summaryrefslogtreecommitdiff
path: root/test/e2e
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2022-02-02 10:03:13 +0100
committerGiuseppe Scrivano <gscrivan@redhat.com>2022-02-02 10:03:18 +0100
commitc4dfd004ad7efedb48ffa239e65bc9cdcfa31ed2 (patch)
treed94923d7f6582852a48863db39517bde824979ae /test/e2e
parent6f491e21aa291ac0e9cbda5f41e7dc8b87fe160c (diff)
downloadpodman-c4dfd004ad7efedb48ffa239e65bc9cdcfa31ed2.tar.gz
podman-c4dfd004ad7efedb48ffa239e65bc9cdcfa31ed2.tar.bz2
podman-c4dfd004ad7efedb48ffa239e65bc9cdcfa31ed2.zip
libpod: enforce noexec,nosuid,nodev for /dev/shm
these mount flags are already used for the /dev/shm mount on the host, but they are not set for the bind mount itself. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'test/e2e')
-rw-r--r--test/e2e/run_test.go10
1 files changed, 10 insertions, 0 deletions
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index 62a454e29..91a2eddad 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -1926,4 +1926,14 @@ WORKDIR /madethis`, BB)
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring("i686"))
})
+
+ It("podman run /dev/shm has nosuid,noexec,nodev", func() {
+ session := podmanTest.Podman([]string{"run", ALPINE, "grep", "/dev/shm", "/proc/self/mountinfo"})
+ session.WaitWithDefaultTimeout()
+ Expect(session).Should(Exit(0))
+ output := session.OutputToString()
+ Expect(output).To(ContainSubstring("nosuid"))
+ Expect(output).To(ContainSubstring("noexec"))
+ Expect(output).To(ContainSubstring("nodev"))
+ })
})