From be9ed1cfacc19d1ad3c09e10481da445615b8b8e Mon Sep 17 00:00:00 2001 From: baude Date: Wed, 14 Feb 2018 12:51:06 -0600 Subject: Privileged containers should inherit host devices When running a privileged container, it should inherit the same devices the host has. Signed-off-by: baude Closes: #330 Approved by: mheon --- test/e2e/privileged_test.go | 76 ----------------------------------- test/e2e/run_privileged_test.go | 89 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 89 insertions(+), 76 deletions(-) delete mode 100644 test/e2e/privileged_test.go create mode 100644 test/e2e/run_privileged_test.go (limited to 'test') diff --git a/test/e2e/privileged_test.go b/test/e2e/privileged_test.go deleted file mode 100644 index b660e1b55..000000000 --- a/test/e2e/privileged_test.go +++ /dev/null @@ -1,76 +0,0 @@ -package integration - -import ( - "os" - - . "github.com/onsi/ginkgo" - . "github.com/onsi/gomega" - "strings" -) - -var _ = Describe("Podman privileged container tests", func() { - var ( - tempdir string - err error - podmanTest PodmanTest - ) - - BeforeEach(func() { - tempdir, err = CreateTempDirInTempDir() - if err != nil { - os.Exit(1) - } - podmanTest = PodmanCreate(tempdir) - podmanTest.RestoreAllArtifacts() - }) - - AfterEach(func() { - podmanTest.Cleanup() - - }) - - It("podman privileged make sure sys is mounted rw", func() { - session := podmanTest.Podman([]string{"run", "--privileged", "busybox", "mount"}) - session.WaitWithDefaultTimeout() - Expect(session.ExitCode()).To(Equal(0)) - ok, lines := session.GrepString("sysfs") - Expect(ok).To(BeTrue()) - Expect(lines[0]).To(ContainSubstring("sysfs (rw,")) - }) - - It("podman privileged CapEff", func() { - cap := podmanTest.SystemExec("grep", []string{"CapEff", "/proc/self/status"}) - cap.WaitWithDefaultTimeout() - Expect(cap.ExitCode()).To(Equal(0)) - - session := podmanTest.Podman([]string{"run", "--privileged", "busybox", "grep", "CapEff", "/proc/self/status"}) - session.WaitWithDefaultTimeout() - Expect(session.ExitCode()).To(Equal(0)) - Expect(session.OutputToString()).To(Equal(cap.OutputToString())) - }) - - It("podman cap-add CapEff", func() { - cap := podmanTest.SystemExec("grep", []string{"CapEff", "/proc/self/status"}) - cap.WaitWithDefaultTimeout() - Expect(cap.ExitCode()).To(Equal(0)) - - session := podmanTest.Podman([]string{"run", "--cap-add", "all", "busybox", "grep", "CapEff", "/proc/self/status"}) - session.WaitWithDefaultTimeout() - Expect(session.ExitCode()).To(Equal(0)) - Expect(session.OutputToString()).To(Equal(cap.OutputToString())) - }) - - It("podman cap-drop CapEff", func() { - cap := podmanTest.SystemExec("grep", []string{"CapAmb", "/proc/self/status"}) - cap.WaitWithDefaultTimeout() - Expect(cap.ExitCode()).To(Equal(0)) - session := podmanTest.Podman([]string{"run", "--cap-drop", "all", "busybox", "grep", "CapEff", "/proc/self/status"}) - session.WaitWithDefaultTimeout() - Expect(session.ExitCode()).To(Equal(0)) - - capAmp := strings.Split(cap.OutputToString(), " ") - capEff := strings.Split(session.OutputToString(), " ") - Expect(capAmp[1]).To(Equal(capEff[1])) - }) - -}) diff --git a/test/e2e/run_privileged_test.go b/test/e2e/run_privileged_test.go new file mode 100644 index 000000000..b53be15f0 --- /dev/null +++ b/test/e2e/run_privileged_test.go @@ -0,0 +1,89 @@ +package integration + +import ( + "os" + + . "github.com/onsi/ginkgo" + . "github.com/onsi/gomega" + "strings" +) + +var _ = Describe("Podman privileged container tests", func() { + var ( + tempdir string + err error + podmanTest PodmanTest + ) + + BeforeEach(func() { + tempdir, err = CreateTempDirInTempDir() + if err != nil { + os.Exit(1) + } + podmanTest = PodmanCreate(tempdir) + podmanTest.RestoreAllArtifacts() + }) + + AfterEach(func() { + podmanTest.Cleanup() + + }) + + It("podman privileged make sure sys is mounted rw", func() { + session := podmanTest.Podman([]string{"run", "--privileged", "busybox", "mount"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + ok, lines := session.GrepString("sysfs") + Expect(ok).To(BeTrue()) + Expect(lines[0]).To(ContainSubstring("sysfs (rw,")) + }) + + It("podman privileged CapEff", func() { + cap := podmanTest.SystemExec("grep", []string{"CapEff", "/proc/self/status"}) + cap.WaitWithDefaultTimeout() + Expect(cap.ExitCode()).To(Equal(0)) + + session := podmanTest.Podman([]string{"run", "--privileged", "busybox", "grep", "CapEff", "/proc/self/status"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + Expect(session.OutputToString()).To(Equal(cap.OutputToString())) + }) + + It("podman cap-add CapEff", func() { + cap := podmanTest.SystemExec("grep", []string{"CapEff", "/proc/self/status"}) + cap.WaitWithDefaultTimeout() + Expect(cap.ExitCode()).To(Equal(0)) + + session := podmanTest.Podman([]string{"run", "--cap-add", "all", "busybox", "grep", "CapEff", "/proc/self/status"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + Expect(session.OutputToString()).To(Equal(cap.OutputToString())) + }) + + It("podman cap-drop CapEff", func() { + cap := podmanTest.SystemExec("grep", []string{"CapAmb", "/proc/self/status"}) + cap.WaitWithDefaultTimeout() + Expect(cap.ExitCode()).To(Equal(0)) + session := podmanTest.Podman([]string{"run", "--cap-drop", "all", "busybox", "grep", "CapEff", "/proc/self/status"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + + capAmp := strings.Split(cap.OutputToString(), " ") + capEff := strings.Split(session.OutputToString(), " ") + Expect(capAmp[1]).To(Equal(capEff[1])) + }) + + It("podman non-privileged should have very few devices", func() { + session := podmanTest.Podman([]string{"run", "busybox", "ls", "-l", "/dev"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + Expect(len(session.OutputToStringArray())).To(Equal(18)) + }) + + It("podman privileged should inherit host devices", func() { + session := podmanTest.Podman([]string{"run", "--privileged", ALPINE, "ls", "-l", "/dev"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + Expect(len(session.OutputToStringArray())).To(BeNumerically(">", 20)) + }) +}) -- cgit v1.2.3-54-g00ecf