diff --git a/capability/capability_test.go b/capability/capability_test.go index 80a0707..0e98eeb 100644 --- a/capability/capability_test.go +++ b/capability/capability_test.go @@ -131,3 +131,84 @@ func TestAmbientCapSet(t *testing.T) { t.Fatalf("Should not have the ambient cap(%d) in current process.\n", capAmbient[1]) } } + +func TestAmbientCapSetGreedy(t *testing.T) { + if runtime.GOOS != "linux" { + return + } + requirePCapSet(t) + + capBounding := []Cap{CAP_KILL, CAP_CHOWN, CAP_SYSLOG} + capPermitted := []Cap{CAP_KILL} + capEffective := []Cap{CAP_KILL} + capInheritable := []Cap{CAP_KILL} + capAmbient := []Cap{CAP_KILL, CAP_CHOWN} + + pid, err := newPid(0) + if err != nil { + t.Fatal(err) + } + pid.Set(BOUNDING, capBounding...) + pid.Set(PERMITTED, capPermitted...) + pid.Set(EFFECTIVE, capEffective...) + pid.Set(INHERITABLE, capInheritable...) + pid.Set(AMBIENT, capAmbient...) + if err = pid.Apply(CAPS | BOUNDING); err != nil { + t.Fatal(err) + } + if err = pid.Apply(AMBIENT); err == nil { + t.Fatal("Expected an error when setting ambient, but got nil.") + } + + // Restore the cap set data from current process + if err = pid.Load(); err != nil { + t.Fatal(err) + } + if !pid.Get(AMBIENT, capAmbient[0]) { + t.Fatalf("Can't get ambient cap(%d) from current process.\n", capAmbient[0]) + } + if pid.Get(AMBIENT, capAmbient[1]) { + t.Fatalf("Should not have the ambient cap(%d) in current process.\n", capAmbient[1]) + } +} + +func TestAmbientCapSetStopOnError(t *testing.T) { + if runtime.GOOS != "linux" { + return + } + requirePCapSet(t) + + capBounding := []Cap{CAP_KILL, CAP_CHOWN, CAP_SYSLOG} + capPermitted := []Cap{CAP_KILL} + capEffective := []Cap{CAP_KILL} + capInheritable := []Cap{CAP_KILL} + capAmbient := []Cap{CAP_KILL, CAP_CHOWN} + + pid, err := newPid(0) + if err != nil { + t.Fatal(err) + } + pid.SetApplyMode(CAP_AMBIENT_RAISE_STOPONERROR) + pid.Set(BOUNDING, capBounding...) + pid.Set(PERMITTED, capPermitted...) + pid.Set(EFFECTIVE, capEffective...) + pid.Set(INHERITABLE, capInheritable...) + pid.Set(AMBIENT, capAmbient...) + if err = pid.Apply(CAPS | BOUNDING); err != nil { + t.Fatal(err) + } + if err = pid.Apply(AMBIENT); err == nil { + t.Fatal("Expected an error when setting ambient, but got nil.") + } + + // Restore the cap set data from current process + if err = pid.Load(); err != nil { + t.Fatal(err) + } + if pid.Get(AMBIENT, capAmbient[0]) { + t.Fatalf("hould not have the ambient cap(%d) in current process.\n", capAmbient[0]) + } + if pid.Get(AMBIENT, capAmbient[1]) { + t.Fatalf("Should not have the ambient cap(%d) in current process.\n", capAmbient[1]) + } +}