - initContainerFlags.user, --- -2.41.0 - - -From d416f1b4abd0782526c011b078442856c733e718 Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Tue, 15 Aug 2023 20:57:46 +0200 -Subject: [PATCH 4/5] cmd/initContainer: Simplify code by removing a function - parameter - -Until now, configureUsers() was pushing the burden of deciding whether -to add a new user or modify an existing one on the callers, even though -it can trivially decide itself. Involving the caller loosens the -encapsulation of the user configuration logic by spreading it across -configureUsers() and it's caller, and adds an extra function parameter -that needs to be carefully set and is vulnerable to programmer errors. - -Fallout from 9ea6fe5852ea8f5225114d825e8e6813e2a3cfea - -https://github.com/containers/toolbox/pull/1356 ---- - src/cmd/initContainer.go | 62 ++++++++++++++++------------------------ - 1 file changed, 24 insertions(+), 38 deletions(-) - -diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go -index 153e5ccb824e..02c389635378 100644 ---- a/src/cmd/initContainer.go -+++ b/src/cmd/initContainer.go -@@ -236,24 +236,12 @@ func initContainer(cmd *cobra.Command, args []string) error { - } - } - -- if _, err := user.Lookup(initContainerFlags.user); err != nil { -- if err := configureUsers(initContainerFlags.uid, -- initContainerFlags.user, -- initContainerFlags.home, -- initContainerFlags.shell, -- initContainerFlags.homeLink, -- false); err != nil { -- return err -- } -- } else { -- if err := configureUsers(initContainerFlags.uid, -- initContainerFlags.user, -- initContainerFlags.home, -- initContainerFlags.shell, -- initContainerFlags.homeLink, -- true); err != nil { -- return err -- } -+ if err := configureUsers(initContainerFlags.uid, -+ initContainerFlags.user, -+ initContainerFlags.home, -+ initContainerFlags.shell, -+ initContainerFlags.homeLink); err != nil { -+ return err - } - - if utils.PathExists("/etc/krb5.conf.d") && !utils.PathExists("/etc/krb5.conf.d/kcm_default_ccache") { -@@ -386,9 +374,7 @@ func initContainerHelp(cmd *cobra.Command, args []string) { - } - } - --func configureUsers(targetUserUid int, -- targetUser, targetUserHome, targetUserShell string, -- homeLink, targetUserExists bool) error { -+func configureUsers(targetUserUid int, targetUser, targetUserHome, targetUserShell string, homeLink bool) error { - if homeLink { - if err := redirectPath("/home", "/var/home", true); err != nil { - return err -@@ -400,45 +386,45 @@ func configureUsers(targetUserUid int, - return fmt.Errorf("failed to get group for sudo: %w", err) - } - -- if targetUserExists { -- logrus.Debugf("Modifying user %s with UID %d:", targetUser, targetUserUid) -+ if _, err := user.Lookup(targetUser); err != nil { -+ logrus.Debugf("Adding user %s with UID %d:", targetUser, targetUserUid) - -- usermodArgs := []string{ -- "--append", -+ useraddArgs := []string{ - "--groups", sudoGroup, -- "--home", targetUserHome, -+ "--home-dir", targetUserHome, -+ "--no-create-home", - "--shell", targetUserShell, - "--uid", fmt.Sprint(targetUserUid), - targetUser, - } - -- logrus.Debug("usermod") -- for _, arg := range usermodArgs { -+ logrus.Debug("useradd") -+ for _, arg := range useraddArgs { - logrus.Debugf("%s", arg) - } - -- if err := shell.Run("usermod", nil, nil, nil, usermodArgs...); err != nil { -- return fmt.Errorf("failed to modify user %s with UID %d: %w", targetUser, targetUserUid, err) -+ if err := shell.Run("useradd", nil, nil, nil, useraddArgs...); err != nil { -+ return fmt.Errorf("failed to add user %s with UID %d: %w", targetUser, targetUserUid, err) - } - } else { -- logrus.Debugf("Adding user %s with UID %d:", targetUser, targetUserUid) -+ logrus.Debugf("Modifying user %s with UID %d:", targetUser, targetUserUid) - -- useraddArgs := []string{ -+ usermodArgs := []string{ -+ "--append", - "--groups", sudoGroup, -- "--home-dir", targetUserHome, -- "--no-create-home", -+ "--home", targetUserHome, - "--shell", targetUserShell, - "--uid", fmt.Sprint(targetUserUid), - targetUser, - } - -- logrus.Debug("useradd") -- for _, arg := range useraddArgs { -+ logrus.Debug("usermod") -+ for _, arg := range usermodArgs { - logrus.Debugf("%s", arg) - } - -- if err := shell.Run("useradd", nil, nil, nil, useraddArgs...); err != nil { -- return fmt.Errorf("failed to add user %s with UID %d: %w", targetUser, targetUserUid, err) -+ if err := shell.Run("usermod", nil, nil, nil, usermodArgs...); err != nil { -+ return fmt.Errorf("failed to modify user %s with UID %d: %w", targetUser, targetUserUid, err) - } - } - --- -2.41.0 - - -From e673dc792438c64683237d26b21d005ffb008fd5 Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Tue, 22 Aug 2023 23:29:43 +0200 -Subject: [PATCH 5/5] cmd/initContainer: Simplify removing the user's password - -It's one less invocation of an external command, which is good because -spawning a new process is generally expensive. - -One positive side-effect of this is that on some Active Directory -set-ups, the entry point no longer fails with: - Error: failed to remove password for user login@company.com: failed - to invoke passwd(1) - -... because of: - # passwd --delete login@company.com - passwd: Libuser error at line: 210 - name contains invalid char `@'. - -This is purely an accident, and isn't meant to be an intential change to -support Active Directory. Tools like useradd(8) and usermod(8) from -Shadow aren't meant to work with Active Directory users, and, hence, it -can still break in other ways. For that, one option is to expose $USER -from the host operating system to the Toolbx container through a Varlink -interface that can be used by nss-systemd inside the container. - -Based on an idea from Si. - -https://github.com/containers/toolbox/issues/585 ---- - src/cmd/initContainer.go | 8 ++------ - 1 file changed, 2 insertions(+), 6 deletions(-) - -diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go -index 02c389635378..91b53cee7d0d 100644 ---- a/src/cmd/initContainer.go -+++ b/src/cmd/initContainer.go -@@ -393,6 +393,7 @@ func configureUsers(targetUserUid int, targetUser, targetUserHome, targetUserShe - "--groups", sudoGroup, - "--home-dir", targetUserHome, - "--no-create-home", -+ "--password", "", - "--shell", targetUserShell, - "--uid", fmt.Sprint(targetUserUid), - targetUser, -@@ -413,6 +414,7 @@ func configureUsers(targetUserUid int, targetUser, targetUserHome, targetUserShe - "--append", - "--groups", sudoGroup, - "--home", targetUserHome, -+ "--password", "", - "--shell", targetUserShell, - "--uid", fmt.Sprint(targetUserUid), - targetUser, -@@ -428,12 +430,6 @@ func configureUsers(targetUserUid int, targetUser, targetUserHome, targetUserShe - } - } - -- logrus.Debugf("Removing password for user %s", targetUser) -- -- if err := shell.Run("passwd", nil, nil, nil, "--delete", targetUser); err != nil { -- return fmt.Errorf("failed to remove password for user %s: %w", targetUser, err) -- } -- - logrus.Debug("Removing password for user root") - - if err := shell.Run("passwd", nil, nil, nil, "--delete", "root"); err != nil { --- -2.41.0 - diff --git a/toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch b/toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch deleted file mode 100644 index adf39a3..0000000 --- a/toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 1fde98456652ddbcb750ade2121c5ceec93fbfae Mon Sep 17 00:00:00 2001 -From: Debarshi Ray -Date: Thu, 13 Jul 2023 13:08:40 +0200 -Subject: [PATCH] cmd/initContainer: Be aware of security hardened mount points - -Sometimes locations such as /var/lib/flatpak, /var/lib/systemd/coredump -and /var/log/journal sit on security hardened mount points that are -marked as 'nosuid,nodev,noexec' [1]. In such cases, when Toolbx is used -rootless, an attempt to bind mount these locations read-only at runtime -with mount(8) fails because of permission problems: - # mount --rbind -o ro - mount: : filesystem was mounted, but any subsequent - operation failed: Unknown error 5005. - -(Note that the above error message from mount(8) was subsequently -improved to show something more meaningful than 'Unknown error' [2].) - -The problem is that 'init-container' is running inside the container's -mount and user namespace, and the source paths were mounted inside the -host's namespace with 'nosuid,nodev,noexec'. The above mount(8) call -tries to remove the 'nosuid,nodev,noexec' flags from the mount point and -replace them with only 'ro', which is something that can't be done from -a child namespace. - -Note that this doesn't fail when Toolbx is running as root. This is -because the container uses the host's user namespace and is able to -remove the 'nosuid,nodev,noexec' flags from the mount point and replace -them with only 'ro'. Even though it doesn't fail, the flags shouldn't -get replaced like that inside the container, because it removes the -security hardening of those mount points. - -There's actually no benefit in bind mounting these paths as read-only. -It was historically done this way 'just to be safe' because a user isn't -expected to write to these locations from inside a container. However, -Toolbx doesn't intend to provide any heightened security beyond what's -already available on the host. - -Hence, it's better to get out of the way and leave it to the permissions -on the source location from the host operating system to guard the -castle. This is accomplished by not passing any file system options to -mount(8) [1]. - -Based on an idea from Si. - -[1] https://man7.org/linux/man-pages/man8/mount.8.html - -[2] util-linux commit 9420ca34dc8b6f0f - https://github.com/util-linux/util-linux/commit/9420ca34dc8b6f0f - https://github.com/util-linux/util-linux/pull/2376 - -https://github.com/containers/toolbox/issues/911 ---- - src/cmd/initContainer.go | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/src/cmd/initContainer.go b/src/cmd/initContainer.go -index 465ac063b210..c4cd1b02d298 100644 ---- a/src/cmd/initContainer.go -+++ b/src/cmd/initContainer.go -@@ -62,10 +62,10 @@ var ( - {"/run/udev/data", "/run/host/run/udev/data", ""}, - {"/run/udev/tags", "/run/host/run/udev/tags", ""}, - {"/tmp", "/run/host/tmp", "rslave"}, -- {"/var/lib/flatpak", "/run/host/var/lib/flatpak", "ro"}, -+ {"/var/lib/flatpak", "/run/host/var/lib/flatpak", ""}, - {"/var/lib/libvirt", "/run/host/var/lib/libvirt", ""}, -- {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", "ro"}, -- {"/var/log/journal", "/run/host/var/log/journal", "ro"}, -+ {"/var/lib/systemd/coredump", "/run/host/var/lib/systemd/coredump", ""}, -+ {"/var/log/journal", "/run/host/var/log/journal", ""}, - {"/var/mnt", "/run/host/var/mnt", "rslave"}, - } - ) --- -2.41.0 - diff --git a/toolbox.spec b/toolbox.spec index d0bbe8f..3e01bfe 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -1,7 +1,7 @@ %global __brp_check_rpaths %{nil} Name: toolbox -Version: 0.0.99.4 +Version: 0.0.99.5 %global goipath github.com/containers/%{name} @@ -17,8 +17,8 @@ Version: 0.0.99.4 %endif %endif -Release: 6%{?dist} -Summary: Tool for containerized command line environments on Linux +Release: 1%{?dist} +Summary: Tool for interactive command line environments on Linux License: ASL 2.0 URL: https://containertoolbx.org/ @@ -27,11 +27,6 @@ Source0: https://github.com/containers/%{name}/releases/download/%{version # RHEL specific Source1: %{name}.conf -# Upstream -Patch0: toolbox-Build-fixes.patch -Patch1: toolbox-cmd-initContainer-Be-aware-of-security-hardened-moun.patch -Patch2: toolbox-Simplify-removing-the-user-s-password.patch - # Fedora specific Patch100: toolbox-Make-the-build-flags-match-Fedora-s-gobuild.patch Patch101: toolbox-Make-the-build-flags-match-Fedora-s-gobuild-for-PPC64.patch @@ -43,7 +38,7 @@ Patch202: toolbox-Add-migration-paths-for-coreos-toolbox-users.patch BuildRequires: gcc BuildRequires: