Merge pull request #10062 from mheon/bump_311

Bump to v3.1.1

15 files changed, 339 insertions, 4 deletions

diff --git a/test/apiv2/20-containers.at b/test/apiv2/20-containers.at
index 9030f0095..58b2dff0a 100644
--- a/test/apiv2/20-containers.at
+++ b/test/apiv2/20-containers.at
@@ -298,7 +298,7 @@ t POST containers/prune?filters='garb1age}' 500 \
 t POST libpod/containers/prune?filters='garb1age}' 500 \
     .cause="invalid character 'g' looking for beginning of value"
 
-## Prune containers with illformed label
+# Prune containers with illformed label
 t POST containers/prune?filters='{"label":["tes' 500 \
     .cause="unexpected end of JSON input"
 t POST libpod/containers/prune?filters='{"label":["tes' 500 \
@@ -306,6 +306,22 @@ t POST libpod/containers/prune?filters='{"label":["tes' 500 \
 
 t GET libpod/containers/json?filters='{"label":["testlabel"]}' 200 length=0
 
+# libpod api: do not use list filters for prune
+t POST libpod/containers/prune?filters='{"name":["anyname"]}' 500 \
+    .cause="name is an invalid filter"
+t POST libpod/containers/prune?filters='{"id":["anyid"]}' 500 \
+    .cause="id is an invalid filter"
+t POST libpod/containers/prune?filters='{"network":["anynetwork"]}' 500 \
+    .cause="network is an invalid filter"
+
+# compat api: do not use list filters for prune
+t POST containers/prune?filters='{"name":["anyname"]}' 500 \
+    .cause="name is an invalid filter"
+t POST containers/prune?filters='{"id":["anyid"]}' 500 \
+    .cause="id is an invalid filter"
+t POST containers/prune?filters='{"network":["anynetwork"]}' 500 \
+    .cause="network is an invalid filter"
+
 # Test CPU limit (NanoCPUs)
 t POST containers/create Image=$IMAGE HostConfig='{"NanoCpus":500000}' 201 \
   .Id~[0-9a-f]\\{64\\}
diff --git a/test/apiv2/25-containersMore.at b/test/apiv2/25-containersMore.at
index 39bfa2e32..0a049d869 100644
--- a/test/apiv2/25-containersMore.at
+++ b/test/apiv2/25-containersMore.at
@@ -38,7 +38,8 @@ t GET libpod/containers/foo/json 200 \
 
 # List processes of the container
 t GET libpod/containers/foo/top 200 \
-  length=2
+  length=2 \
+  .Processes[0][7]="top"
 
 # List processes of none such
 t GET libpod/containers/nonesuch/top 404
diff --git a/test/apiv2/30-volumes.at b/test/apiv2/30-volumes.at
index 18ff31100..623e691e3 100644
--- a/test/apiv2/30-volumes.at
+++ b/test/apiv2/30-volumes.at
@@ -123,4 +123,20 @@ t POST libpod/volumes/prune 200
 #After prune volumes, there should be no volume existing
 t GET libpod/volumes/json 200 length=0
 
+# libpod api: do not use list filters for prune
+t POST libpod/volumes/prune?filters='{"name":["anyname"]}' 500 \
+    .cause="\"name\" is an invalid volume filter"
+t POST libpod/volumes/prune?filters='{"driver":["anydriver"]}' 500 \
+    .cause="\"driver\" is an invalid volume filter"
+t POST libpod/volumes/prune?filters='{"scope":["anyscope"]}' 500 \
+    .cause="\"scope\" is an invalid volume filter"
+
+# compat api: do not use list filters for prune
+t POST volumes/prune?filters='{"name":["anyname"]}' 500 \
+    .cause="\"name\" is an invalid volume filter"
+t POST volumes/prune?filters='{"driver":["anydriver"]}' 500 \
+    .cause="\"driver\" is an invalid volume filter"
+t POST volumes/prune?filters='{"scope":["anyscope"]}' 500 \
+    .cause="\"scope\" is an invalid volume filter"
+
 # vim: filetype=sh
diff --git a/test/apiv2/rest_api/test_rest_v2_0_0.py b/test/apiv2/rest_api/test_rest_v2_0_0.py
index d7910f555..75e07ad3c 100644
--- a/test/apiv2/rest_api/test_rest_v2_0_0.py
+++ b/test/apiv2/rest_api/test_rest_v2_0_0.py
@@ -727,6 +727,11 @@ class TestApi(unittest.TestCase):
         start = json.loads(r.text)
         self.assertGreater(len(start["Errs"]), 0, r.text)
 
