summaryrefslogtreecommitdiff
path: root/test/system
diff options
context:
space:
mode:
Diffstat (limited to 'test/system')
-rw-r--r--test/system/005-info.bats4
-rw-r--r--test/system/030-run.bats17
-rw-r--r--test/system/035-logs.bats49
-rw-r--r--test/system/050-stop.bats31
-rw-r--r--test/system/065-cp.bats234
-rw-r--r--test/system/070-build.bats13
-rw-r--r--test/system/090-events.bats1
-rw-r--r--test/system/125-import.bats45
-rw-r--r--test/system/255-auto-update.bats3
-rw-r--r--test/system/271-tcp-cors-server.bats44
-rw-r--r--test/system/410-selinux.bats12
-rw-r--r--test/system/500-networking.bats87
-rw-r--r--test/system/helpers.bash2
13 files changed, 507 insertions, 35 deletions
diff --git a/test/system/005-info.bats b/test/system/005-info.bats
index 4b419841e..50c3ceb30 100644
--- a/test/system/005-info.bats
+++ b/test/system/005-info.bats
@@ -33,12 +33,16 @@ cgroupVersion: v[12]
expr_nvr="[a-z0-9-]\\\+-[a-z0-9.]\\\+-[a-z0-9]\\\+\."
expr_path="/[a-z0-9\\\/.-]\\\+\\\$"
+ # FIXME: if we're ever able to get package versions on Debian,
+ # add '-[0-9]' to all '*.package' queries below.
tests="
host.buildahVersion | [0-9.]
host.conmon.path | $expr_path
+host.conmon.package | .*conmon.*
host.cgroupManager | \\\(systemd\\\|cgroupfs\\\)
host.cgroupVersion | v[12]
host.ociRuntime.path | $expr_path
+host.ociRuntime.package | .*\\\(crun\\\|runc\\\).*
store.configFile | $expr_path
store.graphDriverName | [a-z0-9]\\\+\\\$
store.graphRoot | $expr_path
diff --git a/test/system/030-run.bats b/test/system/030-run.bats
index 32fc85c4e..3d9d834b3 100644
--- a/test/system/030-run.bats
+++ b/test/system/030-run.bats
@@ -706,4 +706,21 @@ EOF
run_podman rmi nomtab
}
+@test "podman run --device-cgroup-rule tests" {
+ skip_if_rootless "cannot add devices in rootless mode"
+
+ run_podman run --device-cgroup-rule="b 7:* rmw" --rm $IMAGE
+ run_podman run --device-cgroup-rule="c 7:* rmw" --rm $IMAGE
+ run_podman run --device-cgroup-rule="a 7:1 rmw" --rm $IMAGE
+ run_podman run --device-cgroup-rule="a 7 rmw" --rm $IMAGE
+ run_podman 125 run --device-cgroup-rule="b 7:* rmX" --rm $IMAGE
+ is "$output" "Error: invalid device access in device-access-add: X"
+ run_podman 125 run --device-cgroup-rule="b 7:2" --rm $IMAGE
+ is "$output" 'Error: invalid device cgroup rule requires type, major:Minor, and access rules: "b 7:2"'
+ run_podman 125 run --device-cgroup-rule="x 7:* rmw" --rm $IMAGE
+ is "$output" "Error: invalid device type in device-access-add:"
+ run_podman 125 run --device-cgroup-rule="a a:* rmw" --rm $IMAGE
+ is "$output" "Error: strconv.ParseInt: parsing \"a\": invalid syntax"
+}
+
# vim: filetype=sh
diff --git a/test/system/035-logs.bats b/test/system/035-logs.bats
index ccf83df14..32282c8e1 100644
--- a/test/system/035-logs.bats
+++ b/test/system/035-logs.bats
@@ -24,6 +24,9 @@ load helpers
# test --since with Unix timestamps
run_podman logs --since 1000 $cid
+ # test --until with Unix timestamps
+ run_podman logs --until 1000 $cid
+
run_podman rm $cid
}
@@ -125,4 +128,50 @@ $s_after"
_log_test_since journald
}
+function _log_test_until() {
+ local driver=$1
+
+ s_before="before_$(random_string)_${driver}"
+ s_after="after_$(random_string)_${driver}"
+
+ before=$(date --iso-8601=seconds)
+ sleep 5
