diff options
Diffstat (limited to 'test')
| -rw-r--r-- | test/e2e/run_volume_test.go | 28 | ||||
| -rw-r--r-- | test/system/030-run.bats | 18 |
2 files changed, 44 insertions, 2 deletions
diff --git a/test/e2e/run_volume_test.go b/test/e2e/run_volume_test.go index abb93a149..5bad6744b 100644 --- a/test/e2e/run_volume_test.go +++ b/test/e2e/run_volume_test.go @@ -162,4 +162,32 @@ var _ = Describe("Podman run with volumes", func() { Expect(session.OutputToString()).To(ContainSubstring("/testvol1")) Expect(session.OutputToString()).To(ContainSubstring("/testvol2")) }) + + It("podman run with volumes and suid/dev/exec options", func() { + mountPath := filepath.Join(podmanTest.TempDir, "secrets") + os.Mkdir(mountPath, 0755) + session := podmanTest.Podman([]string{"run", "--rm", "-v", fmt.Sprintf("%s:/run/test:suid,dev,exec", mountPath), ALPINE, "grep", "/run/test", "/proc/self/mountinfo"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + found, matches := session.GrepString("/run/test") + Expect(found).Should(BeTrue()) + Expect(matches[0]).To(Not(ContainSubstring("noexec"))) + Expect(matches[0]).To(Not(ContainSubstring("nodev"))) + Expect(matches[0]).To(Not(ContainSubstring("nosuid"))) + + session = podmanTest.Podman([]string{"run", "--rm", "--tmpfs", "/run/test:suid,dev,exec", ALPINE, "grep", "/run/test", "/proc/self/mountinfo"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + found, matches = session.GrepString("/run/test") + Expect(found).Should(BeTrue()) + Expect(matches[0]).To(Not(ContainSubstring("noexec"))) + Expect(matches[0]).To(Not(ContainSubstring("nodev"))) + Expect(matches[0]).To(Not(ContainSubstring("nosuid"))) + }) + + It("podman run with noexec can't exec", func() { + session := podmanTest.Podman([]string{"run", "--rm", "-v", "/bin:/hostbin:noexec", ALPINE, "/hostbin/ls", "/"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Not(Equal(0))) + }) }) diff --git a/test/system/030-run.bats b/test/system/030-run.bats index 9e609b434..f279a0c75 100644 --- a/test/system/030-run.bats +++ b/test/system/030-run.bats @@ -4,13 +4,27 @@ load helpers @test "podman run - basic tests" { rand=$(random_string 30) + + # 2019-09 Fedora 31 and rawhide (32) are switching from runc to crun + # because of cgroups v2; crun emits different error messages. + # Default to runc: + err_no_such_cmd="Error: .*: starting container process caused .*exec:.*stat /no/such/command: no such file or directory" + err_no_exec_dir="Error: .*: starting container process caused .*exec:.* permission denied" + + # ...but check the configured runtime engine, and switch to crun as needed + run_podman info --format '{{ .host.OCIRuntime.path }}' + if expr "$output" : ".*/crun"; then + err_no_such_cmd="Error: executable file not found in \$PATH: No such file or directory: OCI runtime command not found error" + err_no_exec_dir="Error: open executable: Operation not permitted: OCI runtime permission denied error" + fi + tests=" true | 0 | false | 1 | sh -c 'exit 32' | 32 | echo $rand | 0 | $rand -/no/such/command | 127 | Error: .*: starting container process caused .*exec:.*stat /no/such/command: no such file or directory -/etc | 126 | Error: .*: starting container process caused .*exec:.* permission denied +/no/such/command | 127 | $err_no_such_cmd +/etc | 126 | $err_no_exec_dir " while read cmd expected_rc expected_output; do |