File tree Expand file tree Collapse file tree 1 file changed +41
-0
lines changed
Expand file tree Collapse file tree 1 file changed +41
-0
lines changed Original file line number Diff line number Diff line change @@ -729,3 +729,44 @@ TEST_F(InitCapTestFixture, GetCapabilities_FullSuccess)
729729
730730 unlink("/etc/security/caps/process-capabilities.json");
731731}
732+
733+ TEST_F(InitCapTestFixture, DropRootCaps_FullRootFlow_NoCrashes)
734+ {
735+ system("mkdir -p /etc/security/caps");
736+
737+ std::ofstream cfg("/etc/security/caps/process-capabilities.json");
738+ cfg << R"({
739+ "default": "CAP_NET_RAW",
740+ "testbin": {
741+ "allow": "CAP_NET_ADMIN",
742+ "drop": ""
743+ }
744+ })";
745+ cfg.close();
746+
747+ __test_force_root = 1; // force root path
748+
749+ cap_user cu{};
750+ cu.user_name = strdup("nobody");
751+ cu.default_count = 0;
752+ cu.add_count = 0;
753+ cu.drop_count = 0;
754+
755+ EXPECT_CALL(*g_CapMock, getpid())
756+ .WillRepeatedly(Return(123));
757+
758+ EXPECT_CALL(*g_CapMock, getuid())
759+ .WillRepeatedly(Return(0));
760+
761+ cap_t fake_caps = cap_init();
762+ ASSERT_NE(fake_caps, nullptr);
763+
764+ caps = fake_caps;
765+
766+ int rc = drop_root_caps(&cu);
767+ EXPECT_EQ(rc, 0);
768+
769+ cap_free(fake_caps);
770+ caps = NULL;
771+ __test_force_root = 0;
772+ }
You can’t perform that action at this time.
0 commit comments