+ run_podman run --log-driver=$driver -d --name test $IMAGE sh -c \
+ "echo $s_before; trap 'echo $s_after; exit' SIGTERM; while :; do sleep 1; done"
+
+ # sleep a second to make sure the date is after the first echo
+ sleep 1
+ run_podman stop test
+ # sleep for 20 seconds to get the proper after time
+ sleep 20
+
+ run_podman logs test
+ is "$output" \
+ "$s_before
+$s_after"
+
+ run_podman logs --until $before test
+ is "$output" \
+ ""
+
+ after=$(date --iso-8601=seconds)
+
+ run_podman logs --until $after test
+ is "$output" \
+ "$s_before
+$s_after"
+ run_podman rm -f test
+}
+
+@test "podman logs - until k8s-file" {
+ _log_test_until k8s-file
+}
+
+@test "podman logs - until journald" {
+ # We can't use journald on RHEL as rootless: rhbz#1895105
+ skip_if_journald_unavailable
+
+ _log_test_until journald
+}
+
# vim: filetype=sh
diff --git a/test/system/050-stop.bats b/test/system/050-stop.bats
index 2ed791429..d809507a5 100644
--- a/test/system/050-stop.bats
+++ b/test/system/050-stop.bats
@@ -119,11 +119,31 @@ load helpers
# the container's status.
run_podman run --name stopme -d $IMAGE sh -c \
- "trap 'echo Received SIGTERM, ignoring' SIGTERM; echo READY; while :; do sleep 1; done"
+ "trap 'echo Received SIGTERM, ignoring' SIGTERM; echo READY; while :; do sleep 0.2; done"
- # Stop the container in the background
+ wait_for_ready stopme
+
+ local t0=$SECONDS
+ # Stop the container, but do so in the background so we can inspect
+ # the container status while it's stopping. Use $PODMAN because we
+ # don't want the overhead and error checks of run_podman.
$PODMAN stop -t 20 stopme &
+ # Wait for container to acknowledge the signal. We can't use wait_for_output
+ # because that aborts if .State.Running != true
+ local timeout=5
+ while [[ $timeout -gt 0 ]]; do
+ run_podman logs stopme
+ if [[ "$output" =~ "Received SIGTERM, ignoring" ]]; then
+ break
+ fi
+ timeout=$((timeout - 1))
+ if [[ $timeout -eq 0 ]]; then
+ die "Timed out waiting for container to receive SIGERM"
+ fi
+ sleep 0.5
+ done
+
# Other commands can acquire the lock
run_podman ps -a
@@ -131,6 +151,13 @@ load helpers
run_podman inspect --format '{{.State.Status}}' stopme
is "$output" "stopping" "Status of container should be 'stopping'"
+ # Time check: make sure we were able to run 'ps' before the container
+ # exited. If this takes too long, it means ps had to wait for lock.
+ local delta_t=$(( $SECONDS - t0 ))
+ if [[ $delta_t -gt 5 ]]; then
+ die "Operations took too long ($delta_t seconds)"
+ fi
+
run_podman kill stopme
run_podman wait stopme
diff --git a/test/system/065-cp.bats b/test/system/065-cp.bats
index 5778eb46e..39f439e7b 100644
--- a/test/system/065-cp.bats
+++ b/test/system/065-cp.bats
@@ -22,8 +22,7 @@ load helpers
mkdir -p $srcdir/subdir
echo "${randomcontent[2]}" > $srcdir/subdir/dotfile.
- run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sleep infinity
- run_podman exec cpcontainer mkdir /srv/subdir
+ run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sh -c "mkdir /srv/subdir; sleep infinity"
# Commit the image for testing non-running containers
run_podman commit -q cpcontainer
@@ -41,7 +40,6 @@ load helpers
0 | /tmp | /tmp/hostfile0 | copy to /tmp
1 | /tmp/ | /tmp/hostfile1 | copy to /tmp/
2 | /tmp/. | /tmp/hostfile2 | copy to /tmp/.
