summaryrefslogtreecommitdiff
path: root/test
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2021-01-04 14:49:41 +0100
committerGitHub <noreply@github.com>2021-01-04 14:49:41 +0100
commit8e4d19da1547985c5f3aa01eae82db70644d15f1 (patch)
treef72af44835e00ceb2c99c1f1c505a6bdbadc818f /test
parent23f25b8261cf2c0d83f8ce5b8251951a11a7e2c4 (diff)
parentbd35792b0c1372aacd344e324f04529f16cf0711 (diff)
downloadpodman-8e4d19da1547985c5f3aa01eae82db70644d15f1.tar.gz
podman-8e4d19da1547985c5f3aa01eae82db70644d15f1.tar.bz2
podman-8e4d19da1547985c5f3aa01eae82db70644d15f1.zip
Merge pull request #8863 from mgoltzsche/fix_seccomp_when_privileged
Disable seccomp by default when creating a privileged container.
Diffstat (limited to 'test')
-rw-r--r--test/e2e/run_privileged_test.go9
1 files changed, 9 insertions, 0 deletions
diff --git a/test/e2e/run_privileged_test.go b/test/e2e/run_privileged_test.go
index cadda7224..48f9ea76e 100644
--- a/test/e2e/run_privileged_test.go
+++ b/test/e2e/run_privileged_test.go
@@ -110,6 +110,15 @@ var _ = Describe("Podman privileged container tests", func() {
Expect("0000000000000000").To(Equal(capEff[1]))
})
+ It("podman privileged should disable seccomp by default", func() {
+ hostSeccomp := SystemExec("grep", []string{"-Ei", "^Seccomp:\\s+0$", "/proc/self/status"})
+ Expect(hostSeccomp.ExitCode()).To(Equal(0))
+
+ session := podmanTest.Podman([]string{"run", "--privileged", ALPINE, "grep", "-Ei", "^Seccomp:\\s+0$", "/proc/self/status"})
+ session.WaitWithDefaultTimeout()
+ Expect(session.ExitCode()).To(Equal(0))
+ })
+
It("podman non-privileged should have very few devices", func() {
session := podmanTest.Podman([]string{"run", "-t", "busybox", "ls", "-l", "/dev"})
session.WaitWithDefaultTimeout()