summaryrefslogtreecommitdiff
path: root/test/e2e/exec_test.go
diff options
context:
space:
mode:
authorMatthew Heon <matthew.heon@pm.me>2021-04-05 15:49:35 -0400
committerMatthew Heon <mheon@redhat.com>2021-04-06 09:18:46 -0400
commit541252afa701850f6691933d575c5c24ed0b17c1 (patch)
tree4ae3773866ff9ee462c578c0efcbf413b61af3af /test/e2e/exec_test.go
parent3fae801a3714ac058c5d19edf7f2288c18e84195 (diff)
downloadpodman-541252afa701850f6691933d575c5c24ed0b17c1.tar.gz
podman-541252afa701850f6691933d575c5c24ed0b17c1.tar.bz2
podman-541252afa701850f6691933d575c5c24ed0b17c1.zip
Ensure that `--userns=keep-id` sets user in config
One of the side-effects of the `--userns=keep-id` command is switching the default user of the container to the UID of the user running Podman (though this can still be overridden by the `--user` flag). However, it did this by setting the UID and GID in the OCI spec, and not by informing Libpod of its intention to switch users via the `WithUser()` option. Because of this, a lot of the code that should have triggered when the container ran with a non-root user was not triggering. In the case of the issue that this fixed, the code to remove capabilities from non-root users was not triggering. Adjust the keep-id code to properly inform Libpod of our intention to use a non-root user to fix this. Also, fix an annoying race around short-running exec sessions where Podman would always print a warning that the exec session had already stopped. Fixes #9919 Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Diffstat (limited to 'test/e2e/exec_test.go')
-rw-r--r--test/e2e/exec_test.go14
1 files changed, 13 insertions, 1 deletions
diff --git a/test/e2e/exec_test.go b/test/e2e/exec_test.go
index df86eab15..e6f63a391 100644
--- a/test/e2e/exec_test.go
+++ b/test/e2e/exec_test.go
@@ -119,6 +119,19 @@ var _ = Describe("Podman exec", func() {
Expect(session.ExitCode()).To(Equal(100))
})
+ It("podman exec in keep-id container drops privileges", func() {
+ SkipIfNotRootless("This function is not enabled for rootful podman")
+ ctrName := "testctr1"
+ testCtr := podmanTest.Podman([]string{"run", "-d", "--name", ctrName, "--userns=keep-id", ALPINE, "top"})
+ testCtr.WaitWithDefaultTimeout()
+ Expect(testCtr.ExitCode()).To(Equal(0))
+
+ session := podmanTest.Podman([]string{"exec", ctrName, "grep", "CapEff", "/proc/self/status"})
+ session.WaitWithDefaultTimeout()
+ Expect(session.ExitCode()).To(Equal(0))
+ Expect(session.OutputToString()).To(ContainSubstring("0000000000000000"))
+ })
+
It("podman exec --privileged", func() {
session := podmanTest.Podman([]string{"run", "--privileged", "--rm", ALPINE, "sh", "-c", "grep ^CapBnd /proc/self/status | cut -f 2"})
session.WaitWithDefaultTimeout()
@@ -143,7 +156,6 @@ var _ = Describe("Podman exec", func() {
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(ContainSubstring(bndPerms))
-
})
It("podman exec --privileged", func() {