-0 | /tmp/hostfile2 | /tmp/hostfile2 | overwrite previous copy
0 | /tmp/anotherbase.txt | /tmp/anotherbase.txt | copy to /tmp, new name
0 | . | /srv/hostfile0 | copy to workdir (rel path), new name
1 | ./ | /srv/hostfile1 | copy to workdir (rel path), new name
@@ -175,11 +173,12 @@ load helpers
random-1-$(random_string 15)
random-2-$(random_string 20)
)
- run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sleep infinity
- run_podman exec cpcontainer sh -c "echo ${randomcontent[0]} > /tmp/containerfile"
- run_podman exec cpcontainer sh -c "echo ${randomcontent[0]} > /tmp/dotfile."
- run_podman exec cpcontainer sh -c "echo ${randomcontent[1]} > /srv/containerfile1"
- run_podman exec cpcontainer sh -c "mkdir /srv/subdir; echo ${randomcontent[2]} > /srv/subdir/containerfile2"
+ run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sh -c "mkdir /srv/subdir;
+ echo ${randomcontent[0]} > /tmp/containerfile;
+ echo ${randomcontent[0]} > /tmp/dotfile.;
+ echo ${randomcontent[1]} > /srv/containerfile1;
+ echo ${randomcontent[2]} > /srv/subdir/containerfile2;
+ sleep infinity"
# Commit the image for testing non-running containers
run_podman commit -q cpcontainer
@@ -226,6 +225,98 @@ load helpers
}
+@test "podman cp file from container to container" {
+ # Create 3 files with random content in the container.
+ local -a randomcontent=(
+ random-0-$(random_string 10)
+ random-1-$(random_string 15)
+ random-2-$(random_string 20)
+ )
+
+ run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sh -c "mkdir /srv/subdir;
+ echo ${randomcontent[0]} > /tmp/containerfile;
+ echo ${randomcontent[0]} > /tmp/dotfile.;
+ echo ${randomcontent[1]} > /srv/containerfile1;
+ echo ${randomcontent[2]} > /srv/subdir/containerfile2;
+ sleep infinity"
+
+ # Commit the image for testing non-running containers
+ run_podman commit -q cpcontainer
+ cpimage="$output"
+
+ # format is: <id> | <source arg to cp> | <destination arg (appended to $srcdir) to cp> | <full dest path (appended to $srcdir)> | <test name>
+ tests="
+0 | /tmp/containerfile | | /containerfile | /
+0 | /tmp/dotfile. | | /dotfile. | /
+0 | /tmp/containerfile | / | /containerfile | /
+0 | /tmp/containerfile | /. | /containerfile | /.
+0 | /tmp/containerfile | /newfile | /newfile | /newfile
+1 | containerfile1 | / | /containerfile1 | copy from workdir (rel path) to /
+2 | subdir/containerfile2 | / | /containerfile2 | copy from workdir/subdir (rel path) to /
+"
+
+ # From RUNNING container
+ while read id src dest dest_fullname description; do
+ # dest may be "''" for empty table cells
+ if [[ $dest == "''" ]];then
+ unset dest
+ fi
+
+ # To RUNNING container
+ run_podman run -d $IMAGE sleep infinity
+ destcontainer="$output"
+ run_podman cp cpcontainer:$src $destcontainer:"/$dest"
+ run_podman exec $destcontainer cat "/$dest_fullname"
+ is "$output" "${randomcontent[$id]}" "$description (cp ctr:$src to /$dest)"
+ run_podman kill $destcontainer
+ run_podman rm -f $destcontainer
+
+ # To CREATED container
+ run_podman create $IMAGE sleep infinity
+ destcontainer="$output"
+ run_podman cp cpcontainer:$src $destcontainer:"/$dest"
+ run_podman start $destcontainer
+ run_podman exec $destcontainer cat "/$dest_fullname"
+ is "$output" "${randomcontent[$id]}" "$description (cp ctr:$src to /$dest)"
+ run_podman kill $destcontainer
+ run_podman rm -f $destcontainer
+ done < <(parse_table "$tests")
+ run_podman kill cpcontainer
+ run_podman rm -f cpcontainer
+
+ # From CREATED container
