106 lines
3.0 KiB
Go
106 lines
3.0 KiB
Go
package capabilities
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestAllCapabilities(t *testing.T) {
|
|
caps := AllCapabilities()
|
|
assert.True(t, len(caps) > 0)
|
|
err := ValidateCapabilities(caps)
|
|
require.Nil(t, err)
|
|
}
|
|
|
|
func TestBoundingCapabilities(t *testing.T) {
|
|
caps, err := BoundingSet()
|
|
require.Nil(t, err)
|
|
assert.True(t, len(caps) > 0)
|
|
}
|
|
|
|
func TestMergeCapabilitiesDropVerify(t *testing.T) {
|
|
adds := []string{"CAP_SETUID", "CAP_SYS_ADMIN"}
|
|
drops := []string{"CAP_NET_ADMIN", "cap_chown"}
|
|
base := []string{"CHOWN"}
|
|
caps, err := MergeCapabilities(base, adds, drops)
|
|
require.Nil(t, err)
|
|
assert.Equal(t, []string{"CAP_SETUID", "CAP_SYS_ADMIN"}, caps)
|
|
}
|
|
|
|
func TestMergeCapabilitiesDropAddConflict(t *testing.T) {
|
|
adds := []string{"CAP_SYS_ADMIN", "NET_ADMIN"}
|
|
drops := []string{"CAP_NET_ADMIN", "cap_chown"}
|
|
base := []string{"CHOWN"}
|
|
_, err := MergeCapabilities(base, adds, drops)
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestMergeCapabilitiesDrop(t *testing.T) {
|
|
adds := []string{"CAP_SYS_ADMIN"}
|
|
drops := []string{"CAP_NET_ADMIN", "cap_chown"}
|
|
base := []string{"CHOWN"}
|
|
caps, err := MergeCapabilities(base, adds, drops)
|
|
require.Nil(t, err)
|
|
assert.Equal(t, []string{"CAP_SYS_ADMIN"}, caps)
|
|
}
|
|
|
|
func TestMergeCapabilitiesDropAll(t *testing.T) {
|
|
adds := []string{"CAP_CHOWN", "CAP_NET_ADMIN", "CAP_SYS_ADMIN"}
|
|
drops := []string{"all"}
|
|
base := []string{"CAP_SETUID"}
|
|
caps, err := MergeCapabilities(base, adds, drops)
|
|
require.Nil(t, err)
|
|
assert.Equal(t, caps, adds)
|
|
}
|
|
|
|
func TestMergeCapabilitiesAddAll(t *testing.T) {
|
|
base := []string{"CAP_SYS_ADMIN", "CAP_NET_ADMIN", "CAP_CHOWN"}
|
|
adds := []string{"all"}
|
|
drops := []string{}
|
|
caps, err := MergeCapabilities(base, adds, drops)
|
|
require.Nil(t, err)
|
|
allCaps, err := BoundingSet()
|
|
require.Nil(t, err)
|
|
assert.Equal(t, caps, allCaps)
|
|
|
|
drops = []string{"CAP_SETUID", "CAP_CHOWN"}
|
|
caps, err = MergeCapabilities(base, adds, drops)
|
|
require.Nil(t, err)
|
|
assert.NotEqual(t, caps, allCaps)
|
|
assert.False(t, stringInSlice("CAP_SETUID", caps))
|
|
assert.False(t, stringInSlice("CAP_CHOWN", caps))
|
|
}
|
|
|
|
func TestMergeCapabilitiesAddAllDropAll(t *testing.T) {
|
|
base := []string{"CAP_SYS_ADMIN", "CAP_NET_ADMIN", "CAP_CHOWN"}
|
|
adds := []string{"all"}
|
|
drops := []string{"all"}
|
|
_, err := MergeCapabilities(base, adds, drops)
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestNormalizeCapabilities(t *testing.T) {
|
|
strSlice := []string{"SYS_ADMIN", "net_admin", "CAP_CHOWN"}
|
|
caps, err := NormalizeCapabilities(strSlice)
|
|
require.Nil(t, err)
|
|
err = ValidateCapabilities(caps)
|
|
require.Nil(t, err)
|
|
strSlice = []string{"no_ADMIN", "net_admin", "CAP_CHMOD"}
|
|
_, err = NormalizeCapabilities(strSlice)
|
|
assert.Error(t, err)
|
|
}
|
|
|
|
func TestValidateCapabilities(t *testing.T) {
|
|
strSlice := []string{"CAP_SYS_ADMIN", "CAP_NET_ADMIN"}
|
|
err := ValidateCapabilities(strSlice)
|
|
require.Nil(t, err)
|
|
}
|
|
|
|
func TestValidateCapabilitiesBadCapabilities(t *testing.T) {
|
|
strSlice := []string{"CAP_SYS_ADMIN", "NO_ADMIN"}
|
|
err := ValidateCapabilities(strSlice)
|
|
assert.Error(t, err)
|
|
}
|