go-md2man -BuildRequires: golang >= 1.19.4 +BuildRequires: golang >= 1.20 BuildRequires: meson >= 0.58.0 BuildRequires: pkgconfig(bash-completion) BuildRequires: shadow-utils-subid-devel @@ -53,14 +48,15 @@ BuildRequires: systemd-rpm-macros BuildRequires: golang(github.com/HarryMichal/go-version) >= 1.0.1 BuildRequires: golang(github.com/acobaugh/osrelease) >= 0.1.0 BuildRequires: golang(github.com/briandowns/spinner) >= 1.17.0 -BuildRequires: golang(github.com/docker/go-units) >= 0.4.0 +BuildRequires: golang(github.com/docker/go-units) >= 0.5.0 BuildRequires: golang(github.com/fsnotify/fsnotify) >= 1.5.1 BuildRequires: golang(github.com/godbus/dbus) >= 5.0.6 BuildRequires: golang(github.com/sirupsen/logrus) >= 1.8.1 BuildRequires: golang(github.com/spf13/cobra) >= 1.3.0 BuildRequires: golang(github.com/spf13/viper) >= 1.10.1 -BuildRequires: golang(golang.org/x/sys/unix) -BuildRequires: golang(golang.org/x/term) +BuildRequires: golang(golang.org/x/sys/unix) >= 0.1.0 +BuildRequires: golang(golang.org/x/text) >= 0.3.8 +BuildRequires: golang(gopkg.in/yaml.v3) >= 3.0.0 BuildRequires: pkgconfig(fish) # for tests # BuildRequires: codespell @@ -68,17 +64,25 @@ BuildRequires: pkgconfig(fish) # BuildRequires: ShellCheck %endif +Recommends: skopeo + Requires: containers-common -Requires: podman >= 1.4.0 +Requires: podman >= 1.6.4 %if ! 0%{?rhel} Requires: flatpak-session-helper %endif %description -Toolbox is a tool for Linux operating systems, which allows the use of -containerized command line environments. It is built on top of Podman and -other standard container technologies from OCI. +Toolbx is a tool for Linux, which allows the use of interactive command line +environments for development and troubleshooting the host operating system, +without having to install software on the host. It is built on top of Podman +and other standard container technologies from OCI. + +Toolbx environments have seamless access to the user's home directory, the +Wayland and X11 sockets, networking (including Avahi), removable devices (like +USB sticks), systemd journal, SSH agent, D-Bus, ulimits, /dev and the udev +database, etc.. %if ! 0%{?rhel} @@ -162,14 +166,13 @@ Summary: Tests for %{name} Requires: %{name}%{?_isa} = %{version}-%{release} Requires: coreutils -Requires: gawk Requires: grep # for htpasswd Requires: httpd-tools Requires: openssl Requires: skopeo %if ! 0%{?rhel} -Requires: bats +Requires: bats >= 1.7.0 %endif %description tests @@ -178,9 +181,6 @@ The %{name}-tests package contains system tests for %{name}. %prep %setup -q -%patch0 -p1 -%patch1 -p1 -%patch2 -p1 %if 0%{?fedora} %ifnarch ppc64 @@ -265,6 +265,9 @@ install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf %changelog +* Tue Dec 19 2023 Debarshi Ray - 0.0.99.5-1 +- Update to 0.0.99.5 + * Tue Dec 19 2023 Debarshi Ray - 0.0.99.4-6 - Require openssl(1) for the system tests in the tests subpackage From ce1386fb6aef5bb4bbff17fa16312ed0ccb96e3d Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Tue, 13 Feb 2024 23:04:34 +0100 Subject: [PATCH 14/15] Unbreak Podman's downstream Fedora CI https://bugzilla.redhat.com/show_bug.cgi?id=2263968 --- ...nbreak-Podman-s-downstream-Fedora-CI.patch | 47 +++++++++++++++++++ toolbox.spec | 10 +++- 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch diff --git a/toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch b/toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch new file mode 100644 index 0000000..92cebc8 --- /dev/null +++ b/toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch @@ -0,0 +1,47 @@ +From 6838e9347199e875f9869acd2afa64688161ca11 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Tue, 13 Feb 2024 21:56:06 +0100 +Subject: [PATCH] test/system: Unbreak Podman's downstream Fedora CI + +The paths to bats-assert and bats-support are broken, if bats(1) is +invoked from any other location than the parent directory of the 'tests' +directory. eg., Podman's downstream Fedora CI invokes the tests as: + $ cd /path/to/toolbox/test/system + $ bats . + +... and it led to [1]: + 1..306 + # test suite: Set up + # Missing dependencies + # Forgot to run 'git submodule init' and 'git submodule update' ? + # test suite: Tear down + not ok 1 setup_suite + # (from function `setup_suite' in test file ./setup_suite.bash, line 33) + # `return 1' failed + # bats warning: Executed 1 instead of expected 306 tests + +Fallout from 2c0960660330dc6be6861502988695f9812c475a + +[1] https://bugzilla.redhat.com/show_bug.cgi?id=2263968 + +https://github.com/containers/toolbox/pull/1448 +--- + test/system/setup_suite.bash | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/test/system/setup_suite.bash b/test/system/setup_suite.bash +index 78507d660529..649018f01e96 100644 +--- a/test/system/setup_suite.bash ++++ b/test/system/setup_suite.bash +@@ -17,7 +17,7 @@ + + missing_dependencies=false + +-if [ -f test/system/libs/bats-assert/load.bash ] && [ -f test/system/libs/bats-support/load.bash ]; then ++if [ -f "$BATS_TEST_DIRNAME/libs/bats-assert/load.bash" ] && [ -f "$BATS_TEST_DIRNAME/libs/bats-support/load.bash" ]; then + load 'libs/helpers' + else + missing_dependencies=true +-- +2.43.0 + diff --git a/toolbox.spec b/toolbox.spec index 3e01bfe..739497a 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -17,7 +17,7 @@ Version: 0.0.99.5 %endif %endif -Release: 1%{?dist} +Release: 2%{?dist} Summary: Tool for interactive command line environments on Linux License: ASL 2.0 @@ -27,6 +27,9 @@ Source0: https://github.com/containers/%{name}/releases/download/%{version # RHEL specific Source1: %{name}.conf +# Upstream +Patch0: toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch + # Fedora specific Patch100: toolbox-Make-the-build-flags-match-Fedora-s-gobuild.patch Patch101: toolbox-Make-the-build-flags-match-Fedora-s-gobuild-for-PPC64.patch @@ -182,6 +185,8 @@ The %{name}-tests package contains