+    def test_df(self):
+        r = requests.get(_url("/system/df"))
+        self.assertEqual(r.status_code, 200, r.text)
+
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/test/e2e/build_test.go b/test/e2e/build_test.go
index 95ed23313..4f337116e 100644
--- a/test/e2e/build_test.go
+++ b/test/e2e/build_test.go
@@ -549,4 +549,21 @@ RUN echo hello`, ALPINE)
 		inspect.WaitWithDefaultTimeout()
 		Expect(inspect.OutputToString()).To(Equal("1970-01-01 00:00:00 +0000 UTC"))
 	})
+
+	It("podman build --log-rusage", func() {
+		targetPath, err := CreateTempDirInTempDir()
+		Expect(err).To(BeNil())
+
+		containerFile := filepath.Join(targetPath, "Containerfile")
+		content := `FROM scratch`
+
+		Expect(ioutil.WriteFile(containerFile, []byte(content), 0755)).To(BeNil())
+
+		session := podmanTest.Podman([]string{"build", "--log-rusage", "--pull-never", targetPath})
+		session.WaitWithDefaultTimeout()
+		Expect(session.ExitCode()).To(Equal(0))
+		Expect(session.OutputToString()).To(ContainSubstring("(system)"))
+		Expect(session.OutputToString()).To(ContainSubstring("(user)"))
+		Expect(session.OutputToString()).To(ContainSubstring("(elapsed)"))
+	})
 })
diff --git a/test/e2e/exec_test.go b/test/e2e/exec_test.go
index df86eab15..e6f63a391 100644
--- a/test/e2e/exec_test.go
+++ b/test/e2e/exec_test.go
@@ -119,6 +119,19 @@ var _ = Describe("Podman exec", func() {
 		Expect(session.ExitCode()).To(Equal(100))
 	})
 
+	It("podman exec in keep-id container drops privileges", func() {
+		SkipIfNotRootless("This function is not enabled for rootful podman")
+		ctrName := "testctr1"
+		testCtr := podmanTest.Podman([]string{"run", "-d", "--name", ctrName, "--userns=keep-id", ALPINE, "top"})
+		testCtr.WaitWithDefaultTimeout()
+		Expect(testCtr.ExitCode()).To(Equal(0))
+
+		session := podmanTest.Podman([]string{"exec", ctrName, "grep", "CapEff", "/proc/self/status"})
+		session.WaitWithDefaultTimeout()
+		Expect(session.ExitCode()).To(Equal(0))
+		Expect(session.OutputToString()).To(ContainSubstring("0000000000000000"))
+	})
+
 	It("podman exec --privileged", func() {
 		session := podmanTest.Podman([]string{"run", "--privileged", "--rm", ALPINE, "sh", "-c", "grep ^CapBnd /proc/self/status | cut -f 2"})
 		session.WaitWithDefaultTimeout()
@@ -143,7 +156,6 @@ var _ = Describe("Podman exec", func() {
 		session.WaitWithDefaultTimeout()
 		Expect(session.ExitCode()).To(Equal(0))
 		Expect(session.OutputToString()).To(ContainSubstring(bndPerms))
-
 	})
 
 	It("podman exec --privileged", func() {
diff --git a/test/e2e/play_kube_test.go b/test/e2e/play_kube_test.go
index a4c738f17..2a1ba86e5 100644
--- a/test/e2e/play_kube_test.go
+++ b/test/e2e/play_kube_test.go
@@ -1674,7 +1674,6 @@ MemoryReservation: {{ .HostConfig.MemoryReservation }}`})
 	})
 
