github.com/containers/podman/v4@v4.9.4/test/e2e/run_security_labels_test.go (about) 1 package integration 2 3 import ( 4 "fmt" 5 "strings" 6 7 . "github.com/containers/podman/v4/test/utils" 8 . "github.com/onsi/ginkgo/v2" 9 . "github.com/onsi/gomega" 10 . "github.com/onsi/gomega/gexec" 11 ) 12 13 var _ = Describe("Podman generate kube", func() { 14 15 It("podman empty security labels", func() { 16 test1 := podmanTest.Podman([]string{"create", "--label", "io.containers.capabilities=", "--name", "test1", "alpine", "echo", "test1"}) 17 test1.WaitWithDefaultTimeout() 18 Expect(test1).Should(ExitCleanly()) 19 20 inspect := podmanTest.Podman([]string{"inspect", "test1"}) 21 inspect.WaitWithDefaultTimeout() 22 Expect(inspect).Should(ExitCleanly()) 23 24 ctr := inspect.InspectContainerToJSON() 25 Expect(ctr[0].EffectiveCaps).To(BeNil()) 26 27 test2 := podmanTest.Podman([]string{"run", "--label", "io.containers.capabilities=", "alpine", "grep", "^CapEff", "/proc/self/status"}) 28 test2.WaitWithDefaultTimeout() 29 Expect(test2.OutputToString()).To(ContainSubstring("0000000000000000")) 30 }) 31 32 It("podman security labels", func() { 33 test1 := podmanTest.Podman([]string{"create", "--label", "io.containers.capabilities=setuid,setgid", "--name", "test1", "alpine", "echo", "test1"}) 34 test1.WaitWithDefaultTimeout() 35 Expect(test1).Should(ExitCleanly()) 36 37 inspect := podmanTest.Podman([]string{"inspect", "test1"}) 38 inspect.WaitWithDefaultTimeout() 39 Expect(inspect).Should(ExitCleanly()) 40 41 ctr := inspect.InspectContainerToJSON() 42 caps := strings.Join(ctr[0].EffectiveCaps, ",") 43 Expect(caps).To(Equal("CAP_SETGID,CAP_SETUID")) 44 }) 45 46 It("podman bad security labels", func() { 47 test1 := podmanTest.Podman([]string{"create", "--label", "io.containers.capabilities=sys_admin", "--name", "test1", "alpine", "echo", "test1"}) 48 test1.WaitWithDefaultTimeout() 49 Expect(test1).Should(Exit(0)) 50 stderr := test1.ErrorToString() 51 if IsRemote() { 52 Expect(stderr).To(BeEmpty()) 53 } else { 54 Expect(stderr).To(ContainSubstring("Capabilities requested by user or image are not allowed by default: \\\"CAP_SYS_ADMIN\\\"")) 55 } 56 57 inspect := podmanTest.Podman([]string{"inspect", "test1"}) 58 inspect.WaitWithDefaultTimeout() 59 Expect(inspect).Should(ExitCleanly()) 60 61 ctr := inspect.InspectContainerToJSON() 62 caps := strings.Join(ctr[0].EffectiveCaps, ",") 63 Expect(caps).To(Not(Equal("CAP_SYS_ADMIN"))) 64 }) 65 66 It("podman --cap-add sys_admin security labels", func() { 67 test1 := podmanTest.Podman([]string{"create", "--cap-add", "SYS_ADMIN", "--label", "io.containers.capabilities=sys_admin", "--name", "test1", "alpine", "echo", "test1"}) 68 test1.WaitWithDefaultTimeout() 69 Expect(test1).Should(ExitCleanly()) 70 71 inspect := podmanTest.Podman([]string{"inspect", "test1"}) 72 inspect.WaitWithDefaultTimeout() 73 Expect(inspect).Should(ExitCleanly()) 74 75 ctr := inspect.InspectContainerToJSON() 76 caps := strings.Join(ctr[0].EffectiveCaps, ",") 77 Expect(caps).To(Equal("CAP_SYS_ADMIN")) 78 }) 79 80 It("podman --cap-drop all sys_admin security labels", func() { 