+ run_podman create --name cpcontainer --workdir=/srv $cpimage
+ while read id src dest dest_fullname description; do
+ # dest may be "''" for empty table cells
+ if [[ $dest == "''" ]];then
+ unset dest
+ fi
+
+ # To RUNNING container
+ run_podman run -d $IMAGE sleep infinity
+ destcontainer="$output"
+ run_podman cp cpcontainer:$src $destcontainer:"/$dest"
+ run_podman exec $destcontainer cat "/$dest_fullname"
+ is "$output" "${randomcontent[$id]}" "$description (cp ctr:$src to /$dest)"
+ run_podman kill $destcontainer
+ run_podman rm -f $destcontainer
+
+ # To CREATED container
+ run_podman create $IMAGE sleep infinity
+ destcontainer="$output"
+ run_podman cp cpcontainer:$src $destcontainer:"/$dest"
+ run_podman start $destcontainer
+ run_podman exec $destcontainer cat "/$dest_fullname"
+ is "$output" "${randomcontent[$id]}" "$description (cp ctr:$src to /$dest)"
+ run_podman kill $destcontainer
+ run_podman rm -f $destcontainer
+ done < <(parse_table "$tests")
+ run_podman rm -f cpcontainer
+
+ run_podman rmi -f $cpimage
+}
+
+
@test "podman cp dir from host to container" {
srcdir=$PODMAN_TMPDIR
mkdir -p $srcdir/dir/sub
@@ -241,8 +332,7 @@ load helpers
mkdir -p $srcdir/dir.
cp -r $srcdir/dir/* $srcdir/dir.
- run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sleep infinity
- run_podman exec cpcontainer mkdir /srv/subdir
+ run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sh -c "mkdir /srv/subdir; sleep infinity"
# Commit the image for testing non-running containers
run_podman commit -q cpcontainer
@@ -309,12 +399,12 @@ load helpers
random-0-$(random_string 10)
random-1-$(random_string 15)
)
- run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sleep infinity
- run_podman exec cpcontainer sh -c "mkdir /srv/subdir; echo ${randomcontent[0]} > /srv/subdir/containerfile0"
- run_podman exec cpcontainer sh -c "echo ${randomcontent[1]} > /srv/subdir/containerfile1"
- # "." and "dir/." will copy the contents, so make sure that a dir ending
- # with dot is treated correctly.
- run_podman exec cpcontainer sh -c 'mkdir /tmp/subdir.; cp /srv/subdir/* /tmp/subdir./'
+
+ run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sh -c "mkdir /srv/subdir;
+ echo ${randomcontent[0]} > /srv/subdir/containerfile0; \
+ echo ${randomcontent[1]} > /srv/subdir/containerfile1; \
+ mkdir /tmp/subdir.; cp /srv/subdir/* /tmp/subdir./; \
+ sleep infinity"
# Commit the image for testing non-running containers
run_podman commit -q cpcontainer
@@ -377,6 +467,110 @@ load helpers
}
+@test "podman cp dir from container to container" {
+ # Create 2 files with random content in the container.
+ local -a randomcontent=(
+ random-0-$(random_string 10)
+ random-1-$(random_string 15)
+ )
+
+ run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sh -c "mkdir /srv/subdir;
+ echo ${randomcontent[0]} > /srv/subdir/containerfile0; \
+ echo ${randomcontent[1]} > /srv/subdir/containerfile1; \
+ mkdir /tmp/subdir.; cp /srv/subdir/* /tmp/subdir./; \
+ sleep infinity"
+
+ # Commit the image for testing non-running containers
+ run_podman commit -q cpcontainer
+ cpimage="$output"
+
+ # format is: <source arg to cp (appended to /srv)> | <dest> | <full dest path> | <test name>
+ tests="
+/srv | | /srv/subdir | copy /srv
+/srv | /newdir | /newdir/subdir | copy /srv to /newdir
+/srv/ | | /srv/subdir | copy /srv/
+/srv/. | | /subdir | copy /srv/.
+/srv/. | /newdir | /newdir/subdir | copy /srv/. to /newdir
+/srv/subdir/. | | | copy /srv/subdir/.