 	It("podman play kube applies log driver to containers", func() {
-		Skip("need to verify images have correct packages for journald")
 		pod := getPod()
 		err := generateKubeYaml("pod", pod, kubeYaml)
 		Expect(err).To(BeNil())
diff --git a/test/e2e/save_test.go b/test/e2e/save_test.go
index 5ddd5efc8..42ee7440b 100644
--- a/test/e2e/save_test.go
+++ b/test/e2e/save_test.go
@@ -111,6 +111,24 @@ var _ = Describe("Podman save", func() {
 		Expect(save.ExitCode()).To(Equal(0))
 	})
 
+	It("podman save to directory with --compress but not use docker-dir and oci-dir", func() {
+		if rootless.IsRootless() && podmanTest.RemoteTest {
+			Skip("Requires a fix in containers image for chown/lchown")
+		}
+		outdir := filepath.Join(podmanTest.TempDir, "save")
+
+		save := podmanTest.Podman([]string{"save", "--compress", "--format", "docker-archive", "-o", outdir, ALPINE})
+		save.WaitWithDefaultTimeout()
+		// should not be 0
+		Expect(save.ExitCode()).ToNot(Equal(0))
+
+		save = podmanTest.Podman([]string{"save", "--compress", "--format", "oci-archive", "-o", outdir, ALPINE})
+		save.WaitWithDefaultTimeout()
+		// should not be 0
+		Expect(save.ExitCode()).ToNot(Equal(0))
+
+	})
+
 	It("podman save bad filename", func() {
 		outdir := filepath.Join(podmanTest.TempDir, "save:colon")
 
diff --git a/test/system/001-basic.bats b/test/system/001-basic.bats
index d276cfda1..f2e85ef6b 100644
--- a/test/system/001-basic.bats
+++ b/test/system/001-basic.bats
@@ -104,4 +104,17 @@ function setup() {
     is "$output" "you found me" "sample invocation of 'jq'"
 }
 
+@test "podman --log-level recognizes log levels" {
+    run_podman 1 --log-level=telepathic info
+    is "$output" 'Log Level "telepathic" is not supported.*'
+    run_podman --log-level=trace   info
+    run_podman --log-level=debug   info
+    run_podman --log-level=info    info
+    run_podman --log-level=warn    info
+    run_podman --log-level=warning info
+    run_podman --log-level=error   info
+    run_podman --log-level=fatal   info
+    run_podman --log-level=panic   info
+}
+
 # vim: filetype=sh
diff --git a/test/system/005-info.bats b/test/system/005-info.bats
index 7452c1901..ed341dd17 100644
--- a/test/system/005-info.bats
+++ b/test/system/005-info.bats
@@ -53,4 +53,34 @@ store.imageStore.number   | 1
 
