test ApplyMode for AMBIENT

Signed-off-by: lifubang <lifubang@acmcoder.com>
moby · Sep 30, 2024 · e502b72 · e502b72
1 parent be34d2f
commit e502b72
Showing 1 changed file with 81 additions and 0 deletions.
diff --git a/capability/capability_test.go b/capability/capability_test.go
@@ -131,3 +131,84 @@ func TestAmbientCapSet(t *testing.T) {
 		t.Fatalf("Should not have the ambient cap(%d) in current process.\n", capAmbient[1])
 	}
 }
+
+func TestAmbientCapSetGreedy(t *testing.T) {
+	if runtime.GOOS != "linux" {
+		return
+	}
+	requirePCapSet(t)
+
+	capBounding := []Cap{CAP_KILL, CAP_CHOWN, CAP_SYSLOG}
+	capPermitted := []Cap{CAP_KILL}
+	capEffective := []Cap{CAP_KILL}
+	capInheritable := []Cap{CAP_KILL}
+	capAmbient := []Cap{CAP_KILL, CAP_CHOWN}
+
+	pid, err := newPid(0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pid.Set(BOUNDING, capBounding...)
+	pid.Set(PERMITTED, capPermitted...)
+	pid.Set(EFFECTIVE, capEffective...)
+	pid.Set(INHERITABLE, capInheritable...)
+	pid.Set(AMBIENT, capAmbient...)
+	if err = pid.Apply(CAPS | BOUNDING); err != nil {
+		t.Fatal(err)
+	}
+	if err = pid.Apply(AMBIENT); err == nil {
+		t.Fatal("Expected an error when setting ambient, but got nil.")
+	}
+
+	// Restore the cap set data from current process
+	if err = pid.Load(); err != nil {
+		t.Fatal(err)
+	}
+	if !pid.Get(AMBIENT, capAmbient[0]) {
+		t.Fatalf("Can't get ambient cap(%d) from current process.\n", capAmbient[0])
+	}
+	if pid.Get(AMBIENT, capAmbient[1]) {
+		t.Fatalf("Should not have the ambient cap(%d) in current process.\n", capAmbient[1])
+	}
+}
+
+func TestAmbientCapSetStopOnError(t *testing.T) {
+	if runtime.GOOS != "linux" {
+		return
+	}
+	requirePCapSet(t)
+
+	capBounding := []Cap{CAP_KILL, CAP_CHOWN, CAP_SYSLOG}
+	capPermitted := []Cap{CAP_KILL}
+	capEffective := []Cap{CAP_KILL}
+	capInheritable := []Cap{CAP_KILL}
+	capAmbient := []Cap{CAP_KILL, CAP_CHOWN}
+
+	pid, err := newPid(0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pid.SetApplyMode(CAP_AMBIENT_RAISE_STOPONERROR)
+	pid.Set(BOUNDING, capBounding...)
+	pid.Set(PERMITTED, capPermitted...)
+	pid.Set(EFFECTIVE, capEffective...)
+	pid.Set(INHERITABLE, capInheritable...)
+	pid.Set(AMBIENT, capAmbient...)
+	if err = pid.Apply(CAPS | BOUNDING); err != nil {
+		t.Fatal(err)
+	}
+	if err = pid.Apply(AMBIENT); err == nil {
+		t.Fatal("Expected an error when setting ambient, but got nil.")
+	}
+
+	// Restore the cap set data from current process
+	if err = pid.Load(); err != nil {
+		t.Fatal(err)
+	}
+	if pid.Get(AMBIENT, capAmbient[0]) {
+		t.Fatalf("hould not have the ambient cap(%d) in current process.\n", capAmbient[0])
+	}
+	if pid.Get(AMBIENT, capAmbient[1]) {
+		t.Fatalf("Should not have the ambient cap(%d) in current process.\n", capAmbient[1])
+	}
+}