summaryrefslogtreecommitdiff
path: root/test/system/410-selinux.bats
diff options
context:
space:
mode:
authorEd Santiago <santiago@redhat.com>2021-09-28 07:13:51 -0600
committerEd Santiago <santiago@redhat.com>2021-09-30 13:32:51 -0600
commitbf94ebf423931f6cd848126372fe558c8b956dcc (patch)
treedc585c17a1a41a80bd64407042e3a108d06b508e /test/system/410-selinux.bats
parentba72b17d28ff897d6721a227c615fcd511ca2e7a (diff)
downloadpodman-bf94ebf423931f6cd848126372fe558c8b956dcc.tar.gz
podman-bf94ebf423931f6cd848126372fe558c8b956dcc.tar.bz2
podman-bf94ebf423931f6cd848126372fe558c8b956dcc.zip
System tests: tighten 'is' operator
Fix day-one sloppiness: when I first wrote this framework it compared strings using 'expr', not '=', to be more forgiving of extra cruft in output. This was a bad decision. It means that warnings or additional text are ignored: is "all is ok, NOT!" "all is ok" <-- this would pass Solution: tighten up the 'is' check. Use '=' (direct compare) first. If it fails, look for wild cards ('*') or character classes ('[') in the expect string. If so, and only then, use 'expr'. And, thanks to a clever suggestion from Luap99, include '(using expr)' in the error message when we do so; this could make it easier for a developer to understand a string mismatch. This change exposes a lot of instances in which we weren't doing proper comparisons. Fix those. Thankfully, there weren't as many as I'd feared. Also, and completely unrelated, add '-T' flag to bats helper, for showing timing results. (I will open this as a separate PR if requested. I too find it offensive to jumble together unrelated commits.) Signed-off-by: Ed Santiago <santiago@redhat.com>
Diffstat (limited to 'test/system/410-selinux.bats')
-rw-r--r--test/system/410-selinux.bats19
1 files changed, 12 insertions, 7 deletions
diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats
index 0f7c35c65..7f7f23000 100644
--- a/test/system/410-selinux.bats
+++ b/test/system/410-selinux.bats
@@ -29,7 +29,7 @@ function check_label() {
if [ -n "$2" ]; then
# e.g. from the above example -> "s0:c45,c745"
range=$(cut -d: -f4,5 <<<"$context")
- is "$range" "$2" "SELinux range"
+ is "$range" "$2^@" "SELinux range"
fi
}
@@ -101,7 +101,7 @@ function check_label() {
--security-opt label=level:s0 \
$IMAGE sh -c 'while test ! -e /stop; do sleep 0.1; done'
run_podman inspect --format='{{ .HostConfig.SecurityOpt }}' myc
- is "$output" "\[label=type:spc_t,label=level:s0 seccomp=unconfined]" \
+ is "$output" "[label=type:spc_t,label=level:s0 seccomp=unconfined]" \
"'podman inspect' preserves all --security-opts"
run_podman exec myc touch /stop
@@ -117,6 +117,10 @@ function check_label() {
# must use a pid namespace and not join an existing one.
skip_if_rootless_cgroupsv1
+ if [[ $(podman_runtime) == "runc" ]]; then
+ skip "some sort of runc bug, not worth fixing (#11784)"
+ fi
+
run_podman run -d --name myctr $IMAGE top
run_podman exec myctr cat -v /proc/self/attr/current
context_c1="$output"
@@ -225,24 +229,25 @@ function check_label() {
run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current
run ls -dZ ${tmpdir}
- is "$output" ${LABEL} "No Relabel Correctly"
+ is "$output" "${LABEL} ${tmpdir}" "No Relabel Correctly"
run_podman run -v $tmpdir:/test:z --security-opt label=disable $IMAGE cat /proc/self/attr/current
run ls -dZ $tmpdir
- is "$output" ${RELABEL} "Privileged Relabel Correctly"
+ is "$output" "${RELABEL} $tmpdir" "Privileged Relabel Correctly"
run_podman run -v $tmpdir:/test:z --privileged $IMAGE cat /proc/self/attr/current
run ls -dZ $tmpdir
- is "$output" ${RELABEL} "Privileged Relabel Correctly"
+ is "$output" "${RELABEL} $tmpdir" "Privileged Relabel Correctly"
run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current
level=$(secon -l $output)
run ls -dZ $tmpdir
- is "$output" "system_u:object_r:container_file_t:$level" "Confined Relabel Correctly"
+ is "$output" "system_u:object_r:container_file_t:$level $tmpdir" \
+ "Confined Relabel Correctly"
run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current
run ls -dZ $tmpdir
- is "$output" ${RELABEL} "Shared Relabel Correctly"
+ is "$output" "${RELABEL} $tmpdir" "Shared Relabel Correctly"
}
# vim: filetype=sh