system tests for %{name}. %prep %setup -q +%patch0 -p1 + %if 0%{?fedora} %ifnarch ppc64 %patch100 -p1 @@ -265,6 +270,9 @@ install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf %changelog +* Tue Feb 13 2024 Debarshi Ray - 0.0.99.5-2 +- Unbreak Podman's downstream Fedora CI + * Tue Dec 19 2023 Debarshi Ray - 0.0.99.5-1 - Update to 0.0.99.5 From bd9d7756563a988ffd1e29e86ae910f25ba03435 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Tue, 27 Feb 2024 16:12:07 +0100 Subject: [PATCH 15/15] Unbreak Podman's downstream Fedora CI (part 2) ... and backport some new upstream tests. https://bugzilla.redhat.com/show_bug.cgi?id=2263968 --- ...nbreak-Podman-s-downstream-Fedora-CI.patch | 167 +++- toolbox-test-system-new.patch | 894 ++++++++++++++++++ toolbox.spec | 10 +- 3 files changed, 1066 insertions(+), 5 deletions(-) create mode 100644 toolbox-test-system-new.patch diff --git a/toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch b/toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch index 92cebc8..1956003 100644 --- a/toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch +++ b/toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch @@ -1,7 +1,7 @@ -From 6838e9347199e875f9869acd2afa64688161ca11 Mon Sep 17 00:00:00 2001 +From a859f73d075ec0505994d8ce0f371ec28e466983 Mon Sep 17 00:00:00 2001 From: Debarshi Ray Date: Tue, 13 Feb 2024 21:56:06 +0100 -Subject: [PATCH] test/system: Unbreak Podman's downstream Fedora CI +Subject: [PATCH 1/2] test/system: Unbreak Podman's downstream Fedora CI The paths to bats-assert and bats-support are broken, if bats(1) is invoked from any other location than the parent directory of the 'tests' @@ -30,7 +30,7 @@ https://github.com/containers/toolbox/pull/1448 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/system/setup_suite.bash b/test/system/setup_suite.bash -index 78507d660529..649018f01e96 100644 +index e4edf232bcd8..01985b7f9afc 100644 --- a/test/system/setup_suite.bash +++ b/test/system/setup_suite.bash @@ -17,7 +17,7 @@ @@ -45,3 +45,164 @@ index 78507d660529..649018f01e96 100644 -- 2.43.0 + +From a183876eae2bb4ffd84bca4303fc28be6725ebc2 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Fri, 23 Feb 2024 10:38:16 +0100 +Subject: [PATCH 2/2] test/system: Unbreak Podman's downstream Fedora CI (part + 2) + +The working directory from which bats(1) is invoked might not be part of +the Toolbx container. eg., Podman's downstream Fedora CI invokes the +tests as: + $ cd /path/to/toolbox/test/system + $ bats . + +... and it led to [1]: + not ok 110 run: Smoke test with true(1) + # (from function `assert_output' in file + ./libs/bats-assert/src/assert.bash, line 255, + # in test file ./104-run.bats, line 38) + # `assert_output ""' failed + # + # -- output differs -- + # expected (0 lines): + # + # actual (3 lines): + # Error: crun: chdir to `/usr/share/toolbox/test/system`: No such + file or directory: OCI runtime attempted to invoke a command that + was not found + # Error: directory /usr/share/toolbox/test/system not found in + container fedora-toolbox-41 + # Using /home/testuser instead. + # -- + # + +[1] https://bugzilla.redhat.com/show_bug.cgi?id=2263968 + +https://github.com/containers/toolbox/pull/1457 +--- + test/system/104-run.bats | 2 ++ + test/system/201-ipc.bats | 2 ++ + test/system/203-network.bats | 2 ++ + test/system/206-user.bats | 2 ++ + test/system/210-ulimit.bats | 2 ++ + test/system/211-dbus.bats | 2 ++ + test/system/220-environment-variables.bats | 2 ++ + 7 files changed, 14 insertions(+) + +diff --git a/test/system/104-run.bats b/test/system/104-run.bats +index ff11a8477062..a0cb89fdeeca 100644 +--- a/test/system/104-run.bats ++++ b/test/system/104-run.bats +@@ -23,9 +23,11 @@ setup() { + bats_require_minimum_version 1.7.0 + _setup_environment + cleanup_containers ++ pushd "$HOME" || return 1 + } + + teardown() { ++ popd || return 1 + cleanup_containers + } + +diff --git a/test/system/201-ipc.bats b/test/system/201-ipc.bats +index 15c791dec86d..09200b41d06c 100644 +--- a/test/system/201-ipc.bats ++++ b/test/system/201-ipc.bats +@@ -23,9 +23,11 @@ setup() { + bats_require_minimum_version 1.7.0 + _setup_environment + cleanup_containers ++ pushd "$HOME" || return 1 + } + + teardown() { ++ popd || return 1 + cleanup_containers + } + +diff --git a/test/system/203-network.bats b/test/system/203-network.bats +index db1ba561f314..012374e3317f 100644 +--- a/test/system/203-network.bats ++++ b/test/system/203-network.bats +@@ -35,9 +35,11 @@ setup() { + bats_require_minimum_version 1.7.0 + _setup_environment + cleanup_containers ++ pushd "$HOME" || return 1 + } + + teardown() { ++ popd || return 1 + cleanup_containers + } + +diff --git a/test/system/206-user.bats b/test/system/206-user.bats +index 2df7862f259e..473a6b40905a 100644 +--- a/test/system/206-user.bats ++++ b/test/system/206-user.bats +@@ -23,9 +23,11 @@ setup() { + bats_require_minimum_version 1.7.0 + _setup_environment + cleanup_containers ++ pushd "$HOME" || return 1 + } + + teardown() { ++ popd || return 1 + cleanup_containers + } + +diff --git a/test/system/210-ulimit.bats b/test/system/210-ulimit.bats +index ea0c46685df1..ea08feea1513 100644 +--- a/test/system/210-ulimit.bats ++++ b/test/system/210-ulimit.bats +@@ -23,9 +23,11 @@ setup() { + bats_require_minimum_version 1.7.0 + _setup_environment + cleanup_containers ++ pushd "$HOME" || return 1 + } + + teardown() { ++ popd || return 1 + cleanup_containers + } + +diff --git a/test/system/211-dbus.bats b/test/system/211-dbus.bats +index 295bb71b2789..61c543a56005 100644 +--- a/test/system/211-dbus.bats ++++ b/test/system/211-dbus.bats +@@ -23,9 +23,11 @@ setup() { + bats_require_minimum_version 1.7.0 + _setup_environment + cleanup_containers ++ pushd "$HOME" || return 1 + } + + teardown() { ++ popd || return 1 + cleanup_containers + } + +diff --git a/test/system/220-environment-variables.bats