diff options
| author | Valentin Rothberg <rothberg@redhat.com> | 2019-05-23 13:24:51 +0200 |
|---|---|---|
| committer | Valentin Rothberg <rothberg@redhat.com> | 2019-05-24 11:09:25 +0200 |
| commit | bcbf5c48940e543b39385bc1e137ca7b5d5ad9dd (patch) | |
| tree | 7c45e591ca83814f8a7c1c55bebcd2c802d01e6b | |
| parent | fe928c6b429ff25b9cc14bcf45db976db223ee34 (diff) | |
| download | podman-bcbf5c48940e543b39385bc1e137ca7b5d5ad9dd.tar.gz podman-bcbf5c48940e543b39385bc1e137ca7b5d5ad9dd.tar.bz2 podman-bcbf5c48940e543b39385bc1e137ca7b5d5ad9dd.zip | |
baseline tests: apparmor with --privileged
https://github.com/containers/libpod/issues/3112 has revealed a
regression in apparmor when running privileged containers where the
profile must not be set or loaded. Add a simple test to avoid potential
future regressions.
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
| -rwxr-xr-x | test/test_podman_baseline.sh | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/test/test_podman_baseline.sh b/test/test_podman_baseline.sh index 5c24229bb..92bc8e20c 100755 --- a/test/test_podman_baseline.sh +++ b/test/test_podman_baseline.sh @@ -504,6 +504,16 @@ EOF echo "failed" fi + #Expected to pass (as root with --privileged). + #Note that the profile should not be loaded letting the mount succeed. + podman run --privileged docker.io/library/alpine:latest sh -c "mkdir tmp2; mount --bind tmp tmp2" + rc=$? + echo -n "root with specified AppArmor profile but --privileged: " + if [ $rc == 0 ]; then + echo "passed" + else + echo "failed" + fi #Expected to fail (as rootless) sudo -u "#1000" podman run --security-opt apparmor=$aaProfile docker.io/library/alpine:latest echo hello rc=$? |