mirror of
https://github.com/projectatomic/atomic.git
synced 2026-02-06 21:45:24 +01:00
d81e7e651e
This addresses one of the two issues raised by bugzilla 1248038 where atomic is using shell=True on its subprocess calls which exposes a security concern. Two new functions were added to accomplish this. The first is a util.chk_call which is similar to util.subp but it uses the python function check call instead of Popen. The second function is atomic.sub_env_strings. Previously, there was env variable substitution occuring with cmd_env and the subprocess call. That was one upside of the shell=True usage. Now, prior to calling util.chk_call, we pass the intended command to sub_env_strings and use cmd_env to perform the variable substitution. We will address part 2 of the security concerns, which is the handling of LABELS as strings, in a different PR.
54 lines
1.6 KiB
Bash
Executable File
54 lines
1.6 KiB
Bash
Executable File
#!/bin/bash -x
|
|
set -euo pipefail
|
|
IFS=$'\n\t'
|
|
|
|
#
|
|
# 'atomic run --display' and 'atomic install --display' integration tests
|
|
# AUTHOR: Sally O'Malley <somalley at redhat dot com>
|
|
#
|
|
ATOMIC=${ATOMIC:="/usr/bin/atomic"}
|
|
DOCKER=${DOCKER:="/usr/bin/docker"}
|
|
TNAME="test_display"
|
|
|
|
teardown () {
|
|
${DOCKER} rm TEST3 TEST4 2> /dev/null
|
|
}
|
|
trap teardown EXIT
|
|
|
|
# Remove the --user UID:GID
|
|
OUTPUT=`${ATOMIC} run --display -n TEST1 atomic-test-1 | sed 's/ --user [0-9]*:[0-9]* / /' | xargs`
|
|
OUTPUT2="/usr/bin/docker run -t -v /var/log/TEST1:/var/log -v /var/lib/TEST1:/var/lib --name TEST1 atomic-test-1 echo I am the run label."
|
|
if [[ ${OUTPUT} != ${OUTPUT2} ]]; then
|
|
echo "Failed ${TNAME} 1"
|
|
exit 1
|
|
fi
|
|
|
|
OUTPUT=`${ATOMIC} install --display -n TEST2 atomic-test-1 | xargs`
|
|
OUTPUT2="/usr/bin/docker run -v /etc/TEST2:/etc -v /var/log/TEST2:/var/log -v /var/lib/TEST2:/var/lib --name TEST2 atomic-test-1 echo I am the install label."
|
|
if [[ ${OUTPUT} != ${OUTPUT2} ]]; then
|
|
echo "Failed ${TNAME} 2"
|
|
exit 1
|
|
fi
|
|
|
|
${ATOMIC} install -n TEST3 atomic-test-1
|
|
OUTPUT=`${DOCKER} logs TEST3 | tr -d '\r'`
|
|
if [[ ${OUTPUT} != "I am the install label." ]]; then
|
|
echo "Failed ${TNAME} 3"
|
|
exit 1
|
|
fi
|
|
|
|
${ATOMIC} run -n TEST4 atomic-test-1
|
|
OUTPUT=`${DOCKER} logs TEST4 | tr -d '\r'`
|
|
if [[ ${OUTPUT} != "I am the run label." ]]; then
|
|
echo "Failed ${TNAME} 4"
|
|
exit 1
|
|
fi
|
|
|
|
# The centos image does not have an INSTALL label, so `atomic install` should be
|
|
# a noop.
|
|
OUTPUT=`${ATOMIC} install --display -n TEST5 centos | xargs`
|
|
if [[ -n ${OUTPUT} ]]; then
|
|
echo "Failed ${TNAME} 5"
|
|
exit 1
|
|
fi
|