[YARN-7353] Docker permitted volumes don't properly check for directories

• Type: Sub-task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.9.0, 3.0.0
• Component/s: yarn
• Labels: Docker
• Assignee: Eric Badger
• Reporter: Eric Badger
• Created: 18/Oct/17 15:36
• Updated: 02/May/18 22:34
• Resolved: 20/Oct/17 16:29

Description

docker-util.c:check_mount_permitted()

    // directory check
    permitted_mount_len = strlen(permitted_mounts[i]);
    if (permitted_mount_len > 0
        && permitted_mounts[i][permitted_mount_len - 1] == '/') {
      if (strncmp(normalized_path, permitted_mounts[i], permitted_mount_len) == 0) {
        ret = 1;
        break;
      }
    }

This code will treat "/home/" as a directory, but not "/home"

[  FAILED  ] 3 tests, listed below:
[  FAILED  ] TestDockerUtil.test_check_mount_permitted
[  FAILED  ] TestDockerUtil.test_normalize_mounts
[  FAILED  ] TestDockerUtil.test_add_rw_mounts

Additionally, YARN-6623 introduced new test failures in the C++ container-executor test "cetest"

Issue Links

• breaks: YARN-7412 test_docker_util.test_check_mount_permitted() is failing
• incorporates: YARN-7344 Unit test for white list mount fails on CentOS 7
• is duplicated by: YARN-7344 Unit test for white list mount fails on CentOS 7