b/test/system/220-environment-variables.bats +index 5b51d17dee55..c24e07d146ee 100644 +--- a/test/system/220-environment-variables.bats ++++ b/test/system/220-environment-variables.bats +@@ -23,9 +23,11 @@ setup() { + bats_require_minimum_version 1.7.0 + _setup_environment + cleanup_containers ++ pushd "$HOME" || return 1 + } + + teardown() { ++ popd || return 1 + cleanup_containers + } + +-- +2.43.0 + diff --git a/toolbox-test-system-new.patch b/toolbox-test-system-new.patch new file mode 100644 index 0000000..9800b15 --- /dev/null +++ b/toolbox-test-system-new.patch @@ -0,0 +1,894 @@ +From f51c4a4cd8ff1c51a68073a10eaddab8f16fdaf6 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Thu, 8 Feb 2024 22:18:33 +0100 +Subject: [PATCH 1/4] test/system: Ensure that the user is part of a group with + the same name + +https://github.com/containers/toolbox/pull/1447 +--- + test/system/206-user.bats | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/test/system/206-user.bats b/test/system/206-user.bats +index c295d8a61f39..cdd38c146024 100644 +--- a/test/system/206-user.bats ++++ b/test/system/206-user.bats +@@ -434,6 +434,7 @@ teardown() { + run --keep-empty-lines --separate-stderr "$TOOLBOX" run cat /etc/group + + assert_success ++ assert_line --regexp "^$USER:x:[[:digit:]]+:$USER$" + assert_line --regexp "^(sudo|wheel):x:[[:digit:]]+:$USER$" + assert [ ${#lines[@]} -gt 1 ] + +@@ -447,6 +448,7 @@ teardown() { + run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch cat /etc/group + + assert_success ++ assert_line --regexp "^$USER:x:[[:digit:]]+:$USER$" + assert_line --regexp "^wheel:x:[[:digit:]]+:$USER$" + assert [ ${#lines[@]} -gt 1 ] + +@@ -460,6 +462,7 @@ teardown() { + run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 cat /etc/group + + assert_success ++ assert_line --regexp "^$USER:x:[[:digit:]]+:$USER$" + assert_line --regexp "^wheel:x:[[:digit:]]+:$USER$" + assert [ ${#lines[@]} -gt 1 ] + +@@ -473,6 +476,7 @@ teardown() { + run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 cat /etc/group + + assert_success ++ assert_line --regexp "^$USER:x:[[:digit:]]+:$USER$" + assert_line --regexp "^wheel:x:[[:digit:]]+:$USER$" + assert [ ${#lines[@]} -gt 1 ] + +@@ -486,6 +490,7 @@ teardown() { + run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 cat /etc/group + + assert_success ++ assert_line --regexp "^$USER:x:[[:digit:]]+:$USER$" + assert_line --regexp "^sudo:x:[[:digit:]]+:$USER$" + assert [ ${#lines[@]} -gt 1 ] + +@@ -499,6 +504,7 @@ teardown() { + run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 cat /etc/group + + assert_success ++ assert_line --regexp "^$USER:x:[[:digit:]]+:$USER$" + assert_line --regexp "^sudo:x:[[:digit:]]+:$USER$" + assert [ ${#lines[@]} -gt 1 ] + +@@ -512,6 +518,7 @@ teardown() { + run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 20.04 cat /etc/group + + assert_success ++ assert_line --regexp "^$USER:x:[[:digit:]]+:$USER$" + assert_line --regexp "^sudo:x:[[:digit:]]+:$USER$" + assert [ ${#lines[@]} -gt 1 ] + +-- +2.43.0 + + +From b2d64fad1a23a07919efdb70de9247645e44f973 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Thu, 8 Feb 2024 22:51:43 +0100 +Subject: [PATCH 2/4] test/system: Ensure that process started by 'podman exec' + has all groups +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Commit 15173f8c25c81244 exposed a bug in crun(1) [1] where the process +started directly by 'podman exec --user ...' inside the Toolbx container +would not have the supplementary groups attached to the user by the +entry point. + +This could be observed by differences in id(1): + ⬢$ id + uid=1000(user) gid=1000(user) groups=1000(user) + ⬢$ id user + uid=1000(user) gid=1000(user) groups=1000(user),10(wheel) + +... and could be worked around by starting a new session with sudo(8). + +[1] crun commit 9effaebb429a1aed + https://github.com/containers/crun/commit/9effaebb429a1aed + https://github.com/containers/crun/issues/644 + https://github.com/containers/podman/issues/9986 + +https://github.com/containers/toolbox/issues/608 +--- + test/system/206-user.bats | 231 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 231 insertions(+) + +diff --git a/test/system/206-user.bats b/test/system/206-user.bats +index cdd38c146024..2df7862f259e 100644 +--- a/test/system/206-user.bats ++++ b/test/system/206-user.bats +@@ -525,3 +525,234 @@ teardown() { + # shellcheck disable=SC2154 + assert [ ${#stderr_lines[@]} -eq 0 ] + } ++ ++@test "user: id(1) for $USER inside the default container" { ++ create_default_container ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run id ++ ++ assert_success ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ local output_id="${lines[0]}" ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run id "$USER" ++ ++ assert_success ++ assert_line --index 0 "$output_id" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: id(1) for $USER inside Arch Linux" { ++ create_distro_container arch latest arch-toolbox-latest ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch id ++ ++ assert_success ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ local output_id="${lines[0]}" ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch id "$USER" ++ ++ assert_success ++ assert_line --index 0 "$output_id" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: id(1) for $USER inside Fedora 34" { ++ create_distro_container fedora 34 fedora-toolbox-34 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 id ++ ++ assert_success ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ local output_id="${lines[0]}" ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 id "$USER" ++ ++ assert_success ++ assert_line --index 0 "$output_id" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: id(1) for $USER inside RHEL 8.7" { ++ create_distro_container rhel 8.7 rhel-toolbox-8.7 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 id ++ ++ assert_success ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ local output_id="${lines[0]}" ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 id "$USER" ++ ++ assert_success ++ assert_line --index 0 "$output_id" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: id(1) for $USER inside Ubuntu 16.04" { ++ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 id ++ ++ assert_success ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ local output_id="${lines[0]}" ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 id "$USER" ++ ++ assert_success ++ assert_line --index 0 "$output_id" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: id(1) for $USER inside Ubuntu 18.04" { ++ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 id ++ ++ assert_success ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ local output_id="${lines[0]}" ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 id "$USER" ++ ++ assert_success ++ assert_line --index 0 "$output_id" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "user: id(1) for $USER inside Ubuntu 20.04" { ++ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 20.04 id ++ ++ assert_success ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ local output_id="${lines[0]}" ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++ ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 20.04 id "$USER" ++ ++ assert_success ++ assert_line --index 0 "$output_id" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ # shellcheck disable=SC2154 ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} +-- +2.43.0 + + +From da2555d04f9ff677b3f2033ff36390f75c3a509d Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Thu, 18 Jan 2024 19:53:02 +0100 +Subject: [PATCH 3/4] test/system: Group by higher-level objective, not + distribution + +Fallout from 51ffd2793d882ffab45ace44c03edfdaeb3f138c + +https://github.com/containers/toolbox/pull/1436 +--- + test/system/220-environment-variables.bats | 152 ++++++++++----------- + 1 file changed, 76 insertions(+), 76 deletions(-) + +diff --git a/test/system/220-environment-variables.bats b/test/system/220-environment-variables.bats +index 0e1356654468..dd74b1dc5142 100644 +--- a/test/system/220-environment-variables.bats ++++ b/test/system/220-environment-variables.bats +@@ -1,6 +1,6 @@ + # shellcheck shell=bats + # +-# Copyright © 2023 Red Hat, Inc. ++# Copyright © 2023 – 2024 Red Hat, Inc. + # + # Licensed under the Apache License, Version 2.0 (the "License"); + # you may not use this file except in compliance with the License. +@@ -57,25 +57,24 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTSIZE inside the default container" { +- skip "https://pagure.io/setup/pull-request/48" +- +- create_default_container ++@test "environment variables: HISTFILESIZE inside Arch Linux" { ++ create_distro_container arch latest arch-toolbox-latest + +- if [ "$HISTSIZE" = "" ]; then ++ # shellcheck disable=SC2031 ++ if [ "$HISTFILESIZE" = "" ]; then + # shellcheck disable=SC2030 +- HISTSIZE=1001 ++ HISTFILESIZE=1001 + else +- ((HISTSIZE++)) ++ ((HISTFILESIZE++)) + fi + +- export HISTSIZE ++ export HISTFILESIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run bash -c 'echo "$HISTSIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch bash -c 'echo "$HISTFILESIZE"' + + assert_success +- assert_line --index 0 "$HISTSIZE" ++ assert_line --index 0 "$HISTFILESIZE" + + if check_bats_version 1.10.0; then + assert [ ${#lines[@]} -eq 1 ] +@@ -87,8 +86,8 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTFILESIZE inside Arch Linux" { +- create_distro_container arch latest arch-toolbox-latest ++@test "environment variables: HISTFILESIZE inside Fedora 34" { ++ create_distro_container fedora 34 fedora-toolbox-34 + + # shellcheck disable=SC2031 + if [ "$HISTFILESIZE" = "" ]; then +@@ -101,7 +100,7 @@ teardown() { + export HISTFILESIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch bash -c 'echo "$HISTFILESIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 bash -c 'echo "$HISTFILESIZE"' + + assert_success + assert_line --index 0 "$HISTFILESIZE" +@@ -116,24 +115,24 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTSIZE inside Arch Linux" { +- create_distro_container arch latest arch-toolbox-latest ++@test "environment variables: HISTFILESIZE inside RHEL 8.7" { ++ create_distro_container rhel 8.7 rhel-toolbox-8.7 + + # shellcheck disable=SC2031 +- if [ "$HISTSIZE" = "" ]; then ++ if [ "$HISTFILESIZE" = "" ]; then + # shellcheck disable=SC2030 +- HISTSIZE=1001 ++ HISTFILESIZE=1001 + else +- ((HISTSIZE++)) ++ ((HISTFILESIZE++)) + fi + +- export HISTSIZE ++ export HISTFILESIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch bash -c 'echo "$HISTSIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 bash -c 'echo "$HISTFILESIZE"' + + assert_success +- assert_line --index 0 "$HISTSIZE" ++ assert_line --index 0 "$HISTFILESIZE" + + if check_bats_version 1.10.0; then + assert [ ${#lines[@]} -eq 1 ] +@@ -145,8 +144,8 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTFILESIZE inside Fedora 34" { +- create_distro_container fedora 34 fedora-toolbox-34 ++@test "environment variables: HISTFILESIZE inside Ubuntu 16.04" { ++ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 + + # shellcheck disable=SC2031 + if [ "$HISTFILESIZE" = "" ]; then +@@ -159,7 +158,8 @@ teardown() { + export HISTFILESIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 bash -c 'echo "$HISTFILESIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 \ ++ bash -c 'echo "$HISTFILESIZE"' + + assert_success + assert_line --index 0 "$HISTFILESIZE" +@@ -174,26 +174,25 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTSIZE inside Fedora 34" { +- skip "https://pagure.io/setup/pull-request/48" +- +- create_distro_container fedora 34 fedora-toolbox-34 ++@test "environment variables: HISTFILESIZE inside Ubuntu 18.04" { ++ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 + + # shellcheck disable=SC2031 +- if [ "$HISTSIZE" = "" ]; then ++ if [ "$HISTFILESIZE" = "" ]; then + # shellcheck disable=SC2030 +- HISTSIZE=1001 ++ HISTFILESIZE=1001 + else +- ((HISTSIZE++)) ++ ((HISTFILESIZE++)) + fi + +- export HISTSIZE ++ export HISTFILESIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 bash -c 'echo "$HISTSIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 \ ++ bash -c 'echo "$HISTFILESIZE"' + + assert_success +- assert_line --index 0 "$HISTSIZE" ++ assert_line --index 0 "$HISTFILESIZE" + + if check_bats_version 1.10.0; then + assert [ ${#lines[@]} -eq 1 ] +@@ -205,12 +204,11 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTFILESIZE inside RHEL 8.7" { +- create_distro_container rhel 8.7 rhel-toolbox-8.7 ++@test "environment variables: HISTFILESIZE inside Ubuntu 20.04" { ++ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 + + # shellcheck disable=SC2031 + if [ "$HISTFILESIZE" = "" ]; then +- # shellcheck disable=SC2030 + HISTFILESIZE=1001 + else + ((HISTFILESIZE++)) +@@ -219,7 +217,8 @@ teardown() { + export HISTFILESIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 bash -c 'echo "$HISTFILESIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 20.04 \ ++ bash -c 'echo "$HISTFILESIZE"' + + assert_success + assert_line --index 0 "$HISTFILESIZE" +@@ -234,12 +233,11 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTSIZE inside RHEL 8.7" { ++@test "environment variables: HISTSIZE inside the default container" { + skip "https://pagure.io/setup/pull-request/48" + +- create_distro_container rhel 8.7 rhel-toolbox-8.7 ++ create_default_container + +- # shellcheck disable=SC2031 + if [ "$HISTSIZE" = "" ]; then + # shellcheck disable=SC2030 + HISTSIZE=1001 +@@ -250,7 +248,7 @@ teardown() { + export HISTSIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 bash -c 'echo "$HISTSIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run bash -c 'echo "$HISTSIZE"' + + assert_success + assert_line --index 0 "$HISTSIZE" +@@ -265,25 +263,24 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTFILESIZE inside Ubuntu 16.04" { +- create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 ++@test "environment variables: HISTSIZE inside Arch Linux" { ++ create_distro_container arch latest arch-toolbox-latest + + # shellcheck disable=SC2031 +- if [ "$HISTFILESIZE" = "" ]; then ++ if [ "$HISTSIZE" = "" ]; then + # shellcheck disable=SC2030 +- HISTFILESIZE=1001 ++ HISTSIZE=1001 + else +- ((HISTFILESIZE++)) ++ ((HISTSIZE++)) + fi + +- export HISTFILESIZE ++ export HISTSIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 \ +- bash -c 'echo "$HISTFILESIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch bash -c 'echo "$HISTSIZE"' + + assert_success +- assert_line --index 0 "$HISTFILESIZE" ++ assert_line --index 0 "$HISTSIZE" + + if check_bats_version 1.10.0; then + assert [ ${#lines[@]} -eq 1 ] +@@ -295,8 +292,10 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTSIZE inside Ubuntu 16.04" { +- create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 ++@test "environment variables: HISTSIZE inside Fedora 34" { ++ skip "https://pagure.io/setup/pull-request/48" ++ ++ create_distro_container fedora 34 fedora-toolbox-34 + + # shellcheck disable=SC2031 + if [ "$HISTSIZE" = "" ]; then +@@ -309,7 +308,7 @@ teardown() { + export HISTSIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 bash -c 'echo "$HISTSIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 bash -c 'echo "$HISTSIZE"' + + assert_success + assert_line --index 0 "$HISTSIZE" +@@ -324,25 +323,26 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTFILESIZE inside Ubuntu 18.04" { +- create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 ++@test "environment variables: HISTSIZE inside RHEL 8.7" { ++ skip "https://pagure.io/setup/pull-request/48" ++ ++ create_distro_container rhel 8.7 rhel-toolbox-8.7 + + # shellcheck disable=SC2031 +- if [ "$HISTFILESIZE" = "" ]; then ++ if [ "$HISTSIZE" = "" ]; then + # shellcheck disable=SC2030 +- HISTFILESIZE=1001 ++ HISTSIZE=1001 + else +- ((HISTFILESIZE++)) ++ ((HISTSIZE++)) + fi + +- export HISTFILESIZE ++ export HISTSIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 \ +- bash -c 'echo "$HISTFILESIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 bash -c 'echo "$HISTSIZE"' + + assert_success +- assert_line --index 0 "$HISTFILESIZE" ++ assert_line --index 0 "$HISTSIZE" + + if check_bats_version 1.10.0; then + assert [ ${#lines[@]} -eq 1 ] +@@ -354,8 +354,8 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTSIZE inside Ubuntu 18.04" { +- create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 ++@test "environment variables: HISTSIZE inside Ubuntu 16.04" { ++ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 + + # shellcheck disable=SC2031 + if [ "$HISTSIZE" = "" ]; then +@@ -368,7 +368,7 @@ teardown() { + export HISTSIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 bash -c 'echo "$HISTSIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 bash -c 'echo "$HISTSIZE"' + + assert_success + assert_line --index 0 "$HISTSIZE" +@@ -383,24 +383,24 @@ teardown() { + assert [ ${#stderr_lines[@]} -eq 0 ] + } + +-@test "environment variables: HISTFILESIZE inside Ubuntu 20.04" { +- create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 ++@test "environment variables: HISTSIZE inside Ubuntu 18.04" { ++ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 + + # shellcheck disable=SC2031 +- if [ "$HISTFILESIZE" = "" ]; then +- HISTFILESIZE=1001 ++ if [ "$HISTSIZE" = "" ]; then ++ # shellcheck disable=SC2030 ++ HISTSIZE=1001 + else +- ((HISTFILESIZE++)) ++ ((HISTSIZE++)) + fi + +- export HISTFILESIZE ++ export HISTSIZE + + # shellcheck disable=SC2016 +- run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 20.04 \ +- bash -c 'echo "$HISTFILESIZE"' ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 bash -c 