diff options
Diffstat (limited to 'test/system')
| -rw-r--r-- | test/system/030-run.bats | 11 | ||||
| -rw-r--r-- | test/system/065-cp.bats | 8 | ||||
| -rw-r--r-- | test/system/075-exec.bats | 1 | ||||
| -rw-r--r-- | test/system/160-volumes.bats | 13 | ||||
| -rw-r--r-- | test/system/170-run-userns.bats | 14 | ||||
| -rw-r--r-- | test/system/500-networking.bats | 1 |
6 files changed, 38 insertions, 10 deletions
diff --git a/test/system/030-run.bats b/test/system/030-run.bats index aba18badb..aa75a6462 100644 --- a/test/system/030-run.bats +++ b/test/system/030-run.bats @@ -273,9 +273,11 @@ echo $rand | 0 | $rand # symptom only manifests on a fedora container image -- we have no # reproducer on alpine. Checking directory ownership is good enough. @test "podman run : user namespace preserved root ownership" { + keep="--userns=keep-id" + is_rootless || keep="" for priv in "" "--privileged"; do for user in "--user=0" "--user=100"; do - for keepid in "" "--userns=keep-id"; do + for keepid in "" ${keep}; do opts="$priv $user $keepid" for dir in /etc /usr;do @@ -290,6 +292,7 @@ echo $rand | 0 | $rand # #6829 : add username to /etc/passwd inside container if --userns=keep-id @test "podman run : add username to /etc/passwd if --userns=keep-id" { + skip_if_not_rootless "--userns=keep-id only works in rootless mode" # Default: always run as root run_podman run --rm $IMAGE id -un is "$output" "root" "id -un on regular container" @@ -340,6 +343,7 @@ echo $rand | 0 | $rand # #6991 : /etc/passwd is modifiable @test "podman run : --userns=keep-id: passwd file is modifiable" { + skip_if_not_rootless "--userns=keep-id only works in rootless mode" run_podman run -d --userns=keep-id --cap-add=dac_override $IMAGE sh -c 'while ! test -e /tmp/stop; do sleep 0.1; done' cid="$output" @@ -824,6 +828,9 @@ EOF # CVE-2022-1227 : podman top joins container mount NS and uses nsenter from image @test "podman top does not use nsenter from image" { + keepid="--userns=keep-id" + is_rootless || keepid="" + tmpdir=$PODMAN_TMPDIR/build-test mkdir -p $tmpdir tmpbuilddir=$tmpdir/build @@ -838,7 +845,7 @@ EOF test_image="cve_2022_1227_test" run_podman build -t $test_image $tmpbuilddir - run_podman run -d --userns=keep-id $test_image top + run_podman run -d ${keepid} $test_image top ctr="$output" run_podman top $ctr huser,user run_podman rm -f -t0 $ctr diff --git a/test/system/065-cp.bats b/test/system/065-cp.bats index 780fc6737..260ad4800 100644 --- a/test/system/065-cp.bats +++ b/test/system/065-cp.bats @@ -119,7 +119,9 @@ load helpers echo "content" > $srcdir/hostfile userid=$(id -u) - run_podman run --user=$userid --userns=keep-id -d --name cpcontainer $IMAGE sleep infinity + keepid="--userns=keep-id" + is_rootless || keepid="" + run_podman run --user=$userid ${keepid} -d --name cpcontainer $IMAGE sleep infinity run_podman cp $srcdir/hostfile cpcontainer:/tmp/hostfile run_podman exec cpcontainer stat -c "%u" /tmp/hostfile is "$output" "$userid" "copied file is chowned to the container user" @@ -138,7 +140,9 @@ load helpers userid=$(id -u) - run_podman run --user="$userid" --userns=keep-id -d --name cpcontainer $IMAGE sleep infinity + keepid="--userns=keep-id" + is_rootless || keepid="" + run_podman run --user=$userid ${keepid} -d --name cpcontainer $IMAGE sleep infinity run_podman cp -a=false - cpcontainer:/tmp/ < "${tmpdir}/a.tar" run_podman exec cpcontainer stat -c "%u:%g" /tmp/a.txt is "$output" "1042:1043" "copied file retains uid/gid from the tar" diff --git a/test/system/075-exec.bats b/test/system/075-exec.bats index 42954e5ec..0a6048b7e 100644 --- a/test/system/075-exec.bats +++ b/test/system/075-exec.bats @@ -87,6 +87,7 @@ load helpers # #6829 : add username to /etc/passwd inside container if --userns=keep-id @test "podman exec - with keep-id" { + skip_if_not_rootless "--userns=keep-id only works in rootless mode" # Multiple --userns options confirm command-line override (last one wins) run_podman run -d --userns=private --userns=keep-id $IMAGE sh -c \ "echo READY;while [ ! -f /tmp/stop ]; do sleep 1; done" diff --git a/test/system/160-volumes.bats b/test/system/160-volumes.bats index d0088b994..1a558c599 100644 --- a/test/system/160-volumes.bats +++ b/test/system/160-volumes.bats @@ -182,13 +182,14 @@ EOF run_podman volume rm $myvol - # Autocreated volumes should also work with keep-id - # All we do here is check status; podman 1.9.1 would fail with EPERM - myvol=myvol$(random_string) - run_podman run --rm -v $myvol:/myvol:z --userns=keep-id $IMAGE \ + if is_rootless; then + # Autocreated volumes should also work with keep-id + # All we do here is check status; podman 1.9.1 would fail with EPERM + myvol=myvol$(random_string) + run_podman run --rm -v $myvol:/myvol:z --userns=keep-id $IMAGE \ touch /myvol/myfile - - run_podman volume rm $myvol + run_podman volume rm $myvol + fi } diff --git a/test/system/170-run-userns.bats b/test/system/170-run-userns.bats index c020a73ab..d754306b2 100644 --- a/test/system/170-run-userns.bats +++ b/test/system/170-run-userns.bats @@ -94,3 +94,17 @@ EOF is ${output} ${secret_content} "Secrets should work with user namespace" run_podman secret rm ${test_name} } + +@test "podman userns=nomap" { + skip_if_not_rootless "--userns=nomap only works in rootless mode" + ns_user=$(id -un) + baseuid=$(egrep "${ns_user}:" /etc/subuid | cut -f2 -d:) + test ! -z ${baseuid} || skip "no IDs allocated for user ${ns_user}" + + test_name="test_$(random_string 12)" + run_podman run -d --userns=nomap $IMAGE sleep 100 + cid=${output} + run_podman top ${cid} huser + is "${output}" "HUSER.*${baseuid}" "Container should start with baseuid from /etc/subuid not user UID" + run_podman rm -t 0 --force ${cid} +} diff --git a/test/system/500-networking.bats b/test/system/500-networking.bats index 78ad3fe04..1b5e27e95 100644 --- a/test/system/500-networking.bats +++ b/test/system/500-networking.bats @@ -88,6 +88,7 @@ load helpers # Issue #5466 - port-forwarding doesn't work with this option and -d @test "podman networking: port with --userns=keep-id" { + skip_if_not_rootless "--userns=keep-id only works in rootless mode" for cidr in "" "$(random_rfc1918_subnet).0/24"; do myport=$(random_free_port 52000-52999) if [[ -z $cidr ]]; then |