 }
 
+# 2021-04-06 discussed in watercooler: RHEL must never use crun, even if
+# using cgroups v2.
+@test "podman info - RHEL8 must use runc" {
+    local osrelease=/etc/os-release
+    test -e $osrelease || skip "Not a RHEL system (no $osrelease)"
+
+    local osname=$(source $osrelease; echo $NAME)
+    if [[ $osname =~ Red.Hat || $osname =~ CentOS ]]; then
+        # Version can include minor; strip off first dot an all beyond it
+        local osver=$(source $osrelease; echo $VERSION_ID)
+        test ${osver%%.*} -le 8 || skip "$osname $osver > RHEL8"
+
+        # RHEL or CentOS 8.
+        # FIXME: what does 'CentOS 8' even mean? What is $VERSION_ID in CentOS?
+        run_podman info --format '{{.Host.OCIRuntime.Name}}'
+        is "$output" "runc" "$osname only supports OCI Runtime = runc"
+    else
+        skip "only applicable on RHEL, this is $osname"
+    fi
+}
+
+@test "podman info --storage-opt='' " {
+    skip_if_remote "--storage-opt flag is not supported for remote"
+    skip_if_rootless "storage opts are required for rootless running"
+    run_podman --storage-opt='' info
+    # Note this will not work in rootless mode, unless you specify
+    # storage-driver=vfs, until we have kernels that support rootless overlay
+    # mounts.
+    is "$output" ".*graphOptions: {}" "output includes graphOptions: {}"
+}
 # vim: filetype=sh
diff --git a/test/system/037-runlabel.bats b/test/system/037-runlabel.bats
new file mode 100644
index 000000000..8e18f40d3
--- /dev/null
+++ b/test/system/037-runlabel.bats
@@ -0,0 +1,32 @@
+#!/usr/bin/env bats
+
+load helpers
+
+@test "podman container runlabel test" {
+    skip_if_remote "container runlabel is not supported for remote"
+    tmpdir=$PODMAN_TMPDIR/runlabel-test
+    mkdir -p $tmpdir
+    containerfile=$tmpdir/Containerfile
+    rand1=$(random_string 30)
+    rand2=$(random_string 30)
+    rand3=$(random_string 30)
+    cat >$containerfile <<EOF
+FROM $IMAGE
+LABEL  INSTALL  /usr/bin/podman  run  -t  -i  --rm  \\\${OPT1}  --privileged  -v /:/host --net=host --ipc=host --pid=host -e HOST=/host -e NAME=\\\${NAME} -e IMAGE=\\\${IMAGE} -e CONFDIR=/etc/\\\${NAME} -e LOGDIR=/var/log/\\\${NAME} -e DATADIR=/var/lib/\\\${NAME} \\\${IMAGE} \\\${OPT2} /bin/install.sh \\\${OPT3}
+EOF
+
+    run_podman build -t runlabel_image $tmpdir
+
+    run_podman container runlabel --opt1=${rand1} --opt2=${rand2} --opt3=${rand3} --name test1 --display  install runlabel_image
+    is "$output"   "command: ${PODMAN} run -t -i --rm ${rand1} --privileged -v /:/host --net=host --ipc=host --pid=host -e HOST=/host -e NAME=test1 -e IMAGE=localhost/runlabel_image:latest -e CONFDIR=/etc/test1 -e LOGDIR=/var/log/test1 -e DATADIR=/var/lib/test1 localhost/runlabel_image:latest ${rand2} /bin/install.sh ${rand3}"   "generating runlabel install command"
+
+    run_podman container runlabel --opt3=${rand3} --display  install runlabel_image
+    is "$output"   "command: ${PODMAN} run -t -i --rm --privileged -v /:/host --net=host --ipc=host --pid=host -e HOST=/host -e NAME=runlabel_image -e IMAGE=localhost/runlabel_image:latest -e CONFDIR=/etc/runlabel_image -e LOGDIR=/var/log/runlabel_image -e DATADIR=/var/lib/runlabel_image localhost/runlabel_image:latest /bin/install.sh ${rand3}" "generating runlabel without name and --opt1, --opt2"
+
+    run_podman 125 container runlabel --opt1=${rand1} --opt2=${rand2} --opt3=${rand3} --name test1 --display  run runlabel_image
+    is "$output"   "Error: cannot find the value of label: run in image: runlabel_image"   "generating runlabel run command"
+
+    run_podman rmi -f runlabel_image
+}
+
+# vim: filetype=sh
diff --git a/test/system/070-build.bats b/test/system/070-build.bats
index e5b68a0d8..2e97c93e0 100644
--- a/test/system/070-build.bats
+++ b/test/system/070-build.bats
@@ -712,6 +712,46 @@ EOF
     run_podman rmi -f build_test
 }
 
