diff options
author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2022-04-22 08:40:34 -0400 |
---|---|---|
committer | GitHub <noreply@github.com> | 2022-04-22 08:40:34 -0400 |
commit | 1bafde2d226067257d430c367ec2c53208d3eeeb (patch) | |
tree | 9d5fb9b77482e7c1284eef11c18a83927dc91da8 /test/system/030-run.bats | |
parent | 22500d797aba09eada894a69ad88f2699a560d02 (diff) | |
parent | 80c0fceb24b70a85f3f2ca8be29f4a131c0881d4 (diff) | |
download | podman-1bafde2d226067257d430c367ec2c53208d3eeeb.tar.gz podman-1bafde2d226067257d430c367ec2c53208d3eeeb.tar.bz2 podman-1bafde2d226067257d430c367ec2c53208d3eeeb.zip |
Merge pull request #13881 from rhatdan/userns
Add support for --userns=nomap
Diffstat (limited to 'test/system/030-run.bats')
-rw-r--r-- | test/system/030-run.bats | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/test/system/030-run.bats b/test/system/030-run.bats index 526003c2d..087f74690 100644 --- a/test/system/030-run.bats +++ b/test/system/030-run.bats @@ -272,9 +272,11 @@ echo $rand | 0 | $rand # symptom only manifests on a fedora container image -- we have no # reproducer on alpine. Checking directory ownership is good enough. @test "podman run : user namespace preserved root ownership" { + keep="--userns=keep-id" + is_rootless || keep="" for priv in "" "--privileged"; do for user in "--user=0" "--user=100"; do - for keepid in "" "--userns=keep-id"; do + for keepid in "" ${keep}; do opts="$priv $user $keepid" for dir in /etc /usr;do @@ -289,6 +291,7 @@ echo $rand | 0 | $rand # #6829 : add username to /etc/passwd inside container if --userns=keep-id @test "podman run : add username to /etc/passwd if --userns=keep-id" { + skip_if_not_rootless "--userns=keep-id only works in rootless mode" # Default: always run as root run_podman run --rm $IMAGE id -un is "$output" "root" "id -un on regular container" @@ -339,6 +342,7 @@ echo $rand | 0 | $rand # #6991 : /etc/passwd is modifiable @test "podman run : --userns=keep-id: passwd file is modifiable" { + skip_if_not_rootless "--userns=keep-id only works in rootless mode" run_podman run -d --userns=keep-id --cap-add=dac_override $IMAGE sh -c 'while ! test -e /tmp/stop; do sleep 0.1; done' cid="$output" @@ -827,6 +831,9 @@ EOF # CVE-2022-1227 : podman top joins container mount NS and uses nsenter from image @test "podman top does not use nsenter from image" { + keepid="--userns=keep-id" + is_rootless || keepid="" + tmpdir=$PODMAN_TMPDIR/build-test mkdir -p $tmpdir tmpbuilddir=$tmpdir/build @@ -841,7 +848,7 @@ EOF test_image="cve_2022_1227_test" run_podman build -t $test_image $tmpbuilddir - run_podman run -d --userns=keep-id $test_image top + run_podman run -d ${keepid} $test_image top ctr="$output" run_podman top $ctr huser,user run_podman rm -f -t0 $ctr |