github.com/wozhu6104/docker@v20.10.10+incompatible/daemon/exec_linux_test.go (about) 1 // +build linux 2 3 package daemon 4 5 import ( 6 "testing" 7 8 containertypes "github.com/docker/docker/api/types/container" 9 "github.com/docker/docker/container" 10 "github.com/docker/docker/daemon/exec" 11 "github.com/opencontainers/runc/libcontainer/apparmor" 12 specs "github.com/opencontainers/runtime-spec/specs-go" 13 "gotest.tools/v3/assert" 14 ) 15 16 func TestExecSetPlatformOpt(t *testing.T) { 17 if !apparmor.IsEnabled() { 18 t.Skip("requires AppArmor to be enabled") 19 } 20 d := &Daemon{} 21 c := &container.Container{AppArmorProfile: "my-custom-profile"} 22 ec := &exec.Config{} 23 p := &specs.Process{} 24 25 err := d.execSetPlatformOpt(c, ec, p) 26 assert.NilError(t, err) 27 assert.Equal(t, "my-custom-profile", p.ApparmorProfile) 28 } 29 30 // TestExecSetPlatformOptPrivileged verifies that `docker exec --privileged` 31 // does not disable AppArmor profiles. Exec currently inherits the `Privileged` 32 // configuration of the container. See https://github.com/moby/moby/pull/31773#discussion_r105586900 33 // 34 // This behavior may change in future, but test for the behavior to prevent it 35 // from being changed accidentally. 36 func TestExecSetPlatformOptPrivileged(t *testing.T) { 37 if !apparmor.IsEnabled() { 38 t.Skip("requires AppArmor to be enabled") 39 } 40 d := &Daemon{} 41 c := &container.Container{AppArmorProfile: "my-custom-profile"} 42 ec := &exec.Config{Privileged: true} 43 p := &specs.Process{} 44 45 err := d.execSetPlatformOpt(c, ec, p) 46 assert.NilError(t, err) 47 assert.Equal(t, "my-custom-profile", p.ApparmorProfile) 48 49 c.HostConfig = &containertypes.HostConfig{Privileged: true} 50 err = d.execSetPlatformOpt(c, ec, p) 51 assert.NilError(t, err) 52 assert.Equal(t, unconfinedAppArmorProfile, p.ApparmorProfile) 53 }