+@test "podman build check_label" {
+    skip_if_no_selinux
+    tmpdir=$PODMAN_TMPDIR/build-test
+    mkdir -p $tmpdir
+    tmpbuilddir=$tmpdir/build
+    mkdir -p $tmpbuilddir
+    dockerfile=$tmpbuilddir/Dockerfile
+    cat >$dockerfile <<EOF
+FROM $IMAGE
+RUN cat /proc/self/attr/current
+EOF
+
+    run_podman build -t build_test --security-opt label=level:s0:c3,c4 --format=docker $tmpbuilddir
+    is "$output" ".*s0:c3,c4STEP 3: COMMIT" "label setting level"
+
+    run_podman rmi -f build_test
+}
+
+@test "podman build check_seccomp_ulimits" {
+    tmpdir=$PODMAN_TMPDIR/build-test
+    mkdir -p $tmpdir
+    tmpbuilddir=$tmpdir/build
+    mkdir -p $tmpbuilddir
+    dockerfile=$tmpbuilddir/Dockerfile
+    cat >$dockerfile <<EOF
+FROM $IMAGE
+RUN grep Seccomp: /proc/self/status |awk '{ print \$1\$2 }'
+RUN grep "Max open files" /proc/self/limits |awk '{ print \$4":"\$5 }'
+EOF
+
+    run_podman build --ulimit nofile=101:102 -t build_test $tmpbuilddir
+    is "$output" ".*Seccomp:2" "setting seccomp"
+    is "$output" ".*101:102" "setting ulimits"
+    run_podman rmi -f build_test
+
+    run_podman build -t build_test --security-opt seccomp=unconfined $tmpbuilddir
+    is "$output" ".*Seccomp:0" "setting seccomp"
+    run_podman rmi -f build_test
+}
+
 function teardown() {
     # A timeout or other error in 'build' can leave behind stale images
     # that podman can't even see and which will cascade into subsequent
diff --git a/test/system/270-socket-activation.bats b/test/system/270-socket-activation.bats
new file mode 100644
index 000000000..25206c6a7
--- /dev/null
+++ b/test/system/270-socket-activation.bats
@@ -0,0 +1,103 @@
+#!/usr/bin/env bats   -*- bats -*-
+#
+# Tests podman system service under systemd socket activation
+#
+
+load helpers
+
+SERVICE_NAME="podman_test_$(random_string)"
+
+SYSTEMCTL="systemctl"
+UNIT_DIR="/usr/lib/systemd/system"
+SERVICE_SOCK_ADDR="/run/podman/podman.sock"
+
+if is_rootless; then
+    UNIT_DIR="$HOME/.config/systemd/user"
+    mkdir -p $UNIT_DIR
+
+    SYSTEMCTL="$SYSTEMCTL --user"
+    if [ -z "$XDG_RUNTIME_DIR" ]; then
+        export XDG_RUNTIME_DIR=/run/user/$(id -u)
+    fi
+    SERVICE_SOCK_ADDR="$XDG_RUNTIME_DIR/podman/podman.sock"
+fi
+
+SERVICE_FILE="$UNIT_DIR/$SERVICE_NAME.service"
+SOCKET_FILE="$UNIT_DIR/$SERVICE_NAME.socket"
+
+
+function setup() {
+    skip_if_remote "systemd tests are meaningless over remote"
+
+    basic_setup
+
+    cat > $SERVICE_FILE <<EOF
+[Unit]
+Description=Podman API Service
+Requires=podman.socket
+After=podman.socket
+Documentation=man:podman-system-service(1)
+StartLimitIntervalSec=0
+
+[Service]
+Type=exec
+KillMode=process
+Environment=LOGGING="--log-level=info"
+ExecStart=$PODMAN $LOGGING system service -t 2
+EOF
+    cat > $SOCKET_FILE <<EOF
+[Unit]
+Description=Podman API Socket
+Documentation=man:podman-system-service(1)
+
+[Socket]
+ListenStream=%t/podman/podman.sock
+SocketMode=0660
+
+[Install]
+WantedBy=sockets.target
+EOF
+
+    # ensure pause die before each test runs
+    if is_rootless; then
+        local pause_pid="$XDG_RUNTIME_DIR/libpod/tmp/pause.pid"
+        if [ -f $pause_pid ]; then
+            kill -9 $(cat $pause_pid) 2> /dev/null
+            rm -f $pause_pid
+        fi
+    fi
+    $SYSTEMCTL start "$SERVICE_NAME.socket"
+}
+
+function teardown() {
+    $SYSTEMCTL stop "$SERVICE_NAME.socket"
+    rm -f "$SERVICE_FILE" "$SOCKET_FILE"
+    $SYSTEMCTL daemon-reload
+    basic_teardown
+}
+
+@test "podman system service - socket activation - no container" {
+    run curl -s --max-time 3 --unix-socket $SERVICE_SOCK_ADDR http://podman/libpod/_ping
+    is "$output" "OK" "podman service responses normally"
+}
+
+@test "podman system service - socket activation - exist container " {
+    run_podman run $IMAGE sleep 90
+    run curl -s --max-time 3 --unix-socket $SERVICE_SOCK_ADDR http://podman/libpod/_ping
+    is "$output" "OK" "podman service responses normally"
+}
+
+@test "podman system service - socket activation - kill rootless pause " {
+    if ! is_rootless; then
+        skip "root podman no need pause process"
+    fi
+    run_podman run $IMAGE sleep 90
+    local pause_pid="$XDG_RUNTIME_DIR/libpod/tmp/pause.pid"
+    if [ -f $pause_pid ]; then
+        kill -9 $(cat $pause_pid) 2> /dev/null
+    fi
+    run curl -s --max-time 3 --unix-socket $SERVICE_SOCK_ADDR http://podman/libpod/_ping
+    is "$output" "OK" "podman service responses normally"
+}
+
+# vim: filetype=sh
diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats
index 4a2c7b7a4..8a690fb48 100644
--- a/test/system/410-selinux.bats
+++ b/test/system/410-selinux.bats
@@ -191,5 +191,33 @@ function check_label() {
     is "$output" "Error.*: \`/proc/thread-self/attr/exec\`: OCI runtime error: unable to assign security attribute" "useful diagnostic"
 }
 
