mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
tests: Add comment to clarify intent of seccomp-notify tests
While doing the previous fix, I went over all the tests in this file and made sure they were named correctly. This patch just adds a small sentence to clarify the intent, and does some minor improvements to some other test names. Signed-off-by: Rodrigo Campos <rodrigoca@microsoft.com>
This commit is contained in:
@@ -42,6 +42,7 @@ function scmp_act_notify_template() {
|
||||
# noNewPrivileges, for this reason many of the following cases are tested with
|
||||
# both values.
|
||||
|
||||
# Test basic actions handled by the agent work fine. noNewPrivileges FALSE.
|
||||
@test "runc run [seccomp] (SCMP_ACT_NOTIFY noNewPrivileges false)" {
|
||||
scmp_act_notify_template "mkdir /dev/shm/foo && stat /dev/shm/foo-bar" false '"mkdir"'
|
||||
|
||||
@@ -49,6 +50,7 @@ function scmp_act_notify_template() {
|
||||
[ "$status" -eq 0 ]
|
||||
}
|
||||
|
||||
# Test basic actions handled by the agent work fine. noNewPrivileges TRUE.
|
||||
@test "runc run [seccomp] (SCMP_ACT_NOTIFY noNewPrivileges true)" {
|
||||
scmp_act_notify_template "mkdir /dev/shm/foo && stat /dev/shm/foo-bar" true '"mkdir"'
|
||||
|
||||
@@ -56,6 +58,7 @@ function scmp_act_notify_template() {
|
||||
[ "$status" -eq 0 ]
|
||||
}
|
||||
|
||||
# Test actions not-handled by the agent work fine. noNewPrivileges FALSE.
|
||||
@test "runc exec [seccomp] (SCMP_ACT_NOTIFY noNewPrivileges false)" {
|
||||
requires root
|
||||
|
||||
@@ -68,6 +71,7 @@ function scmp_act_notify_template() {
|
||||
[ "$status" -eq 0 ]
|
||||
}
|
||||
|
||||
# Test actions not-handled by the agent work fine. noNewPrivileges TRUE.
|
||||
@test "runc exec [seccomp] (SCMP_ACT_NOTIFY noNewPrivileges true)" {
|
||||
requires root
|
||||
|
||||
@@ -78,6 +82,7 @@ function scmp_act_notify_template() {
|
||||
[ "$status" -eq 0 ]
|
||||
}
|
||||
|
||||
# Test important syscalls (some might be executed by runc) work fine when handled by the agent. noNewPrivileges FALSE.
|
||||
@test "runc run [seccomp] (SCMP_ACT_NOTIFY important syscalls noNewPrivileges false)" {
|
||||
scmp_act_notify_template "/bin/true" false '"execve","openat","open","read","close"'
|
||||
|
||||
@@ -85,6 +90,7 @@ function scmp_act_notify_template() {
|
||||
[ "$status" -eq 0 ]
|
||||
}
|
||||
|
||||
# Test important syscalls (some might be executed by runc) work fine when handled by the agent. noNewPrivileges TRUE.
|
||||
@test "runc run [seccomp] (SCMP_ACT_NOTIFY important syscalls noNewPrivileges true)" {
|
||||
scmp_act_notify_template "/bin/true" true '"execve","openat","open","read","close"'
|
||||
|
||||
@@ -105,7 +111,8 @@ function scmp_act_notify_template() {
|
||||
[ "$status" -eq 0 ]
|
||||
}
|
||||
|
||||
@test "runc run [seccomp] (SCMP_ACT_NOTIFY empty listener path)" {
|
||||
# Ensure listenerPath is present if the profile uses seccomp notify actions.
|
||||
@test "runc run [seccomp] (SCMP_ACT_NOTIFY empty listener path and notify act)" {
|
||||
scmp_act_notify_template "/bin/true" false '"mkdir"'
|
||||
update_config '.linux.seccomp.listenerPath = ""'
|
||||
|
||||
@@ -113,6 +120,7 @@ function scmp_act_notify_template() {
|
||||
[ "$status" -ne 0 ]
|
||||
}
|
||||
|
||||
# Test using an invalid socket (none listening) as listenerPath fails.
|
||||
@test "runc run [seccomp] (SCMP_ACT_NOTIFY wrong listener path)" {
|
||||
scmp_act_notify_template "/bin/true" false '"mkdir"'
|
||||
update_config '.linux.seccomp.listenerPath = "/some-non-existing-listener-path.sock"'
|
||||
@@ -121,7 +129,8 @@ function scmp_act_notify_template() {
|
||||
[ "$status" -ne 0 ]
|
||||
}
|
||||
|
||||
@test "runc run [seccomp] (SCMP_ACT_NOTIFY abstract listener path)" {
|
||||
# Test using an invalid abstract socket as listenerPath fails.
|
||||
@test "runc run [seccomp] (SCMP_ACT_NOTIFY wrong abstract listener path)" {
|
||||
scmp_act_notify_template "/bin/true" false '"mkdir"'
|
||||
update_config '.linux.seccomp.listenerPath = "@mysocketishere"'
|
||||
|
||||
|
||||
Reference in New Issue
Block a user