diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2021-04-06 17:04:50 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-04-06 17:04:50 +0200 |
| commit | 382b5b81d24870abe400d14296e4f5ef47c99d29 (patch) | |
| tree | 05d4173fd7095cf10df6ea7f89ab5202200daad8 /test | |
| parent | f143de9db6861cd8b8d6fc4e03f2826041307982 (diff) | |
| parent | 541252afa701850f6691933d575c5c24ed0b17c1 (diff) | |
| download | podman-382b5b81d24870abe400d14296e4f5ef47c99d29.tar.gz podman-382b5b81d24870abe400d14296e4f5ef47c99d29.tar.bz2 podman-382b5b81d24870abe400d14296e4f5ef47c99d29.zip | |
Merge pull request #9942 from mheon/fix_9919
Ensure that `--userns=keep-id` sets user in config
Diffstat (limited to 'test')
| -rw-r--r-- | test/e2e/exec_test.go | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/test/e2e/exec_test.go b/test/e2e/exec_test.go index df86eab15..e6f63a391 100644 --- a/test/e2e/exec_test.go +++ b/test/e2e/exec_test.go @@ -119,6 +119,19 @@ var _ = Describe("Podman exec", func() { Expect(session.ExitCode()).To(Equal(100)) }) + It("podman exec in keep-id container drops privileges", func() { + SkipIfNotRootless("This function is not enabled for rootful podman") + ctrName := "testctr1" + testCtr := podmanTest.Podman([]string{"run", "-d", "--name", ctrName, "--userns=keep-id", ALPINE, "top"}) + testCtr.WaitWithDefaultTimeout() + Expect(testCtr.ExitCode()).To(Equal(0)) + + session := podmanTest.Podman([]string{"exec", ctrName, "grep", "CapEff", "/proc/self/status"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + Expect(session.OutputToString()).To(ContainSubstring("0000000000000000")) + }) + It("podman exec --privileged", func() { session := podmanTest.Podman([]string{"run", "--privileged", "--rm", ALPINE, "sh", "-c", "grep ^CapBnd /proc/self/status | cut -f 2"}) session.WaitWithDefaultTimeout() @@ -143,7 +156,6 @@ var _ = Describe("Podman exec", func() { session.WaitWithDefaultTimeout() Expect(session.ExitCode()).To(Equal(0)) Expect(session.OutputToString()).To(ContainSubstring(bndPerms)) - }) It("podman exec --privileged", func() { |