+/tmp/subdir. | | /subdir. | copy /tmp/subdir.
+"
+
+ # From RUNNING container
+ while read src dest dest_fullname description; do
+ if [[ $src == "''" ]];then
+ unset src
+ fi
+ if [[ $dest == "''" ]];then
+ unset dest
+ fi
+ if [[ $dest_fullname == "''" ]];then
+ unset dest_fullname
+ fi
+
+ # To RUNNING container
+ run_podman run -d $IMAGE sleep infinity
+ destcontainer="$output"
+ run_podman cp cpcontainer:$src $destcontainer:"/$dest"
+ run_podman exec $destcontainer cat "/$dest_fullname/containerfile0" "/$dest_fullname/containerfile1"
+ is "$output" "${randomcontent[0]}
+${randomcontent[1]}" "$description"
+ run_podman kill $destcontainer
+ run_podman rm -f $destcontainer
+
+ # To CREATED container
+ run_podman create $IMAGE sleep infinity
+ destcontainer="$output"
+ run_podman cp cpcontainer:$src $destcontainer:"/$dest"
+ run_podman start $destcontainer
+ run_podman exec $destcontainer cat "/$dest_fullname/containerfile0" "/$dest_fullname/containerfile1"
+ is "$output" "${randomcontent[0]}
+${randomcontent[1]}" "$description"
+ run_podman kill $destcontainer
+ run_podman rm -f $destcontainer
+ done < <(parse_table "$tests")
+ run_podman kill cpcontainer
+ run_podman rm -f cpcontainer
+
+ # From CREATED container
+ run_podman create --name cpcontainer --workdir=/srv $cpimage
+ while read src dest dest_fullname description; do
+ if [[ $src == "''" ]];then
+ unset src
+ fi
+ if [[ $dest == "''" ]];then
+ unset dest
+ fi
+ if [[ $dest_fullname == "''" ]];then
+ unset dest_fullname
+ fi
+
+ # To RUNNING container
+ run_podman run -d $IMAGE sleep infinity
+ destcontainer="$output"
+ run_podman cp cpcontainer:$src $destcontainer:"/$dest"
+ run_podman exec $destcontainer cat "/$dest_fullname/containerfile0" "/$dest_fullname/containerfile1"
+ is "$output" "${randomcontent[0]}
+${randomcontent[1]}" "$description"
+ run_podman kill $destcontainer
+ run_podman rm -f $destcontainer
+
+ # To CREATED container
+ run_podman create $IMAGE sleep infinity
+ destcontainer="$output"
+ run_podman start $destcontainer
+ run_podman cp cpcontainer:$src $destcontainer:"/$dest"
+ run_podman exec $destcontainer cat "/$dest_fullname/containerfile0" "/$dest_fullname/containerfile1"
+ is "$output" "${randomcontent[0]}
+${randomcontent[1]}" "$description"
+ run_podman kill $destcontainer
+ run_podman rm -f $destcontainer
+ done < <(parse_table "$tests")
+
+ run_podman rm -f cpcontainer
+ run_podman rmi -f $cpimage
+}
+
+
@test "podman cp symlinked directory from container" {
destdir=$PODMAN_TMPDIR/cp-weird-symlink
mkdir -p $destdir
@@ -387,10 +581,10 @@ load helpers
random-1-$(random_string 15)
)
- run_podman run -d --name cpcontainer $IMAGE sleep infinity
- run_podman exec cpcontainer sh -c "echo ${randomcontent[0]} > /tmp/containerfile0"
- run_podman exec cpcontainer sh -c "echo ${randomcontent[1]} > /tmp/containerfile1"
- run_podman exec cpcontainer sh -c "mkdir /tmp/sub && cd /tmp/sub && ln -s .. weirdlink"
+ run_podman run -d --name cpcontainer $IMAGE sh -c "echo ${randomcontent[0]} > /tmp/containerfile0; \
+ echo ${randomcontent[1]} > /tmp/containerfile1; \
+ mkdir /tmp/sub && cd /tmp/sub && ln -s .. weirdlink; \
+ sleep infinity"
# Commit the image for testing non-running containers
run_podman commit -q cpcontainer
diff --git a/test/system/070-build.bats b/test/system/070-build.bats
index 7b76c585f..26113e45c 100644
--- a/test/system/070-build.bats
+++ b/test/system/070-build.bats
@@ -749,16 +749,9 @@ RUN echo $random_string
EOF
run_podman 125 build -t build_test --pull-never $tmpdir
- # FIXME: this is just ridiculous. Even after #10030 and #10034, Ubuntu
- # remote *STILL* flakes this test! It fails with the correct exit status,
- # but the error output is 'Error: stream dropped, unexpected failure'
- # Let's just stop checking on podman-remote. As long as it exits 125,
- # we're happy.
