diff options
| author | Matthew Heon <mheon@redhat.com> | 2020-05-19 15:43:04 -0400 |
|---|---|---|
| committer | Matthew Heon <mheon@redhat.com> | 2020-05-20 16:48:20 -0400 |
| commit | cc65430145aee98ffefc4b9a505793e470134e94 (patch) | |
| tree | 2391d8b7a17679bfd7eccda1ef5023682d53be87 /test/system/160-volumes.bats | |
| parent | 0f8ad039235137d086b9fea33bb74b362e625cdd (diff) | |
| download | podman-cc65430145aee98ffefc4b9a505793e470134e94.tar.gz podman-cc65430145aee98ffefc4b9a505793e470134e94.tar.bz2 podman-cc65430145aee98ffefc4b9a505793e470134e94.zip | |
Turn off 'noexec' option by default for named volumes
We previously enforced this for security reasons, but as Dan has
explained on several occasions, it's not very valuable there
(it's trivially easy to bypass) and it does seriously annoy folks
trying to use named volumes. Flip the default from 'on' to 'off'.
Signed-off-by: Matthew Heon <mheon@redhat.com>
Diffstat (limited to 'test/system/160-volumes.bats')
| -rw-r--r-- | test/system/160-volumes.bats | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/test/system/160-volumes.bats b/test/system/160-volumes.bats index 5d65a950f..3233e6f04 100644 --- a/test/system/160-volumes.bats +++ b/test/system/160-volumes.bats @@ -115,7 +115,8 @@ echo "got here -$rand-" EOF chmod 755 $mountpoint/myscript - # By default, volumes are mounted noexec. This should fail. + # By default, volumes are mounted exec, but we have manually added the + # noexec option. This should fail. # ARGH. Unfortunately, runc (used for cgroups v1) produces a different error local expect_rc=126 local expect_msg='.* OCI runtime permission denied.*' @@ -125,12 +126,12 @@ EOF expect_msg='.* exec user process caused.*permission denied' fi - run_podman ${expect_rc} run --rm --volume $myvolume:/vol:z $IMAGE /vol/myscript + run_podman ${expect_rc} run --rm --volume $myvolume:/vol:noexec,z $IMAGE /vol/myscript is "$output" "$expect_msg" "run on volume, noexec" - # With exec, it should pass - run_podman run --rm -v $myvolume:/vol:z,exec $IMAGE /vol/myscript - is "$output" "got here -$rand-" "script in volume is runnable with exec" + # With the default, it should pass + run_podman run --rm -v $myvolume:/vol:z $IMAGE /vol/myscript + is "$output" "got here -$rand-" "script in volume is runnable with default (exec)" # Clean up run_podman volume rm $myvolume |