aboutsummaryrefslogtreecommitdiff
path: root/test
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2020-02-27 14:19:07 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2020-03-02 16:37:32 -0500
commitb163640c61dcb10953949a1ee28599d8a19fd046 (patch)
treee7b56307cc2778c6cab81f658515ea145d990979 /test
parent47c4ea39196cedac87e7a4e4c1ead54ed9d7ed50 (diff)
downloadpodman-b163640c61dcb10953949a1ee28599d8a19fd046.tar.gz
podman-b163640c61dcb10953949a1ee28599d8a19fd046.tar.bz2
podman-b163640c61dcb10953949a1ee28599d8a19fd046.zip
Allow devs to set labels in container images for default capabilities.
This patch allows users to specify the list of capabilities required to run their container image. Setting a image/container label "io.containers.capabilities=setuid,setgid" tells podman that the contained image should work fine with just these two capabilties, instead of running with the default capabilities, podman will launch the container with just these capabilties. If the user or image specified capabilities that are not in the default set, the container will print an error message and will continue to run with the default capabilities. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'test')
-rw-r--r--test/e2e/run_security_labels.go152
1 files changed, 152 insertions, 0 deletions
diff --git a/test/e2e/run_security_labels.go b/test/e2e/run_security_labels.go
new file mode 100644
index 000000000..a04bdc739
--- /dev/null
+++ b/test/e2e/run_security_labels.go
@@ -0,0 +1,152 @@
+// +build !remoteclient
+
+package integration
+
+import (
+ "os"
+ "strings"
+
+ . "github.com/containers/libpod/test/utils"
+ . "github.com/onsi/ginkgo"
+ . "github.com/onsi/gomega"
+)
+
+var _ = Describe("Podman generate kube", func() {
+ var (
+ tempdir string
+ err error
+ podmanTest *PodmanTestIntegration
+ )
+
+ BeforeEach(func() {
+ tempdir, err = CreateTempDirInTempDir()
+ if err != nil {
+ os.Exit(1)
+ }
+ podmanTest = PodmanTestCreate(tempdir)
+ podmanTest.Setup()
+ podmanTest.SeedImages()
+
+ })
+
+ AfterEach(func() {
+ podmanTest.Cleanup()
+ f := CurrentGinkgoTestDescription()
+ processTestResult(f)
+ })
+
+ It("podman security labels", func() {
+ test1 := podmanTest.Podman([]string{"create", "--label", "io.containers.capabilities=setuid,setgid", "--name", "test1", "alpine", "echo", "test1"})
+ test1.WaitWithDefaultTimeout()
+ Expect(test1.ExitCode()).To(BeZero())
+
+ inspect := podmanTest.Podman([]string{"inspect", "test1"})
+ inspect.WaitWithDefaultTimeout()
+ Expect(inspect.ExitCode()).To(Equal(0))
+
+ ctr := inspect.InspectContainerToJSON()
+ caps := strings.Join(ctr[0].EffectiveCaps, ",")
+ Expect(caps).To(Equal("CAP_SETUID,CAP_SETGID"))
+ })
+
+ It("podman bad security labels", func() {
+ test1 := podmanTest.Podman([]string{"create", "--label", "io.containers.capabilities=sys_admin", "--name", "test1", "alpine", "echo", "test1"})
+ test1.WaitWithDefaultTimeout()
+ Expect(test1.ExitCode()).To(BeZero())
+
+ inspect := podmanTest.Podman([]string{"inspect", "test1"})
+ inspect.WaitWithDefaultTimeout()
+ Expect(inspect.ExitCode()).To(Equal(0))
+
+ ctr := inspect.InspectContainerToJSON()
+ caps := strings.Join(ctr[0].EffectiveCaps, ",")
+ Expect(caps).To(Not(Equal("CAP_SYS_ADMIN")))
+ })
+
+ It("podman --cap-add sys_admin security labels", func() {
