diff options
Diffstat (limited to 'test/system/410-selinux.bats')
| -rw-r--r-- | test/system/410-selinux.bats | 38 |
1 files changed, 22 insertions, 16 deletions
diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats index 8a690fb48..f8cee0e59 100644 --- a/test/system/410-selinux.bats +++ b/test/system/410-selinux.bats @@ -51,18 +51,13 @@ function check_label() { } @test "podman selinux: pid=host" { - # FIXME FIXME FIXME: Remove these lines once all VMs have >= 2.146.0 - # (this is ugly, but better than an unconditional skip) - skip_if_no_selinux + # FIXME this test fails when run rootless with runc: + # Error: container_linux.go:367: starting container process caused: process_linux.go:495: container init caused: readonly path /proc/asound: operation not permitted: OCI permission denied if is_rootless; then - if [ -x /usr/bin/rpm ]; then - cs_version=$(rpm -q --qf '%{version}' container-selinux) - else - # SELinux not enabled on Ubuntu, so we should never get here - die "WHOA! SELinux enabled, but no /usr/bin/rpm!" - fi + runtime=$(podman_runtime) + test "$runtime" == "crun" \ + || skip "runtime is $runtime; this test requires crun" fi - # FIXME FIXME FIXME: delete up to here, leaving just check_label check_label "--pid=host" "spc_t" } @@ -185,30 +180,41 @@ function check_label() { @test "podman with nonexistent labels" { skip_if_no_selinux + # runc and crun emit different diagnostics + runtime=$(podman_runtime) + case "$runtime" in + crun) expect="\`/proc/thread-self/attr/exec\`: OCI runtime error: unable to assign security attribute" ;; + runc) expect="OCI runtime error: .*: failed to set /proc/self/attr/keycreate on procfs" ;; + *) skip "Unknown runtime '$runtime'";; + esac + # The '.*' in the error below is for dealing with podman-remote, which # includes "error preparing container <sha> for attach" in output. run_podman 126 run --security-opt label=type:foo.bar $IMAGE true - is "$output" "Error.*: \`/proc/thread-self/attr/exec\`: OCI runtime error: unable to assign security attribute" "useful diagnostic" + is "$output" "Error.*: $expect" "podman emits useful diagnostic on failure" } @test "podman selinux: check relabel" { skip_if_no_selinux LABEL="system_u:object_r:tmp_t:s0" + RELABEL="system_u:object_r:container_file_t:s0" tmpdir=$PODMAN_TMPDIR/vol touch $tmpdir chcon -vR ${LABEL} $tmpdir ls -Z $tmpdir run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current - level=$(secon -l $output) run ls -dZ ${tmpdir} is "$output" ${LABEL} "No Relabel Correctly" - run_podman run -v $tmpdir:/test:Z --security-opt label=disable $IMAGE cat /proc/self/attr/current - level=$(secon -l $output) + run_podman run -v $tmpdir:/test:z --security-opt label=disable $IMAGE cat /proc/self/attr/current + run ls -dZ $tmpdir + is "$output" ${RELABEL} "Privileged Relabel Correctly" + + run_podman run -v $tmpdir:/test:z --privileged $IMAGE cat /proc/self/attr/current run ls -dZ $tmpdir - is "$output" ${LABEL} "No Privileged Relabel Correctly" + is "$output" ${RELABEL} "Privileged Relabel Correctly" run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current level=$(secon -l $output) @@ -217,7 +223,7 @@ function check_label() { run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current run ls -dZ $tmpdir - is "$output" "system_u:object_r:container_file_t:s0" "Shared Relabel Correctly" + is "$output" ${RELABEL} "Shared Relabel Correctly" } # vim: filetype=sh |