diff --git a/tests/integration/capabilities.bats b/tests/integration/capabilities.bats index 968041223f7..1da7cf64c43 100644 --- a/tests/integration/capabilities.bats +++ b/tests/integration/capabilities.bats @@ -53,3 +53,32 @@ function teardown() { [[ "${output}" == *"CapPrm: 0000000000200000"* ]] [[ "${output}" == *"NoNewPrivs: 1"* ]] } + +@test "runc exec --cap" { + update_config '.process.terminal = false' + update_config '.process.args = ["sleep", "infinity"]' + update_config '.process.user = {"uid":0}' + update_config '.process.capabilities.bounding = ["CAP_KILL", "CAP_CHOWN", "CAP_SYSLOG"]' + update_config '.process.capabilities.effective = ["CAP_KILL"]' + update_config '.process.capabilities.permitted = ["CAP_KILL", "CAP_CHOWN"]' + update_config '.process.capabilities.inheritable = ["CAP_CHOWN", "CAP_SYSLOG"]' + update_config '.process.capabilities.ambient = ["CAP_CHOWN"]' + __runc run -d test_some_caps + [ "$status" -eq 0 ] + + runc exec test_some_caps /bin/cat /proc/self/status + [[ "${output}" == *"CapInh: 0000000400000001"* ]] + [[ "${output}" == *"CapBnd: 0000000400000021"* ]] + [[ "${output}" == *"CapEff: 0000000000000021"* ]] + [[ "${output}" == *"CapPrm: 0000000000000021"* ]] + [[ "${output}" == *"CapAmb: 0000000000000001"* ]] + [[ "${output}" == *"NoNewPrivs: 1"* ]] + + runc exec --cap CAP_SYSLOG test_some_caps /bin/cat /proc/self/status + [[ "${output}" == *"CapInh: 0000000400000001"* ]] + [[ "${output}" == *"CapBnd: 0000000400000021"* ]] + [[ "${output}" == *"CapEff: 0000000400000021"* ]] + [[ "${output}" == *"CapPrm: 0000000400000021"* ]] + [[ "${output}" == *"CapAmb: 0000000400000001"* ]] + [[ "${output}" == *"NoNewPrivs: 1"* ]] +}