'echo "$HISTSIZE"' + + assert_success +- assert_line --index 0 "$HISTFILESIZE" ++ assert_line --index 0 "$HISTSIZE" + + if check_bats_version 1.10.0; then + assert [ ${#lines[@]} -eq 1 ] +-- +2.43.0 + + +From ee2c92299d5488bab4e54cb04d9a120e0b9ed405 Mon Sep 17 00:00:00 2001 +From: Debarshi Ray +Date: Thu, 18 Jan 2024 20:17:50 +0100 +Subject: [PATCH 4/4] test/system: Test that the HOSTNAME environment variable + is set + +Bash automatically sets the HOSTNAME environment variable to the name of +the current host [1] as returned by gethostname(2), which is the same as +hostname(1). + +However, on Fedora, from Fedora 33 onwards, /etc/profile sets the +HOSTNAME environment variable to 'hostnamectl --transient' [2], and, +from Fedora 35 onwards, it has a fallback to hostname(1) [3]. These two +approaches return different values when used inside a Toolbx container. +The former picks up the hostname of the host operating system, while the +fallback gets the name that was set when creating the container with +'podman create --hostname toolbox ...'. + +Hence, the value of HOSTNAME inside a Toolbx container for Fedora +depends on whether the corresponding version of the fedora-toolbox image +contained hostnamectl(1) or not. + +[1] https://www.gnu.org/software/bash/manual/html_node/Bash-Variables.html + +[2] setup commit eb9cc4dce89be24f + https://pagure.io/setup/c/eb9cc4dce89be24f + https://bugzilla.redhat.com/show_bug.cgi?id=1745245 + +[3] setup commit ddd74b5d971a734c + https://pagure.io/setup/c/ddd74b5d971a734c + https://pagure.io/setup/pull-request/28 + https://bugzilla.redhat.com/show_bug.cgi?id=1938223 + +https://github.com/containers/toolbox/issues/558 +--- + test/system/220-environment-variables.bats | 126 +++++++++++++++++++++ + 1 file changed, 126 insertions(+) + +diff --git a/test/system/220-environment-variables.bats b/test/system/220-environment-variables.bats +index dd74b1dc5142..5b51d17dee55 100644 +--- a/test/system/220-environment-variables.bats ++++ b/test/system/220-environment-variables.bats +@@ -439,3 +439,129 @@ teardown() { + # shellcheck disable=SC2154 + assert [ ${#stderr_lines[@]} -eq 0 ] + } ++ ++@test "environment variables: HOSTNAME inside the default container" { ++ create_default_container ++ ++ # shellcheck disable=SC2016 ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run bash -c 'echo "$HOSTNAME"' ++ ++ assert_success ++ assert_line --index 0 --regexp "^(toolbox|$HOSTNAME)$" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "environment variables: HOSTNAME inside Arch Linux" { ++ create_distro_container arch latest arch-toolbox-latest ++ ++ # shellcheck disable=SC2016 ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro arch bash -c 'echo "$HOSTNAME"' ++ ++ assert_success ++ assert_line --index 0 "toolbox" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "environment variables: HOSTNAME inside Fedora 34" { ++ create_distro_container fedora 34 fedora-toolbox-34 ++ ++ # shellcheck disable=SC2016 ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro fedora --release 34 bash -c 'echo "$HOSTNAME"' ++ ++ assert_success ++ assert_line --index 0 "$HOSTNAME" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "environment variables: HOSTNAME inside RHEL 8.7" { ++ create_distro_container rhel 8.7 rhel-toolbox-8.7 ++ ++ # shellcheck disable=SC2016 ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro rhel --release 8.7 bash -c 'echo "$HOSTNAME"' ++ ++ assert_success ++ assert_line --index 0 "toolbox" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "environment variables: HOSTNAME inside Ubuntu 16.04" { ++ create_distro_container ubuntu 16.04 ubuntu-toolbox-16.04 ++ ++ # shellcheck disable=SC2016 ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 16.04 bash -c 'echo "$HOSTNAME"' ++ ++ assert_success ++ assert_line --index 0 "toolbox" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "environment variables: HOSTNAME inside Ubuntu 18.04" { ++ create_distro_container ubuntu 18.04 ubuntu-toolbox-18.04 ++ ++ # shellcheck disable=SC2016 ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 18.04 bash -c 'echo "$HOSTNAME"' ++ ++ assert_success ++ assert_line --index 0 "toolbox" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} ++ ++@test "environment variables: HOSTNAME inside Ubuntu 20.04" { ++ create_distro_container ubuntu 20.04 ubuntu-toolbox-20.04 ++ ++ # shellcheck disable=SC2016 ++ run --keep-empty-lines --separate-stderr "$TOOLBOX" run --distro ubuntu --release 20.04 bash -c 'echo "$HOSTNAME"' ++ ++ assert_success ++ assert_line --index 0 "toolbox" ++ ++ if check_bats_version 1.10.0; then ++ assert [ ${#lines[@]} -eq 1 ] ++ else ++ assert [ ${#lines[@]} -eq 2 ] ++ fi ++ ++ assert [ ${#stderr_lines[@]} -eq 0 ] ++} +-- +2.43.0 + diff --git a/toolbox.spec b/toolbox.spec index 739497a..c8ac033 100644 --- a/toolbox.spec +++ b/toolbox.spec @@ -17,7 +17,7 @@ Version: 0.0.99.5 %endif %endif -Release: 2%{?dist} +Release: 3%{?dist} Summary: Tool for interactive command line environments on Linux License: ASL 2.0 @@ -28,7 +28,8 @@ Source0: https://github.com/containers/%{name}/releases/download/%{version Source1: %{name}.conf # Upstream -Patch0: toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch +Patch0: toolbox-test-system-new.patch +Patch1: toolbox-test-system-Unbreak-Podman-s-downstream-Fedora-CI.patch # Fedora specific Patch100: toolbox-Make-the-build-flags-match-Fedora-s-gobuild.patch @@ -186,6 +187,7 @@ The %{name}-tests package contains system tests for %{name}. %setup -q %patch0 -p1 +%patch1 -p1 %if 0%{?fedora} %ifnarch ppc64 @@ -270,6 +272,10 @@ install -m0644 %{SOURCE1} %{buildroot}%{_sysconfdir}/containers/%{name}.conf %changelog +* Tue Feb 27 2024 Debarshi Ray - 0.0.99.5-3 +- Unbreak Podman's downstream Fedora CI (part 2) +- Backport some new upstream tests + * Tue Feb 13 2024 Debarshi Ray - 0.0.99.5-2 - Unbreak Podman's downstream Fedora CI