mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 22:37:14 +08:00
Aleksa Sarai
37581ad340
Now that runc-dmz is opt-in, we no longer need to try to detect whether SELinux would cause issues for us. We can also remove the special-purpose build-tag we added. Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
59 lines
1.5 KiB
Bash
59 lines
1.5 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
function setup() {
|
|
requires root # for chcon
|
|
if ! selinuxenabled; then
|
|
skip "requires SELinux enabled and in enforcing mode"
|
|
fi
|
|
|
|
setup_busybox
|
|
|
|
# Use a copy of runc binary with proper selinux label set.
|
|
cp "$RUNC" .
|
|
export RUNC="$PWD/runc"
|
|
chcon -u system_u -r object_r -t container_runtime_exec_t "$RUNC"
|
|
|
|
# Label container fs.
|
|
chcon -u system_u -r object_r -t container_file_t -R rootfs
|
|
|
|
# Save the start date and time for ausearch.
|
|
AU_DD="$(date +%x)"
|
|
AU_TT="$(date +%H:%M:%S)"
|
|
}
|
|
|
|
function teardown() {
|
|
teardown_bundle
|
|
# Show any avc denials.
|
|
if [[ -v AU_DD && -v AU_TT ]] && command -v ausearch &>/dev/null; then
|
|
ausearch -ts "$AU_DD" "$AU_TT" -i -m avc || true
|
|
fi
|
|
}
|
|
|
|
# Baseline test, to check that runc works with selinux enabled.
|
|
@test "runc run (no selinux label)" {
|
|
update_config ' .process.args = ["/bin/true"]'
|
|
runc run tst
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
# https://github.com/opencontainers/runc/issues/4057
|
|
@test "runc run (custom selinux label, RUNC_DMZ=true)" {
|
|
# centos-7 has an outdated container-selinux (<2.224.0) which means
|
|
# runc-dmz won't work.
|
|
exclude_os centos-7
|
|
|
|
update_config ' .process.selinuxLabel |= "system_u:system_r:container_t:s0:c4,c5"
|
|
| .process.args = ["/bin/true"]'
|
|
RUNC_DMZ=true runc run tst
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "runc run (custom selinux label)" {
|
|
update_config ' .process.selinuxLabel |= "system_u:system_r:container_t:s0:c4,c5"
|
|
| .process.args = ["/bin/true"]'
|
|
runc run tst
|
|
[ "$status" -eq 0 ]
|
|
}
|