diff options
| author | Daniel J Walsh <dwalsh@redhat.com> | 2021-05-01 05:50:31 -0400 |
|---|---|---|
| committer | Daniel J Walsh <dwalsh@redhat.com> | 2021-05-04 14:40:43 -0400 |
| commit | 4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec (patch) | |
| tree | e944a81bbdd86ab0e166923c2fde320311718de0 /test/e2e/run_test.go | |
| parent | 7f2c27d43fc5d109c156e6203bf4901853b3cc7a (diff) | |
| download | podman-4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec.tar.gz podman-4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec.tar.bz2 podman-4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec.zip | |
Add filepath glob support to --security-opt unmask
Want to allow users to specify --security-opt unmask=/proc/*.
This allows us to run podman within podman more securely, then
specifing umask=all, also gives the user more flexibilty.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'test/e2e/run_test.go')
| -rw-r--r-- | test/e2e/run_test.go | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go index 74bdfce2c..d8d7dab07 100644 --- a/test/e2e/run_test.go +++ b/test/e2e/run_test.go @@ -299,9 +299,17 @@ var _ = Describe("Podman run", func() { session = podmanTest.Podman([]string{"run", "-d", "--name=maskCtr5", "--security-opt", "systempaths=unconfined", ALPINE, "grep", "/proc", "/proc/self/mounts"}) session.WaitWithDefaultTimeout() Expect(session.ExitCode()).To(Equal(0)) - stdoutLines := session.OutputToStringArray() - Expect(stdoutLines).Should(HaveLen(1)) + Expect(session.OutputToStringArray()).Should(HaveLen(1)) + + session = podmanTest.Podman([]string{"run", "-d", "--security-opt", "unmask=/proc/*", ALPINE, "grep", "/proc", "/proc/self/mounts"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + Expect(session.OutputToStringArray()).Should(HaveLen(1)) + session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/proc/a*", ALPINE, "ls", "/proc/acpi"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + Expect(session.OutputToString()).To(Not(BeEmpty())) }) It("podman run security-opt unmask on /sys/fs/cgroup", func() { |