diff options
Diffstat (limited to 'test/system/410-selinux.bats')
| -rw-r--r-- | test/system/410-selinux.bats | 28 |
1 files changed, 28 insertions, 0 deletions
diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats index 4a2c7b7a4..8a690fb48 100644 --- a/test/system/410-selinux.bats +++ b/test/system/410-selinux.bats @@ -191,5 +191,33 @@ function check_label() { is "$output" "Error.*: \`/proc/thread-self/attr/exec\`: OCI runtime error: unable to assign security attribute" "useful diagnostic" } +@test "podman selinux: check relabel" { + skip_if_no_selinux + + LABEL="system_u:object_r:tmp_t:s0" + tmpdir=$PODMAN_TMPDIR/vol + touch $tmpdir + chcon -vR ${LABEL} $tmpdir + ls -Z $tmpdir + + run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current + level=$(secon -l $output) + run ls -dZ ${tmpdir} + is "$output" ${LABEL} "No Relabel Correctly" + + run_podman run -v $tmpdir:/test:Z --security-opt label=disable $IMAGE cat /proc/self/attr/current + level=$(secon -l $output) + run ls -dZ $tmpdir + is "$output" ${LABEL} "No Privileged Relabel Correctly" + + run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current + level=$(secon -l $output) + run ls -dZ $tmpdir + is "$output" "system_u:object_r:container_file_t:$level" "Confined Relabel Correctly" + + run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current + run ls -dZ $tmpdir + is "$output" "system_u:object_r:container_file_t:s0" "Shared Relabel Correctly" +} # vim: filetype=sh |