diff options
| -rw-r--r-- | cmd/podman/spec.go | 14 | ||||
| -rw-r--r-- | test/e2e/privileged_test.go | 39 | ||||
| -rw-r--r-- | test/e2e/rm_test.go | 2 |
3 files changed, 53 insertions, 2 deletions
diff --git a/cmd/podman/spec.go b/cmd/podman/spec.go index d21d8b6da..56e8c8d05 100644 --- a/cmd/podman/spec.go +++ b/cmd/podman/spec.go @@ -156,12 +156,24 @@ func addDevice(g *generate.Generator, device string) error { // Parses information needed to create a container into an OCI runtime spec func createConfigToOCISpec(config *createConfig) (*spec.Spec, error) { + cgroupPerm := "ro" g := generate.New() + if config.Privileged { + cgroupPerm = "rw" + g.RemoveMount("/sys") + sysMnt := spec.Mount{ + Destination: "/sys", + Type: "sysfs", + Source: "sysfs", + Options: []string{"nosuid", "noexec", "nodev", "rw"}, + } + g.AddMount(sysMnt) + } cgroupMnt := spec.Mount{ Destination: "/sys/fs/cgroup", Type: "cgroup", Source: "cgroup", - Options: []string{"nosuid", "noexec", "nodev", "relatime", "ro"}, + Options: []string{"nosuid", "noexec", "nodev", "relatime", cgroupPerm}, } g.AddMount(cgroupMnt) g.SetProcessCwd(config.WorkDir) diff --git a/test/e2e/privileged_test.go b/test/e2e/privileged_test.go new file mode 100644 index 000000000..1da9ed07e --- /dev/null +++ b/test/e2e/privileged_test.go @@ -0,0 +1,39 @@ +package integration + +import ( + "os" + + . "github.com/onsi/ginkgo" + . "github.com/onsi/gomega" +) + +var _ = Describe("Podman privileged container tests", func() { + var ( + tempdir string + err error + podmanTest PodmanTest + ) + + BeforeEach(func() { + tempdir, err = CreateTempDirInTempDir() + if err != nil { + os.Exit(1) + } + podmanTest = PodmanCreate(tempdir) + podmanTest.RestoreAllArtifacts() + }) + + AfterEach(func() { + podmanTest.Cleanup() + + }) + + It("podman privileged make sure sys is mounted rw", func() { + session := podmanTest.Podman([]string{"run", "--privileged", "busybox", "mount"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + ok, lines := session.GrepString("sysfs") + Expect(ok).To(BeTrue()) + Expect(lines[0]).To(ContainSubstring("sysfs (rw,")) + }) +}) diff --git a/test/e2e/rm_test.go b/test/e2e/rm_test.go index a59b2ee01..ed0221dfd 100644 --- a/test/e2e/rm_test.go +++ b/test/e2e/rm_test.go @@ -45,7 +45,7 @@ var _ = Describe("Podman rm", func() { result := podmanTest.Podman([]string{"rm", cid}) result.WaitWithDefaultTimeout() - Expect(result.ExitCode()).To(Not(Equal(0))) + Expect(result.ExitCode()).To(Equal(125)) }) It("podman rm created container", func() { |