Merge pull request #13557 from ewindisch/apparmor-unshare-priv

Expand unshare test to include privileged test

integration-cli/docker_cli_run_test.go

@@ -3144,6 +3144,13 @@ func (s *DockerSuite) TestRunUnshareProc(c *check.C) {
 	if out, _, err := runCommandWithOutput(runCmd); err == nil || !strings.Contains(out, "Permission denied") {
 		c.Fatalf("unshare should have failed with permission denied, got: %s, %v", out, err)
 	}
+
+	/* Ensure still fails if running privileged with the default policy */
+	name = "crashoverride"
+	runCmd = exec.Command(dockerBinary, "run", "--privileged", "--security-opt", "apparmor:docker-default", "--name", name, "jess/unshare", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc")
+	if out, _, err := runCommandWithOutput(runCmd); err == nil || !strings.Contains(out, "Permission denied") {
+		c.Fatalf("unshare should have failed with permission denied, got: %s, %v", out, err)
+	}
 }
 
 func (s *DockerSuite) TestRunPublishPort(c *check.C) {