From 1bbeadae72603c44932d46ade275219dbf718950 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 29 Jun 2021 13:19:42 -0700 Subject: [PATCH] tests/int/no_pivot: fix for new kernels The test is failing like this: not ok 70 runc run --no-pivot must not expose bare /proc # (in test file tests/integration/no_pivot.bats, line 20) # `[[ "$output" == *"mount: permission denied"* ]]' failed # runc spec (status=0): # # runc run --no-pivot test_no_pivot (status=1): # unshare: write error: Operation not permitted Apparently, a recent kernel commit db2e718a47984b9d prevents root from doing unshare -r unless it has CAP_SETFPCAP. Add the capability for this specific test. Signed-off-by: Kir Kolyshkin --- tests/integration/no_pivot.bats | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/integration/no_pivot.bats b/tests/integration/no_pivot.bats index 4baf0bf2d..30dbe7f73 100644 --- a/tests/integration/no_pivot.bats +++ b/tests/integration/no_pivot.bats @@ -13,7 +13,9 @@ function teardown() { @test "runc run --no-pivot must not expose bare /proc" { requires root - update_config '.process.args |= ["unshare", "-mrpf", "sh", "-euxc", "mount -t proc none /proc && echo h > /proc/sysrq-trigger"]' + update_config ' .process.args |= ["unshare", "-mrpf", "sh", "-euxc", "mount -t proc none /proc && echo h > /proc/sysrq-trigger"] + | .process.capabilities.bounding += ["CAP_SETFCAP"] + | .process.capabilities.permitted += ["CAP_SETFCAP"]' runc run --no-pivot test_no_pivot [ "$status" -eq 1 ]