From aa8466f688f18bf704eb68c5ccb1963c76afb247 Mon Sep 17 00:00:00 2001 From: Paul Bellamy Date: Tue, 21 Jul 2015 11:30:21 +0100 Subject: [PATCH] [proxy] Mount weavewait readonly so it can't be tampered with --- proxy/create_container_interceptor.go | 2 +- test/610_proxy_wait_for_weave_test.sh | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/proxy/create_container_interceptor.go b/proxy/create_container_interceptor.go index 574b5c01..ee5c43ed 100644 --- a/proxy/create_container_interceptor.go +++ b/proxy/create_container_interceptor.go @@ -53,7 +53,7 @@ func (i *createContainerInterceptor) InterceptRequest(r *http.Request) error { if container.HostConfig == nil { container.HostConfig = &docker.HostConfig{} } - container.HostConfig.VolumesFrom = append(container.HostConfig.VolumesFrom, "weaveproxy") + container.HostConfig.VolumesFrom = append(container.HostConfig.VolumesFrom, "weaveproxy:ro") if container.Config == nil { container.Config = &docker.Config{} } diff --git a/test/610_proxy_wait_for_weave_test.sh b/test/610_proxy_wait_for_weave_test.sh index 204f86cc..ddc63b3d 100755 --- a/test/610_proxy_wait_for_weave_test.sh +++ b/test/610_proxy_wait_for_weave_test.sh @@ -25,4 +25,7 @@ assert "entrypoint c2" "$(entrypoint $COMMITTED_IMAGE)" docker_on $HOST1 run -dit --name c3 $SMALL_IMAGE /bin/sh assert_raises "proxy docker_on $HOST1 exec c3 true" +# Check we can't modify weavewait +assert_raises "proxy docker_on $HOST1 run -e 'WEAVE_CIDR=10.2.1.2/24' $BASE_IMAGE touch /w/w" 1 + end_suite