opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-12-11 09:18:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

libpod: enforce noexec,nosuid,nodev for /dev/shm

Browse Source 
these mount flags are already used for the /dev/shm mount on the host,
but they are not set for the bind mount itself.

Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
This commit is contained in:
Giuseppe Scrivano
2022-02-02 10:03:13 +01:00
parent 6f491e21aa
commit c4dfd004ad
2 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
test/e2e/run_test.go
View File

@@ -1926,4 +1926,14 @@ WORKDIR /madethis`, BB)
Expect(session).Should(Exit(0))
Expect(session.OutputToString()).To(ContainSubstring("i686"))
})
It("podman run /dev/shm has nosuid,noexec,nodev", func() {
session := podmanTest.Podman([]string{"run", ALPINE, "grep", "/dev/shm", "/proc/self/mountinfo"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
output := session.OutputToString()
Expect(output).To(ContainSubstring("nosuid"))
Expect(output).To(ContainSubstring("noexec"))
Expect(output).To(ContainSubstring("nodev"))
})
})