Skip to content

Commit 529b3a7

Browse files
rix0rrrrix0rrr
authored
chore: fix Docker tests on SE Linux (#36284)
On SE Linux, apparently we are mounting volumes with `z,delegated` while on other machines we are just using the string `delegated`. Our tests are all written to expect the string `delegated`, which means they fail when run on an SE Linux machine. Update the tests to mirror the real behavior exactly. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 1d2f473 commit 529b3a7

File tree

1 file changed

+43
-17
lines changed

1 file changed

+43
-17
lines changed

‎packages/aws-cdk-lib/core/test/staging.test.ts‎

Lines changed: 43 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
import { execSync } from 'child_process';
1+
import { spawnSync, execSync } from 'child_process';
22
import * as os from 'os';
33
import * as path from 'path';
44
import { testDeprecated } from '@aws-cdk/cdk-build-tools';
@@ -33,6 +33,7 @@ const ARCHIVE_TARBALL_TEST_HASH = '3e948ff54a277d6001e2452fdbc4a9ef61f916ff662ba
3333

3434
const userInfo = os.userInfo();
3535
const USER_ARG = `-u ${userInfo.uid}:${userInfo.gid}`;
36+
const delegated = isSeLinux() ? 'z,delegated' : 'delegated';
3637

3738
describe('staging', () => {
3839
beforeAll(() => {
@@ -311,7 +312,7 @@ describe('staging', () => {
311312
const assembly = app.synth();
312313
expect(
313314
readDockerStubInput()).toEqual(
314-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
315+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input alpine DOCKER_STUB_SUCCESS`,
315316
);
316317
expect(fs.readdirSync(assembly.directory)).toEqual([
317318
'asset.b1e32e86b3523f2fa512eb99180ee2975a50a4439e63e8badd153f2a68d61aa4',
@@ -390,7 +391,7 @@ describe('staging', () => {
390391
// We're testing that docker was run exactly once even though there are two bundling assets.
391392
expect(
392393
readDockerStubInputConcat()).toEqual(
393-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
394+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input alpine DOCKER_STUB_SUCCESS`,
394395
);
395396

396397
expect(fs.readdirSync(assembly.directory)).toEqual([
@@ -435,7 +436,7 @@ describe('staging', () => {
435436
// and that the hash is based on the output
436437
expect(
437438
readDockerStubInputConcat()).toEqual(
438-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
439+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input alpine DOCKER_STUB_SUCCESS`,
439440
);
440441

441442
expect(fs.readdirSync(assembly.directory)).toEqual([
@@ -483,8 +484,8 @@ describe('staging', () => {
483484
// operating on the same source asset.
484485
expect(
485486
readDockerStubInputConcat()).toEqual(
486-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS\n` +
487-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated --env UNIQUE_ENV_VAR=SOMEVALUE -w /asset-input alpine DOCKER_STUB_SUCCESS`,
487+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input alpine DOCKER_STUB_SUCCESS\n` +
488+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} --env UNIQUE_ENV_VAR=SOMEVALUE -w /asset-input alpine DOCKER_STUB_SUCCESS`,
488489
);
489490

490491
expect(fs.readdirSync(assembly.directory)).toEqual([
@@ -532,7 +533,7 @@ describe('staging', () => {
532533
// We're testing that docker was run once, only for the first Asset, since the only difference is the token.
533534
expect(
534535
readDockerStubInputConcat()).toEqual(
535-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated --env PIP_INDEX_URL=https://aws:MY_SECRET_TOKEN@your-code-repo.d.codeartifact.us-west-2.amazonaws.com/pypi/python/simple/ -w /asset-input alpine DOCKER_STUB_SUCCESS`,
536+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} --env PIP_INDEX_URL=https://aws:MY_SECRET_TOKEN@your-code-repo.d.codeartifact.us-west-2.amazonaws.com/pypi/python/simple/ -w /asset-input alpine DOCKER_STUB_SUCCESS`,
536537
);
537538

538539
expect(fs.readdirSync(assembly.directory)).toEqual([
@@ -663,7 +664,7 @@ describe('staging', () => {
663664

664665
expect(
665666
readDockerStubInputConcat()).toEqual(
666-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
667+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input alpine DOCKER_STUB_SUCCESS`,
667668
);
668669

669670
expect(appAssembly.directory).toEqual(app2Assembly.directory);
@@ -692,7 +693,7 @@ describe('staging', () => {
692693
},
693694
});
694695
throw new Error('We expected the above command to fail');
695-
} catch (e) {
696+
} catch (e: any) {
696697
// We expect the command to be terminated with a signal, which sometimes shows
697698
// as 'signal' is set to SIGTERM, and on some Linuxes as exitCode = 128 + 15 = 143
698699
if (e.signal === 'SIGTERM' || e.status === 143) {
@@ -763,7 +764,7 @@ describe('staging', () => {
763764

