From 703381b4a2b1dc761ffee0d8e36b47f21ffd92c5 Mon Sep 17 00:00:00 2001
From: Giuseppe Scrivano <gscrivan@redhat.com>
Date: Tue, 29 Sep 2020 10:06:48 +0200
Subject: capabilities: always set ambient and inheritable

change capabilities handling to reflect what docker does.

Bounding: set to caplist
Inheritable: set to caplist
Effective: if uid != 0 then clear; else set to caplist
Permitted: if uid != 0 then clear; else set to caplist
Ambient: clear

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
---
 test/system/030-run.bats  | 4 ++--
 test/system/075-exec.bats | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

(limited to 'test/system')

diff --git a/test/system/030-run.bats b/test/system/030-run.bats
index b3599cc17..354c6506d 100644
--- a/test/system/030-run.bats
+++ b/test/system/030-run.bats
@@ -304,7 +304,7 @@ echo $rand        |   0 | $rand
 
 # #6991 : /etc/passwd is modifiable
 @test "podman run : --userns=keep-id: passwd file is modifiable" {
-    run_podman run -d --userns=keep-id $IMAGE sh -c 'while ! test -e /stop; do sleep 0.1; done'
+    run_podman run -d --userns=keep-id --cap-add=dac_override $IMAGE sh -c 'while ! test -e /tmp/stop; do sleep 0.1; done'
     cid="$output"
 
     # Assign a UID that is (a) not in our image /etc/passwd and (b) not
@@ -325,7 +325,7 @@ echo $rand        |   0 | $rand
     is "$output" "newuser3:x:$uid:999:$gecos:/home/newuser3:/bin/sh" \
        "newuser3 added to /etc/passwd in container"
 
-    run_podman exec $cid touch /stop
+    run_podman exec $cid touch /tmp/stop
     run_podman wait $cid
 }
 
diff --git a/test/system/075-exec.bats b/test/system/075-exec.bats
index e9db8c27e..edd7dedc4 100644
--- a/test/system/075-exec.bats
+++ b/test/system/075-exec.bats
@@ -92,14 +92,14 @@ load helpers
 # #6829 : add username to /etc/passwd inside container if --userns=keep-id
 @test "podman exec - with keep-id" {
     run_podman run -d --userns=keep-id $IMAGE sh -c \
-               "echo READY;while [ ! -f /stop ]; do sleep 1; done"
+               "echo READY;while [ ! -f /tmp/stop ]; do sleep 1; done"
     cid="$output"
     wait_for_ready $cid
 
     run_podman exec $cid id -un
     is "$output" "$(id -un)" "container is running as current user"
 
-    run_podman exec --user=$(id -un) $cid touch /stop
+    run_podman exec --user=$(id -un) $cid touch /tmp/stop
     run_podman wait $cid
     run_podman rm $cid
 }
-- 
cgit v1.2.3-54-g00ecf