containers
/
automation-tests
mirror of https://github.com/containers/automation-tests.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8863 from mgoltzsche/fix_seccomp_when_privileged 

Disable seccomp by default when creating a privileged container.
This commit is contained in:
OpenShift Merge Robot 2021-01-04 14:49:41 +01:00 committed by GitHub
parent 23f25b8261 bd35792b0c
commit 8e4d19da15
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/specgen/generate/security.go
View File

@ -172,7 +172,7 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
// Clear default Seccomp profile from Generator for unconfined containers // Clear default Seccomp profile from Generator for unconfined containers
// and privileged containers which do not specify a seccomp profile. // and privileged containers which do not specify a seccomp profile.
if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) { if s.SeccompProfilePath == "unconfined" || (s.Privileged && (s.SeccompProfilePath == "" || s.SeccompProfilePath == config.SeccompOverridePath || s.SeccompProfilePath == config.SeccompDefaultPath)) {
configSpec.Linux.Seccomp = nil configSpec.Linux.Seccomp = nil
} }

9
test/e2e/run_privileged_test.go
View File

@ -110,6 +110,15 @@ var _ = Describe("Podman privileged container tests", func() {
Expect("0000000000000000").To(Equal(capEff[1])) Expect("0000000000000000").To(Equal(capEff[1]))
}) })
It("podman privileged should disable seccomp by default", func() {
hostSeccomp := SystemExec("grep", []string{"-Ei", "^Seccomp:\\s+0$", "/proc/self/status"})
Expect(hostSeccomp.ExitCode()).To(Equal(0))
session := podmanTest.Podman([]string{"run", "--privileged", ALPINE, "grep", "-Ei", "^Seccomp:\\s+0$", "/proc/self/status"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
})
It("podman non-privileged should have very few devices", func() { It("podman non-privileged should have very few devices", func() {
session := podmanTest.Podman([]string{"run", "-t", "busybox", "ls", "-l", "/dev"}) session := podmanTest.Podman([]string{"run", "-t", "busybox", "ls", "-l", "/dev"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()