- if ! is_remote; then
- is "$output" \
- ".*Error: error creating build container: quay.io/libpod/nosuchimage:nosuchtag: image not known" \
- "--pull-never fails with expected error message"
- fi
+ is "$output" \
+ ".*Error: error creating build container: quay.io/libpod/nosuchimage:nosuchtag: image not known" \
+ "--pull-never fails with expected error message"
}
@test "podman build --logfile test" {
diff --git a/test/system/090-events.bats b/test/system/090-events.bats
index d889bd7f9..22edaeee9 100644
--- a/test/system/090-events.bats
+++ b/test/system/090-events.bats
@@ -81,6 +81,7 @@ function _events_disjunctive_filters() {
@test "events with disjunctive filters - journald" {
skip_if_remote "remote does not support --events-backend"
+ skip_if_journald_unavailable "system does not support journald events"
_events_disjunctive_filters --events-backend=journald
}
diff --git a/test/system/125-import.bats b/test/system/125-import.bats
new file mode 100644
index 000000000..c53711618
--- /dev/null
+++ b/test/system/125-import.bats
@@ -0,0 +1,45 @@
+#!/usr/bin/env bats -*- bats -*-
+#
+# tests for podman import
+#
+
+load helpers
+
+@test "podman import" {
+ local archive=$PODMAN_TMPDIR/archive.tar
+ local random_content=$(random_string 12)
+ # Generate a random name and tag (must be lower-case)
+ local random_name=x0$(random_string 12 | tr A-Z a-z)
+ local random_tag=t0$(random_string 7 | tr A-Z a-z)
+ local fqin=localhost/$random_name:$random_tag
+
+ run_podman run --name import $IMAGE sh -c "echo ${random_content} > /random.txt"
+ run_podman export import -o $archive
+ run_podman rm -f import
+
+ # Simple import
+ run_podman import -q $archive
+ iid="$output"
+ run_podman run -t --rm $iid cat /random.txt
+ is "$output" "$random_content" "simple import"
+ run_podman rmi -f $iid
+
+ # Simple import via stdin
+ run_podman import -q - < <(cat $archive)
+ iid="$output"
+ run_podman run -t --rm $iid cat /random.txt
+ is "$output" "$random_content" "simple import via stdin"
+ run_podman rmi -f $iid
+
+ # Tagged import
+ run_podman import -q $archive $fqin
+ run_podman run -t --rm $fqin cat /random.txt
+ is "$output" "$random_content" "tagged import"
+ run_podman rmi -f $fqin
+
+ # Tagged import via stdin
+ run_podman import -q - $fqin < <(cat $archive)
+ run_podman run -t --rm $fqin cat /random.txt
+ is "$output" "$random_content" "tagged import via stdin"
+ run_podman rmi -f $fqin
+}
diff --git a/test/system/255-auto-update.bats b/test/system/255-auto-update.bats
index 25eaba45b..6fb40f41e 100644
--- a/test/system/255-auto-update.bats
+++ b/test/system/255-auto-update.bats
@@ -261,7 +261,8 @@ EOF
systemctl enable --now podman-auto-update-$cname.timer
systemctl list-timers --all
- local expect='Finished Podman auto-update testing service'
+ # While systemd v245 and later uses 'Finished', older versions uses 'Started' for oneshot services
+ local expect='(Finished|Started) Podman auto-update testing service'
local failed_start=failed
local count=0
while [ $count -lt 120 ]; do
diff --git a/test/system/271-tcp-cors-server.bats b/test/system/271-tcp-cors-server.bats
new file mode 100644
index 000000000..cdfa82e82
--- /dev/null
+++ b/test/system/271-tcp-cors-server.bats
@@ -0,0 +1,44 @@
+#!/usr/bin/env bats -*- bats -*-
+#
+# Tests podman system service CORS enabled
+#
+
+load helpers
+
+SERVICE_NAME="podman_test_$(random_string)"
+
+SERVICE_TCP_HOST="localhost"
+
+SERVICE_FILE="$UNIT_DIR/$SERVICE_NAME.service"
+SOCKET_FILE="$UNIT_DIR/$SERVICE_NAME.socket"
+
+@test "podman system service - tcp CORS" {
+ skip_if_remote "system service tests are meaningless over remote"
+ PORT=$(( ((RANDOM<<15)|RANDOM) % 63001 + 2000 ))
+ run_podman system service --cors="*" tcp:$SERVICE_TCP_HOST:$PORT -t 20 &
+ podman_pid="$!"
