From 4fd1965ab4d1395b5cc4a0e03526ef9c43f794ec Mon Sep 17 00:00:00 2001 From: Daniel J Walsh Date: Sat, 1 May 2021 05:50:31 -0400 Subject: Add filepath glob support to --security-opt unmask Want to allow users to specify --security-opt unmask=/proc/*. This allows us to run podman within podman more securely, then specifing umask=all, also gives the user more flexibilty. Signed-off-by: Daniel J Walsh --- test/e2e/run_test.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'test/e2e/run_test.go') diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go index 74bdfce2c..d8d7dab07 100644 --- a/test/e2e/run_test.go +++ b/test/e2e/run_test.go @@ -299,9 +299,17 @@ var _ = Describe("Podman run", func() { session = podmanTest.Podman([]string{"run", "-d", "--name=maskCtr5", "--security-opt", "systempaths=unconfined", ALPINE, "grep", "/proc", "/proc/self/mounts"}) session.WaitWithDefaultTimeout() Expect(session.ExitCode()).To(Equal(0)) - stdoutLines := session.OutputToStringArray() - Expect(stdoutLines).Should(HaveLen(1)) + Expect(session.OutputToStringArray()).Should(HaveLen(1)) + + session = podmanTest.Podman([]string{"run", "-d", "--security-opt", "unmask=/proc/*", ALPINE, "grep", "/proc", "/proc/self/mounts"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + Expect(session.OutputToStringArray()).Should(HaveLen(1)) + session = podmanTest.Podman([]string{"run", "--security-opt", "unmask=/proc/a*", ALPINE, "ls", "/proc/acpi"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + Expect(session.OutputToString()).To(Not(BeEmpty())) }) It("podman run security-opt unmask on /sys/fs/cgroup", func() { -- cgit v1.2.3-54-g00ecf