Test tweaks

pkg/api/cached.go

@@ -75,6 +75,13 @@ func (c *Cached) Prepare(ctx context.Context) error {
 		return err
 	}
 
+	// Once we've prepared the cache make it read-only for
+	// everyone except the user running the daemon
+	err = os.Chmod(c.GetCachePath(), 0755)
+	if err != nil {
+		return fmt.Errorf("failed to change permissions of cache path %s: %v", c.GetCachePath(), err)
+	}
+
 	c.currentVersion = version
 
 	logger.Info(ctx, c.GetCachePath())
@@ -172,6 +179,10 @@ func (c *Cached) NodePublishVolume(ctx context.Context, req *csi.NodePublishVolu
 	if err != nil {
 		return nil, fmt.Errorf("failed to create target path directory %s: %v", targetPath, err)
 	}
+	err = os.Chmod(targetPath, 0777)
+	if err != nil {
+		return nil, fmt.Errorf("failed to change permissions of target path directory %s: %v", targetPath, err)
+	}
 
 	mountArgs := []string{
 		"-t",
@@ -222,7 +233,7 @@ func (s *Cached) NodeUnpublishVolume(ctx context.Context, req *csi.NodeUnpublish
 	// Unmount the overlay
 	err := execCommand("umount", targetPath)
 	if err != nil {
-		return nil, fmt.Errorf("failed to unmount overlay: %s", err)
+		return nil, fmt.Errorf("failed to unmount overlay at %s: %v", targetPath, err)
 	}
 
 	// Clean up upper and work directories from the overlay

test/cached_csi_test.go

@@ -81,9 +81,7 @@ func TestCachedCSIDriverMountsCache(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	targetDir = path.Join(targetDir, "dl_cache")
-
-	verifyDir(t, targetDir, -1, map[string]expectedFile{
+	verifyDir(t, path.Join(targetDir, "dl_cache"), -1, map[string]expectedFile{
 		fmt.Sprintf("objects/%v/pack/a/1", aHash): {content: "pack/a/1 v1"},
 		fmt.Sprintf("objects/%v/pack/a/2", aHash): {content: "pack/a/2 v1"},
 		fmt.Sprintf("objects/%v/pack/b/1", bHash): {content: "pack/b/1 v1"},
@@ -98,9 +96,15 @@ func TestCachedCSIDriverMountsCache(t *testing.T) {
 	require.Equal(t, formatFileMode(os.FileMode(0755)), formatFileMode(fileInfo.Mode()&os.ModePerm))
 
 	// files inside cache dir should also *not* be writable -- it's managed by the CSI and must remain pristine
-	cacheFileInfo, err := os.Stat(path.Join(targetDir, fmt.Sprintf("objects/%v/pack/a/1", aHash)))
+	cacheFileInfo, err := os.Stat(path.Join(targetDir, "dl_cache", fmt.Sprintf("objects/%v/pack/a/1", aHash)))
 	require.NoError(t, err)
 	require.Equal(t, formatFileMode(os.FileMode(0755)), formatFileMode(cacheFileInfo.Mode()&os.ModePerm))
+
+	_, err = cached.NodeUnpublishVolume(tc.Context(), &csi.NodeUnpublishVolumeRequest{
+		VolumeId:   "foobar",
+		TargetPath: targetDir,
+	})
+	require.NoError(t, err)
 }
 
 func TestCachedCSIDriverMountsCacheAtSuffix(t *testing.T) {
@@ -124,6 +128,7 @@ func TestCachedCSIDriverMountsCacheAtSuffix(t *testing.T) {
 	require.NoError(t, err, "cached.Prepare must succeed")
 
 	targetDir := path.Join(tmpDir, "vol-target")
+
 	stagingDir := path.Join(tmpDir, "vol-staging-target")
 	_, err = cached.NodePublishVolume(tc.Context(), &csi.NodePublishVolumeRequest{
 		VolumeId:          "foobar",
@@ -157,6 +162,13 @@ func TestCachedCSIDriverMountsCacheAtSuffix(t *testing.T) {
 	cacheFileInfo, err = os.Stat(path.Join(targetDir, fmt.Sprintf("dl_cache/objects/%v/pack/a/1", aHash)))
 	require.NoError(t, err)
 	require.Equal(t, formatFileMode(os.FileMode(0755)), formatFileMode(cacheFileInfo.Mode()))
+	require.Equal(t, targetDir, path.Join(tmpDir, "vol-target"))
+
+	_, err = cached.NodeUnpublishVolume(tc.Context(), &csi.NodeUnpublishVolumeRequest{
+		VolumeId:   "foobar",
+		TargetPath: targetDir,
+	})
+	require.NoError(t, err)
 }
 
 func TestCachedCSIDriverProbeFailsUntilPrepared(t *testing.T) {