mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-11 06:03:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

tests/int: test for CAP_DAC_OVERRIDE

Browse Source 
This is a test case for issue reported as #3715. In short, even if a
(non-root) user that the container is run as does not have execute
permission bit set for the executable, it should still work in case runc
has the CAP_DAC_OVERRIDE capability set.

Note that since the upstream golang is also broken (see [1]), this test
will fail for Go 1.20 and 1.20.1 (fix is in Go 1.20.2 as per [2]).

[1] https://go.dev/issue/58552
[2] https://go-review.googlesource.com/c/go/+/469956

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
(cherry picked from commit 8293ef2e74)
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2023-02-13 17:27:12 -08:00
parent 840b95394b
commit d30d240b45
1 changed files with 27 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/start_hello.bats
+27
View File
@@ -37,6 +37,33 @@ function teardown() {
[[ "${output}" == *"Hello"* ]]
}
# https://github.com/opencontainers/runc/issues/3715.
#
# Fails when using Go 1.20 < 1.20.2, the reasons is https://go.dev/issue/58552.
@test "runc run as user with no exec bit but CAP_DAC_OVERRIDE set" {
requires root # Can't chown/chmod otherwise.
# Remove exec perm for everyone but owner (root).
chown 0 rootfs/bin/echo
chmod go-x rootfs/bin/echo
# Replace "uid": 0 with "uid": 1000 and do a similar thing for gid.
update_config ' (.. | select(.uid? == 0)) .uid |= 1000
| (.. | select(.gid? == 0)) .gid |= 100'
# Sanity check: make sure we can't run the container w/o CAP_DAC_OVERRIDE.
runc run test_busybox
[ "$status" -ne 0 ]
# Enable CAP_DAC_OVERRIDE.
update_config ' .process.capabilities.bounding += ["CAP_DAC_OVERRIDE"]
| .process.capabilities.effective += ["CAP_DAC_OVERRIDE"]
| .process.capabilities.permitted += ["CAP_DAC_OVERRIDE"]'
runc run test_busybox
[ "$status" -eq 0 ]
}
@test "runc run with rootfs set to ." {
cp config.json rootfs/.
rm config.json