+ test1 := podmanTest.Podman([]string{"create", "--cap-add", "SYS_ADMIN", "--label", "io.containers.capabilities=sys_admin", "--name", "test1", "alpine", "echo", "test1"})
+ test1.WaitWithDefaultTimeout()
+ Expect(test1.ExitCode()).To(BeZero())
+
+ inspect := podmanTest.Podman([]string{"inspect", "test1"})
+ inspect.WaitWithDefaultTimeout()
+ Expect(inspect.ExitCode()).To(Equal(0))
+
+ ctr := inspect.InspectContainerToJSON()
+ caps := strings.Join(ctr[0].EffectiveCaps, ",")
+ Expect(caps).To(Equal("CAP_SYS_ADMIN"))
+ })
+
+ It("podman --cap-drop all sys_admin security labels", func() {
+ test1 := podmanTest.Podman([]string{"create", "--cap-drop", "all", "--label", "io.containers.capabilities=sys_admin", "--name", "test1", "alpine", "echo", "test1"})
+ test1.WaitWithDefaultTimeout()
+ Expect(test1.ExitCode()).To(BeZero())
+
+ inspect := podmanTest.Podman([]string{"inspect", "test1"})
+ inspect.WaitWithDefaultTimeout()
+ Expect(inspect.ExitCode()).To(Equal(0))
+
+ ctr := inspect.InspectContainerToJSON()
+ caps := strings.Join(ctr[0].EffectiveCaps, ",")
+ Expect(caps).To(Equal(""))
+ })
+
+ It("podman security labels from image", func() {
+ test1 := podmanTest.Podman([]string{"create", "--name", "test1", "alpine", "echo", "test1"})
+ test1.WaitWithDefaultTimeout()
+ Expect(test1.ExitCode()).To(BeZero())
+
+ commit := podmanTest.Podman([]string{"commit", "-c", "label=io.containers.capabilities=sys_chroot,net_raw", "test1", "image1"})
+ commit.WaitWithDefaultTimeout()
+ Expect(commit.ExitCode()).To(BeZero())
+
+ image1 := podmanTest.Podman([]string{"create", "--name", "test2", "image1", "echo", "test1"})
+ image1.WaitWithDefaultTimeout()
+ Expect(image1.ExitCode()).To(BeZero())
+
+ inspect := podmanTest.Podman([]string{"inspect", "test2"})
+ inspect.WaitWithDefaultTimeout()
+ Expect(inspect.ExitCode()).To(Equal(0))
+
+ ctr := inspect.InspectContainerToJSON()
+ caps := strings.Join(ctr[0].EffectiveCaps, ",")
+ Expect(caps).To(Equal("CAP_SYS_CHROOT,CAP_NET_RAW"))
+
+ })
+
+ It("podman --privileged security labels", func() {
+ pull := podmanTest.Podman([]string{"create", "--privileged", "--label", "io.containers.capabilities=setuid,setgid", "--name", "test1", "alpine", "echo", "test"})
+ pull.WaitWithDefaultTimeout()
+ Expect(pull.ExitCode()).To(BeZero())
+
+ inspect := podmanTest.Podman([]string{"inspect", "test1"})
+ inspect.WaitWithDefaultTimeout()
+ Expect(inspect.ExitCode()).To(Equal(0))
+
+ ctr := inspect.InspectContainerToJSON()
+ caps := strings.Join(ctr[0].EffectiveCaps, ",")
+ Expect(caps).To(Not(Equal("CAP_SETUID,CAP_SETGID")))
+ })
+
+ It("podman container runlabel (podman --version)", func() {
+ PodmanDockerfile := `
+FROM alpine:latest
+LABEL io.containers.capabilities=chown,mknod`
+
+ image := "podman-caps:podman"
+ podmanTest.BuildImage(PodmanDockerfile, image, "false")
+
+ test1 := podmanTest.Podman([]string{"create", "--name", "test1", image, "echo", "test1"})
+ test1.WaitWithDefaultTimeout()
+ Expect(test1.ExitCode()).To(BeZero())
+
+ inspect := podmanTest.Podman([]string{"inspect", "test1"})
+ inspect.WaitWithDefaultTimeout()
+ Expect(inspect.ExitCode()).To(Equal(0))
+
+ ctr := inspect.InspectContainerToJSON()
+ caps := strings.Join(ctr[0].EffectiveCaps, ",")
+ Expect(caps).To(Equal("CAP_CHOWN,CAP_MKNOD"))
+ })
+
+})