764765
expect(
765766
readDockerStubInputConcat()).toEqual(
766-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated --env PIP_EXTRA_INDEX_URL=https://aws:MY_SECRET_TOKEN@your-code-repo.d.codeartifact.us-west-2.amazonaws.com/pypi/python/simple/ -w /asset-input alpine DOCKER_STUB_SUCCESS`,
767+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} --env PIP_EXTRA_INDEX_URL=https://aws:MY_SECRET_TOKEN@your-code-repo.d.codeartifact.us-west-2.amazonaws.com/pypi/python/simple/ -w /asset-input alpine DOCKER_STUB_SUCCESS`,
767768
);
768769

769770
expect(appAssembly.directory).toEqual(app2Assembly.directory);
@@ -793,7 +794,7 @@ describe('staging', () => {
793794

794795
expect(
795796
readDockerStubInput()).toEqual(
796-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS_NO_OUTPUT`,
797+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input alpine DOCKER_STUB_SUCCESS_NO_OUTPUT`,
797798
);
798799
});
799800

@@ -816,7 +817,7 @@ describe('staging', () => {
816817
// THEN
817818
expect(
818819
readDockerStubInput()).toEqual(
819-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
820+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input alpine DOCKER_STUB_SUCCESS`,
820821
);
821822
expect(asset.assetHash).toEqual('33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f');
822823
});
@@ -841,7 +842,7 @@ describe('staging', () => {
841842
// THEN
842843
expect(
843844
readDockerStubInput()).toEqual(
844-
`run --rm --security-opt no-new-privileges ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
845+
`run --rm --security-opt no-new-privileges ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input alpine DOCKER_STUB_SUCCESS`,
845846
);
846847
expect(asset.assetHash).toEqual('33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f');
847848
});
@@ -866,7 +867,7 @@ describe('staging', () => {
866867
// THEN
867868
expect(
868869
readDockerStubInput()).toEqual(
869-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input --entrypoint DOCKER_STUB_SUCCESS alpine DOCKER_STUB_SUCCESS`,
870+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input --entrypoint DOCKER_STUB_SUCCESS alpine DOCKER_STUB_SUCCESS`,
870871
);
871872
expect(asset.assetHash).toEqual('33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f');
872873
});
@@ -984,7 +985,7 @@ describe('staging', () => {
984985
})).toThrow(/Failed to bundle asset stack\/Asset/);
985986
expect(
986987
readDockerStubInput()).toEqual(
987-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input this-is-an-invalid-docker-image DOCKER_STUB_FAIL`,
988+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input this-is-an-invalid-docker-image DOCKER_STUB_FAIL`,
988989
);
989990
});
990991

@@ -1317,7 +1318,7 @@ describe('staging', () => {
13171318

13181319
expect(
13191320
readDockerStubInput()).toEqual(
1320-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
1321+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input alpine DOCKER_STUB_SUCCESS`,
13211322
);
13221323
expect(asset.assetHash).toEqual('33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f'); // hash of MyStack/Asset
13231324
});
@@ -1341,7 +1342,7 @@ describe('staging', () => {
13411342

13421343
expect(
13431344
readDockerStubInput()).toEqual(
1344-
`run --rm ${USER_ARG} -v /input:/asset-input:delegated -v /output:/asset-output:delegated -w /asset-input alpine DOCKER_STUB_SUCCESS`,
1345+
`run --rm ${USER_ARG} -v /input:/asset-input:${delegated} -v /output:/asset-output:${delegated} -w /asset-input alpine DOCKER_STUB_SUCCESS`,
13451346
);
13461347
expect(asset.assetHash).toEqual('33cbf2cae5432438e0f046bc45ba8c3cef7b6afcf47b59d1c183775c1918fb1f'); // hash of MyStack/Asset
13471348
});
@@ -1744,3 +1745,28 @@ function readDockerStubInput(file?: string) {
17441745
function readDockerStubInputConcat(file?: string) {
17451746
return readAndCleanDockerStubInput(file ?? STUB_INPUT_CONCAT_FILE);
17461747
}
1748+
1749+
function isSeLinux(): boolean {
1750+
if (process.platform != 'linux') {
1751+
return false;
1752+
}
1753+
const prog = 'selinuxenabled';
1754+
const proc = spawnSync(prog, [], {
1755+
stdio: [ // show selinux status output
1756+
'pipe', // get value of stdio
1757+
process.stderr, // redirect stdout to stderr
1758+
'inherit', // inherit stderr
1759+
],
1760+
});
1761+
if (proc.error) {
1762+
// selinuxenabled not a valid command, therefore not enabled
1763+
return false;
1764+
}
1765+
if (proc.status == 0) {
1766+
// selinux enabled
1767+
return true;
1768+
} else {
1769+
// selinux not enabled
1770+
return false;
1771+
}
1772+
}

0 commit comments

Comments
 (0)