From f5c345c30c6b36bcbcb1462bddf30efbbcde57b4 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Tue, 20 Oct 2020 23:17:11 +0900
Subject: [PATCH] test: add "runc run --no-pivot must not expose bare /proc"

For preventing regression like #2647

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 tests/integration/no_pivot.bats | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 tests/integration/no_pivot.bats

diff --git a/tests/integration/no_pivot.bats b/tests/integration/no_pivot.bats
new file mode 100644
index 000000000..844a0ca57
--- /dev/null
+++ b/tests/integration/no_pivot.bats
@@ -0,0 +1,22 @@
+#!/usr/bin/env bats
+
+load helpers
+
+function setup() {
+	teardown_busybox
+	setup_busybox
+}
+
+function teardown() {
+	teardown_busybox
+}
+
+@test "runc run --no-pivot must not expose bare /proc" {
+	requires root
+
+	update_config '.process.args |= ["unshare", "-mrpf", "sh", "-euxc", "mount -t proc none /proc && echo h > /proc/sysrq-trigger"]'
+
+	runc run --no-pivot test_no_pivot
+	[ "$status" -eq 1 ]
+	[[ "$output" == *"mount: permission denied"* ]]
+}