runc/tests/integration/capabilities.bats at 4f9e318d71dde4d687159db5b7e09c870a94b80d · opencontainers/runc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
#!/usr/bin/env bats

load helpers

function setup() {
	setup_busybox
	update_config '.process.args = ["/bin/cat", "/proc/self/status"]'
}

function teardown() {
	teardown_bundle
}

@test "runc run no capability" {
	runc -0 run test_no_caps

	[[ "${output}" == *"CapInh:	0000000000000000"* ]]
	[[ "${output}" == *"CapAmb:	0000000000000000"* ]]
	[[ "${output}" == *"NoNewPrivs:	1"* ]]
}

@test "runc run with unknown capability" {
	update_config '.process.capabilities.bounding = ["CAP_UNKNOWN", "UNKNOWN_CAP"]'
	runc -0 run test_unknown_caps

	[[ "${output}" == *"CapInh:	0000000000000000"* ]]
	[[ "${output}" == *"CapAmb:	0000000000000000"* ]]
	[[ "${output}" == *"NoNewPrivs:	1"* ]]
}

@test "runc run with new privileges" {
	update_config '.process.noNewPrivileges = false'
	runc -0 run test_new_privileges

	[[ "${output}" == *"CapInh:	0000000000000000"* ]]
	[[ "${output}" == *"CapAmb:	0000000000000000"* ]]
	[[ "${output}" == *"NoNewPrivs:	0"* ]]
}

@test "runc run with some capabilities" {
	update_config '.process.user = {"uid":0}'
	update_config '.process.capabilities.bounding = ["CAP_SYS_ADMIN"]'
	update_config '.process.capabilities.permitted = ["CAP_SYS_ADMIN", "CAP_AUDIT_WRITE", "CAP_KILL", "CAP_NET_BIND_SERVICE"]'
	runc -0 run test_some_caps

	[[ "${output}" == *"CapInh:	0000000000000000"* ]]
	[[ "${output}" == *"CapBnd:	0000000000200000"* ]]
	[[ "${output}" == *"CapEff:	0000000000200000"* ]]
	[[ "${output}" == *"CapPrm:	0000000000200000"* ]]
	[[ "${output}" == *"NoNewPrivs:	1"* ]]
}

@test "runc exec --cap" {
	update_config '	  .process.args = ["/bin/sh"]
			| .process.capabilities = {}'
	runc -0 run -d --console-socket "$CONSOLE_SOCKET" test_exec_cap

	runc -0 exec test_exec_cap cat /proc/self/status
	# Check no capabilities are set.
	[[ "${output}" == *"CapInh:	0000000000000000"* ]]
	[[ "${output}" == *"CapPrm:	0000000000000000"* ]]
	[[ "${output}" == *"CapEff:	0000000000000000"* ]]
	[[ "${output}" == *"CapBnd:	0000000000000000"* ]]
	[[ "${output}" == *"CapAmb:	0000000000000000"* ]]

	runc -0 exec --cap CAP_KILL --cap CAP_AUDIT_WRITE test_exec_cap cat /proc/self/status
	# Check capabilities are added into bounding/effective/permitted only,
	# but not to inheritable or ambient.
	#
	# CAP_KILL is 5, the bit mask is 0x20 (1 << 5).
	# CAP_AUDIT_WRITE is 26, the bit mask is 0x20000000 (1 << 26).
	[[ "${output}" == *"CapInh:	0000000000000000"* ]]
	[[ "${output}" == *"CapPrm:	0000000020000020"* ]]
	[[ "${output}" == *"CapEff:	0000000020000020"* ]]
	[[ "${output}" == *"CapBnd:	0000000020000020"* ]]
	[[ "${output}" == *"CapAmb:	0000000000000000"* ]]
}

@test "runc exec --cap [ambient is set from spec]" {
	update_config '	  .process.args = ["/bin/sh"]
			| .process.capabilities.inheritable = ["CAP_CHOWN", "CAP_SYSLOG"]
			| .process.capabilities.permitted = ["CAP_KILL", "CAP_CHOWN"]
			| .process.capabilities.effective = ["CAP_KILL"]
			| .process.capabilities.bounding = ["CAP_KILL", "CAP_CHOWN", "CAP_SYSLOG"]
			| .process.capabilities.ambient = ["CAP_CHOWN"]'
	runc -0 run -d --console-socket "$CONSOLE_SOCKET" test_some_caps

	runc -0 exec test_some_caps cat /proc/self/status
	# Check that capabilities are as set in spec.
	#
	# CAP_CHOWN is 0, the bit mask is 0x1 (1 << 0)
	# CAP_KILL is 5, the bit mask is 0x20 (1 << 5).
	# CAP_SYSLOG is 34, the bit mask is 0x400000000 (1 << 34).
	[[ "${output}" == *"CapInh:	0000000400000001"* ]]
	[[ "${output}" == *"CapPrm:	0000000000000021"* ]]
	[[ "${output}" == *"CapEff:	0000000000000021"* ]]
	[[ "${output}" == *"CapBnd:	0000000400000021"* ]]
	[[ "${output}" == *"CapAmb:	0000000000000001"* ]]

	# Check that if config.json has an inheritable capability set,
	# runc exec --cap adds ambient capabilities.
	runc -0 exec --cap CAP_SYSLOG test_some_caps cat /proc/self/status
	[[ "${output}" == *"CapInh:	0000000400000001"* ]]
	[[ "${output}" == *"CapPrm:	0000000400000021"* ]]
	[[ "${output}" == *"CapEff:	0000000400000021"* ]]
	[[ "${output}" == *"CapBnd:	0000000400000021"* ]]
	[[ "${output}" == *"CapAmb:	0000000400000001"* ]]
}

@test "runc run [ambient caps not set in inheritable result in a warning]" {
	update_config '   .process.capabilities.inheritable = ["CAP_KILL"]
                       | .process.capabilities.ambient = ["CAP_KILL", "CAP_CHOWN"]'
	runc -0 run test_amb
	# This should result in CAP_KILL set in ambient,
	# and a warning about inability to set CAP_CHOWN.
	#
	# CAP_CHOWN is 0, the bit mask is 0x1 (1 << 0)
	# CAP_KILL is 5, the bit mask is 0x20 (1 << 5).
	[[ "$output" == *"can't raise ambient capability CAP_CHOWN: "* ]]
	[[ "${output}" == *"CapAmb:	0000000000000020"* ]]
}