summaryrefslogtreecommitdiff
path: root/test
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2021-05-01 05:50:31 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2021-05-04 14:40:43 -0400
commit4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec (patch)
treee944a81bbdd86ab0e166923c2fde320311718de0 /test
parent7f2c27d43fc5d109c156e6203bf4901853b3cc7a (diff)
downloadpodman-4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec.tar.gz
podman-4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec.tar.bz2
podman-4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec.zip
Add filepath glob support to --security-opt unmask
Want to allow users to specify --security-opt unmask=/proc/*. This allows us to run podman within podman more securely, then specifing umask=all, also gives the user more flexibilty. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'test')
-rw-r--r--test/e2e/run_test.go12
1 files changed, 10 insertions, 2 deletions
diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go
index 74bdfce2c..d8d7dab07 100644
--- a/test/e2e/run_test.go
+++ b/test/e2e/run_test.go
@@ -299,9 +299,17 @@ var _ = Describe("Podman run", func() {
session = podmanTest.Podman([]string{"run", "-d", "--name=maskCtr5", "--security-opt", "systempaths=unconfined", ALPINE, "grep", "/proc", "/proc/self/mounts"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
- stdoutLines := session.OutputToStringArray()
- Expect(stdoutLines).Should(HaveLen(1))
+ Expect(session.OutputToStringArray()).Should(HaveLen(1))
+
+ session = podmanTest.Podman([]string{"run", "-d", "--security-opt", "unmask=/proc/*", ALPINE, "grep", "/proc", "/proc/self/mounts"})
+ session.WaitWithDefaultTimeout()
+ Expect(session.ExitCode()).To(Equal(0))
+ Expect(session.OutputToStringArray()).Should(HaveLen(1))
+ session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/proc/a*", ALPINE, "ls", "/proc/acpi"})
+ session.WaitWithDefaultTimeout()
+ Expect(session.ExitCode()).To(Equal(0))
+ Expect(session.OutputToString()).To(Not(BeEmpty()))
})
It("podman run security-opt unmask on /sys/fs/cgroup", func() {