mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Kir Kolyshkin
1bbeadae72
The test is failing like this: not ok 70 runc run --no-pivot must not expose bare /proc # (in test file tests/integration/no_pivot.bats, line 20) # `[[ "$output" == *"mount: permission denied"* ]]' failed # runc spec (status=0): # # runc run --no-pivot test_no_pivot (status=1): # unshare: write error: Operation not permitted Apparently, a recent kernel commit db2e718a47984b9d prevents root from doing unshare -r unless it has CAP_SETFPCAP. Add the capability for this specific test. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
24 lines
539 B
Bash
24 lines
539 B
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
function setup() {
|
|
setup_busybox
|
|
}
|
|
|
|
function teardown() {
|
|
teardown_bundle
|
|
}
|
|
|
|
@test "runc run --no-pivot must not expose bare /proc" {
|
|
requires root
|
|
|
|
update_config ' .process.args |= ["unshare", "-mrpf", "sh", "-euxc", "mount -t proc none /proc && echo h > /proc/sysrq-trigger"]
|
|
| .process.capabilities.bounding += ["CAP_SETFCAP"]
|
|
| .process.capabilities.permitted += ["CAP_SETFCAP"]'
|
|
|
|
runc run --no-pivot test_no_pivot
|
|
[ "$status" -eq 1 ]
|
|
[[ "$output" == *"mount: permission denied"* ]]
|
|
}
|