+ sleep 5s
+ run curl -s --max-time 10 -vvv $SERVICE_TCP_HOST:$PORT/_ping 2>&1
+ is "$output" ".*< Access-Control-Allow-Origin: \*.*" "access-control-allow-origin verifies CORS is set"
+ kill $podman_pid
+ wait $podman_pid || true
+}
+
+@test "podman system service - tcp without CORS" {
+ skip_if_remote "system service tests are meaningless over remote"
+ PORT=$(( ((RANDOM<<15)|RANDOM) % 63001 + 2000 ))
+ run_podman system service tcp:$SERVICE_TCP_HOST:$PORT -t 20 &
+ podman_pid="$!"
+ sleep 5s
+ (curl -s --max-time 10 -vvv $SERVICE_TCP_HOST:$PORT/_ping 2>&1 | grep -Eq "Access-Control-Allow-Origin:") && false || true
+ kill $podman_pid
+ wait $podman_pid || true
+}
+
+@test "podman system service - CORS enabled in logs" {
+ skip_if_remote "system service tests are meaningless over remote"
+ run_podman system service --log-level="debug" --cors="*" -t 1
+ is "$output" ".*CORS Headers were set to \*.*" "debug log confirms CORS headers set"
+}
+
+# vim: filetype=sh
diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats
index 4ef9c8b30..5ee0e0715 100644
--- a/test/system/410-selinux.bats
+++ b/test/system/410-selinux.bats
@@ -50,6 +50,18 @@ function check_label() {
check_label "--systemd=always" "container_init_t"
}
+@test "podman selinux: init container with --security-opt type" {
+ check_label "--systemd=always --security-opt=label=type:spc_t" "spc_t"
+}
+
+@test "podman selinux: init container with --security-opt level&type" {
+ check_label "--systemd=always --security-opt=label=level:s0:c1,c2 --security-opt=label=type:spc_t" "spc_t" "s0:c1,c2"
+}
+
+@test "podman selinux: init container with --security-opt level" {
+ check_label "--systemd=always --security-opt=label=level:s0:c1,c2" "container_init_t" "s0:c1,c2"
+}
+
@test "podman selinux: pid=host" {
# FIXME this test fails when run rootless with runc:
# Error: container_linux.go:367: starting container process caused: process_linux.go:495: container init caused: readonly path /proc/asound: operation not permitted: OCI permission denied
diff --git a/test/system/500-networking.bats b/test/system/500-networking.bats
index 419d325b0..6ffee7eaf 100644
--- a/test/system/500-networking.bats
+++ b/test/system/500-networking.bats
@@ -139,7 +139,7 @@ load helpers
$IMAGE nc -l -n -v -p $myport
cid="$output"
- wait_for_port 127.0.0.1 $myport
+ wait_for_output "listening on .*:$myport .*" $cid
# emit random string, and check it
teststring=$(random_string 30)
@@ -390,4 +390,89 @@ load helpers
run_podman network rm -f $netname
}
+# Test for https://github.com/containers/podman/issues/10052
+@test "podman network connect/disconnect with port forwarding" {
+ random_1=$(random_string 30)
+ HOST_PORT=12345
+ SERVER=http://127.0.0.1:$HOST_PORT
+
+ # Create a test file with random content
+ INDEX1=$PODMAN_TMPDIR/hello.txt
+ echo $random_1 > $INDEX1
+
+ local netname=testnet-$(random_string 10)
+ run_podman network create $netname
+ is "$output" ".*/cni/net.d/$netname.conflist" "output of 'network create'"
+
+ local netname2=testnet2-$(random_string 10)
+ run_podman network create $netname2
+ is "$output" ".*/cni/net.d/$netname2.conflist" "output of 'network create'"
+
+ # First, run a container in background to ensure that the rootless cni ns
+ # is not destroyed after network disconnect.