+@test "podman selinux: check relabel" {
+    skip_if_no_selinux
+
+    LABEL="system_u:object_r:tmp_t:s0"
+    tmpdir=$PODMAN_TMPDIR/vol
+    touch $tmpdir
+    chcon -vR ${LABEL} $tmpdir
+    ls -Z $tmpdir
+
+    run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current
+    level=$(secon -l $output)
+    run ls -dZ ${tmpdir}
+    is "$output" ${LABEL} "No Relabel Correctly"
+
+    run_podman run -v $tmpdir:/test:Z --security-opt label=disable $IMAGE cat /proc/self/attr/current
+    level=$(secon -l $output)
+    run ls -dZ $tmpdir
+    is "$output" ${LABEL} "No Privileged Relabel Correctly"
+
+    run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current
+    level=$(secon -l $output)
+    run ls -dZ $tmpdir
+    is "$output" "system_u:object_r:container_file_t:$level" "Confined Relabel Correctly"
+
+    run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current
+    run ls -dZ $tmpdir
+    is "$output" "system_u:object_r:container_file_t:s0" "Shared Relabel Correctly"
+}
 
 # vim: filetype=sh
diff --git a/test/system/420-cgroups.bats b/test/system/420-cgroups.bats
index 615e43e6c..89c81a742 100644
--- a/test/system/420-cgroups.bats
+++ b/test/system/420-cgroups.bats
@@ -24,6 +24,11 @@ load helpers
     run_podman container inspect --format '{{.HostConfig.CgroupManager}}' myc
     is "$output" "$other" "podman preserved .HostConfig.CgroupManager"
 
+    if is_rootless && test $other = cgroupfs ; then
+        run_podman container inspect --format '{{.HostConfig.CgroupParent}}' myc
+        is "$output" "" "podman didn't set .HostConfig.CgroupParent for cgroupfs and rootless"
+    fi
+
     # Restart the container, without --cgroup-manager option (ie use default)
     # Prior to #7970, this would fail with an OCI runtime error
     run_podman start myc