0ct0pu5/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

add seccomp default profile fix tests

Browse source 
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
This commit is contained in:
Antonio Murdaca 2016-02-19 09:22:36 +01:00 committed by Jessica Frazelle
parent ad600239bc
commit 11435b674b
No known key found for this signature in database
GPG key ID: 18F3685C0022BFF3
2 changed files with 20 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
integration-cli/docker_cli_run_unix_test.go
View file

@ -909,3 +909,13 @@ func (s *DockerSuite) TestRunApparmorProcDirectory(c *check.C) {
c.Fatalf("expected chmod 777 /proc/1/attr/current to fail, got %s: %v", out, err)
}
}
// make sure the default profile can be successfully parsed (using unshare as it is
// something which we know is blocked in the default profile)
func (s *DockerSuite) TestRunSeccompWithDefaultProfile(c *check.C) {
testRequires(c, SameHostDaemon, seccompEnabled)
out, _, err := dockerCmdWithError("run", "--security-opt", "seccomp:../profiles/seccomp/default.json", "debian:jessie", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami")
c.Assert(err, checker.NotNil, check.Commentf(out))
c.Assert(strings.TrimSpace(out), checker.Equals, "unshare: unshare failed: Operation not permitted")
}

11
profiles/seccomp/seccomp_test.go
View file

@ -12,7 +12,16 @@ func TestLoadProfile(t *testing.T) {
if err != nil {
t.Fatal(err)
}
if _, err := LoadProfile(string(f)); err != nil {
t.Fatal(err)
}
}
func TestLoadDefaultProfile(t *testing.T) {
f, err := ioutil.ReadFile("default.json")
if err != nil {
t.Fatal(err)
}
if _, err := LoadProfile(string(f)); err != nil {
t.Fatal(err)
}