+ run_podman run -d --network $netname $IMAGE top
+ background_cid=$output
+
+ # Run a httpd container on first network with exposed port
+ run_podman run -d -p "$HOST_PORT:80" \
+ --network $netname \
+ -v $INDEX1:/var/www/index.txt:Z \
+ -w /var/www \
+ $IMAGE /bin/busybox-extras httpd -f -p 80
+ cid=$output
+
+ # Verify http contents: curl from localhost
+ run curl --max-time 3 -s $SERVER/index.txt
+ is "$output" "$random_1" "curl 127.0.0.1:/index.txt"
+
+ run_podman inspect $cid --format "{{(index .NetworkSettings.Networks \"$netname\").IPAddress}}"
+ ip="$output"
+ run_podman inspect $cid --format "{{(index .NetworkSettings.Networks \"$netname\").MacAddress}}"
+ mac="$output"
+
+ run_podman network disconnect $netname $cid
+
+ # check that we cannot curl (timeout after 3 sec)
+ run curl --max-time 3 -s $SERVER/index.txt
+ if [ "$status" -eq 0 ]; then
+ die "curl did not fail, it should have timed out or failed with non zero exit code"
+ fi
+
+ run_podman network connect $netname $cid
+
+ # curl should work again
+ run curl --max-time 3 -s $SERVER/index.txt
+ is "$output" "$random_1" "curl 127.0.0.1:/index.txt should work again"
+
+ # check that we have a new ip and mac
+ # if the ip is still the same this whole test turns into a nop
+ run_podman inspect $cid --format "{{(index .NetworkSettings.Networks \"$netname\").IPAddress}}"
+ if [[ "$output" == "$ip" ]]; then
+ die "IP address did not change after podman network disconnect/connect"
+ fi
+ run_podman inspect $cid --format "{{(index .NetworkSettings.Networks \"$netname\").MacAddress}}"
+ if [[ "$output" == "$mac" ]]; then
+ die "MAC address did not change after podman network disconnect/connect"
+ fi
+
+ # connect a second network
+ run_podman network connect $netname2 $cid
+
+ # curl should work
+ run curl --max-time 3 -s $SERVER/index.txt
+ is "$output" "$random_1" "curl 127.0.0.1:/index.txt should work"
+
+ # disconnect the first network
+ run_podman network disconnect $netname $cid
+
+ # curl should still work
+ run curl --max-time 3 -s $SERVER/index.txt
+ is "$output" "$random_1" "curl 127.0.0.1:/index.txt should still work"
+
+ # cleanup
+ run_podman stop -t 0 $cid $background_cid
+ run_podman rm -f $cid $background_cid
+ run_podman network rm -f $netname $netname2
+}
+
# vim: filetype=sh
diff --git a/test/system/helpers.bash b/test/system/helpers.bash
index 02fd7252c..bd9471ace 100644
--- a/test/system/helpers.bash
+++ b/test/system/helpers.bash
@@ -288,7 +288,7 @@ function wait_for_port() {
# Wait
while [ $_timeout -gt 0 ]; do
- { exec 3<> /dev/tcp/$host/$port; } &>/dev/null && return
+ { exec 5<> /dev/tcp/$host/$port; } &>/dev/null && return
sleep 1
_timeout=$(( $_timeout - 1 ))
done
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-02-23 11:09:20 +0000