diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2021-01-04 14:49:41 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-01-04 14:49:41 +0100 |
| commit | 8e4d19da1547985c5f3aa01eae82db70644d15f1 (patch) | |
| tree | f72af44835e00ceb2c99c1f1c505a6bdbadc818f /test/e2e/run_privileged_test.go | |
| parent | 23f25b8261cf2c0d83f8ce5b8251951a11a7e2c4 (diff) | |
| parent | bd35792b0c1372aacd344e324f04529f16cf0711 (diff) | |
| download | podman-8e4d19da1547985c5f3aa01eae82db70644d15f1.tar.gz podman-8e4d19da1547985c5f3aa01eae82db70644d15f1.tar.bz2 podman-8e4d19da1547985c5f3aa01eae82db70644d15f1.zip | |
Merge pull request #8863 from mgoltzsche/fix_seccomp_when_privileged
Disable seccomp by default when creating a privileged container.
Diffstat (limited to 'test/e2e/run_privileged_test.go')
| -rw-r--r-- | test/e2e/run_privileged_test.go | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/test/e2e/run_privileged_test.go b/test/e2e/run_privileged_test.go index cadda7224..48f9ea76e 100644 --- a/test/e2e/run_privileged_test.go +++ b/test/e2e/run_privileged_test.go @@ -110,6 +110,15 @@ var _ = Describe("Podman privileged container tests", func() { Expect("0000000000000000").To(Equal(capEff[1])) }) + It("podman privileged should disable seccomp by default", func() { + hostSeccomp := SystemExec("grep", []string{"-Ei", "^Seccomp:\\s+0$", "/proc/self/status"}) + Expect(hostSeccomp.ExitCode()).To(Equal(0)) + + session := podmanTest.Podman([]string{"run", "--privileged", ALPINE, "grep", "-Ei", "^Seccomp:\\s+0$", "/proc/self/status"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + }) + It("podman non-privileged should have very few devices", func() { session := podmanTest.Podman([]string{"run", "-t", "busybox", "ls", "-l", "/dev"}) session.WaitWithDefaultTimeout() |