opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-24 15:03:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

specgen: add support for ambient capabilities

Browse Source 
if the kernel supports ambient capabilities (Linux 4.3+), also set
them when running with euid != 0.

This is different that what Moby does, as ambient capabilities are
never set.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2020-11-02 14:26:30 +01:00
parent c1ffdfbd78
commit bce8f851c1
3 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
test/e2e/run_test.go
View File

@ -315,6 +315,21 @@ var _ = Describe("Podman run", func() {
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(ContainSubstring("00000000a80425fb"))
session = podmanTest.Podman([]string{"run", "--user=1000:1000", "--cap-add=DAC_OVERRIDE", "--rm", ALPINE, "grep", "CapAmb", "/proc/self/status"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(ContainSubstring("0000000000000002"))
session = podmanTest.Podman([]string{"run", "--user=1000:1000", "--rm", ALPINE, "grep", "CapAmb", "/proc/self/status"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(ContainSubstring("0000000000000000"))
session = podmanTest.Podman([]string{"run", "--user=0", "--cap-add=DAC_OVERRIDE", "--rm", ALPINE, "grep", "CapAmb", "/proc/self/status"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(ContainSubstring("0000000000000000"))
})
It("podman run user capabilities test with image", func() {