package integration import ( "os" "strconv" "strings" . "github.com/containers/podman/v4/test/utils" . "github.com/onsi/ginkgo" . "github.com/onsi/gomega" . "github.com/onsi/gomega/gexec" "github.com/syndtr/gocapability/capability" ) // helper function for confirming that container capabilities are equal // to those of the host, but only to the extent of caps we (podman) // know about at compile time. That is: the kernel may have more caps // available than we are aware of, leading to host=FFF... and ctr=3FF... // because the latter is all we request. Accept that. func containerCapMatchesHost(ctrCap string, hostCap string) { if isRootless() { return } ctrCapN, err := strconv.ParseUint(ctrCap, 16, 64) Expect(err).NotTo(HaveOccurred(), "Error parsing %q as hex", ctrCap) hostCapN, err := strconv.ParseUint(hostCap, 16, 64) Expect(err).NotTo(HaveOccurred(), "Error parsing %q as hex", hostCap) // host caps can never be zero (except rootless). // and host caps must always be a superset (inclusive) of container Expect(hostCapN).To(BeNumerically(">", 0), "host cap %q should be nonzero", hostCap) Expect(hostCapN).To(BeNumerically(">=", ctrCapN), "host cap %q should never be less than container cap %q", hostCap, ctrCap) hostCapMasked := hostCapN & (1<", 20)) }) It("podman privileged should restart after host devices change", func() { containerName := "privileged-restart-test" SkipIfRootless("Cannot create devices in /dev in rootless mode") Expect(os.MkdirAll("/dev/foodevdir", os.ModePerm)).To(BeNil()) mknod := SystemExec("mknod", []string{"/dev/foodevdir/null", "c", "1", "3"}) mknod.WaitWithDefaultTimeout() Expect(mknod).Should(Exit(0)) session := podmanTest.Podman([]string{"run", "--name=" + containerName, "--privileged", "-it", fedoraMinimal, "ls", "/dev"}) session.WaitWithDefaultTimeout() Expect(session).Should(Exit(0)) deviceFiles := session.OutputToStringArray() os.RemoveAll("/dev/foodevdir") session = podmanTest.Podman([]string{"start", "--attach", containerName}) session.WaitWithDefaultTimeout() Expect(session).Should(Exit(0)) deviceFilesAfterRemoval := session.OutputToStringArray() Expect(deviceFiles).To(Not(Equal(deviceFilesAfterRemoval))) }) It("run no-new-privileges test", func() { // Check if our kernel is new enough k, err := IsKernelNewerThan("4.14") Expect(err).To(BeNil()) if !k { Skip("Kernel is not new enough to test this feature") } cap := SystemExec("grep", []string{"NoNewPrivs", "/proc/self/status"}) if cap.ExitCode() != 0 { Skip("Can't determine NoNewPrivs") } session := podmanTest.Podman([]string{"run", BB, "grep", "NoNewPrivs", "/proc/self/status"}) session.WaitWithDefaultTimeout() Expect(session).Should(Exit(0)) privs := strings.Split(session.OutputToString(), ":") session = podmanTest.Podman([]string{"run", "--security-opt", "no-new-privileges", BB, "grep", "NoNewPrivs", "/proc/self/status"}) session.WaitWithDefaultTimeout() Expect(session).Should(Exit(0)) noprivs := strings.Split(session.OutputToString(), ":") Expect(privs[1]).To(Not(Equal(noprivs[1]))) }) })