mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

test join other container userns with selinux enabled

Browse Source 
Signed-off-by: lifubang <lifubang@acmcoder.com>
This commit is contained in:
lifubang
2024-10-25 14:01:05 +08:00
parent c78f3f2ea0
commit 34a928550f
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/userns.bats
+20
View File
@@ -125,6 +125,26 @@ function teardown() {
fi
}
# issue: https://github.com/opencontainers/runc/issues/4466
@test "userns join other container userns[selinux enabled]" {
if ! selinuxenabled; then
skip "requires SELinux enabled and in enforcing mode"
fi
# Create a detached container with the id-mapping we want.
update_config '.process.args = ["sleep", "infinity"]'
runc run -d --console-socket "$CONSOLE_SOCKET" target_userns
[ "$status" -eq 0 ]
# Configure our container to attach to the first container's userns.
target_pid="$(__runc state target_userns | jq .pid)"
update_config '.linux.namespaces |= map(if .type == "user" then (.path = "/proc/'"$target_pid"'/ns/" + .type) else . end)
| del(.linux.uidMappings)
| del(.linux.gidMappings)
| .linux.mountLabel="system_u:object_r:container_file_t:s0:c344,c805"'
runc run -d --console-socket "$CONSOLE_SOCKET" in_userns
[ "$status" -eq 0 ]
}
@test "userns join other container userns [bind-mounted nsfd]" {
requires root