81 test1 := podmanTest.Podman([]string{"create", "--cap-drop", "all", "--label", "io.containers.capabilities=sys_admin", "--name", "test1", "alpine", "echo", "test1"}) 82 test1.WaitWithDefaultTimeout() 83 Expect(test1).Should(Exit(0)) 84 stderr := test1.ErrorToString() 85 if IsRemote() { 86 Expect(stderr).To(BeEmpty()) 87 } else { 88 Expect(stderr).To(ContainSubstring("Capabilities requested by user or image are not allowed by default: \\\"CAP_SYS_ADMIN\\\"")) 89 } 90 91 inspect := podmanTest.Podman([]string{"inspect", "test1"}) 92 inspect.WaitWithDefaultTimeout() 93 Expect(inspect).Should(ExitCleanly()) 94 95 ctr := inspect.InspectContainerToJSON() 96 caps := strings.Join(ctr[0].EffectiveCaps, ",") 97 Expect(caps).To(Equal("")) 98 }) 99 100 It("podman security labels from image", func() { 101 test1 := podmanTest.Podman([]string{"create", "--name", "test1", "alpine", "echo", "test1"}) 102 test1.WaitWithDefaultTimeout() 103 Expect(test1).Should(ExitCleanly()) 104 105 commit := podmanTest.Podman([]string{"commit", "-q", "-c", "label=io.containers.capabilities=setgid,setuid", "test1", "image1"}) 106 commit.WaitWithDefaultTimeout() 107 Expect(commit).Should(ExitCleanly()) 108 109 image1 := podmanTest.Podman([]string{"create", "--name", "test2", "image1", "echo", "test1"}) 110 image1.WaitWithDefaultTimeout() 111 Expect(image1).Should(ExitCleanly()) 112 113 inspect := podmanTest.Podman([]string{"inspect", "test2"}) 114 inspect.WaitWithDefaultTimeout() 115 Expect(inspect).Should(ExitCleanly()) 116 117 ctr := inspect.InspectContainerToJSON() 118 caps := strings.Join(ctr[0].EffectiveCaps, ",") 119 Expect(caps).To(Equal("CAP_SETGID,CAP_SETUID")) 120 121 }) 122 123 It("podman --privileged security labels", func() { 124 pull := podmanTest.Podman([]string{"create", "--privileged", "--label", "io.containers.capabilities=setuid,setgid", "--name", "test1", "alpine", "echo", "test"}) 125 pull.WaitWithDefaultTimeout() 126 Expect(pull).Should(ExitCleanly()) 127 128 inspect := podmanTest.Podman([]string{"inspect", "test1"}) 129 inspect.WaitWithDefaultTimeout() 130 Expect(inspect).Should(ExitCleanly()) 131 132 ctr := inspect.InspectContainerToJSON() 133 caps := strings.Join(ctr[0].EffectiveCaps, ",") 134 Expect(caps).To(Not(Equal("CAP_SETUID,CAP_SETGID"))) 135 }) 136 137 It("podman container runlabel (podman --version)", func() { 138 SkipIfRemote("runlabel not supported on podman-remote") 139 PodmanDockerfile := fmt.Sprintf(` 140 FROM %s 141 LABEL io.containers.capabilities=chown,kill`, ALPINE) 142 143 image := "podman-caps:podman" 144 podmanTest.BuildImage(PodmanDockerfile, image, "false") 145 146 test1 := podmanTest.Podman([]string{"create", "--name", "test1", image, "echo", "test1"}) 147 test1.WaitWithDefaultTimeout() 148 Expect(test1).Should(ExitCleanly()) 149 150 inspect := podmanTest.Podman([]string{"inspect", "test1"}) 151 inspect.WaitWithDefaultTimeout() 152 Expect(inspect).Should(ExitCleanly()) 153 154 ctr := inspect.InspectContainerToJSON() 155 caps := strings.Join(ctr[0].EffectiveCaps, ",") 156 Expect(caps).To(Equal("CAP_CHOWN,CAP_KILL")) 157 }) 158 159 })