87 lines
2.8 KiB
Bash
87 lines
2.8 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
@test "selinux test" {
|
|
if ! which selinuxenabled > /dev/null 2> /dev/null ; then
|
|
skip 'selinuxenabled command not found in $PATH'
|
|
elif ! selinuxenabled ; then
|
|
skip "selinux is disabled"
|
|
fi
|
|
|
|
image=alpine
|
|
_prefetch $image
|
|
|
|
# Create a container and read its context as a baseline.
|
|
run_buildah from --quiet --quiet $WITH_POLICY_JSON $image
|
|
cid=$output
|
|
run_buildah run $cid sh -c 'tr \\0 \\n < /proc/self/attr/current'
|
|
assert "$output" != "" "/proc/self/attr/current cannot be empty"
|
|
firstlabel="$output"
|
|
|
|
# Ensure that we label the same container consistently across multiple "run" instructions.
|
|
run_buildah run $cid sh -c 'tr \\0 \\n < /proc/self/attr/current'
|
|
expect_output "$firstlabel" "label of second container == first"
|
|
|
|
# Ensure that different containers get different labels.
|
|
run_buildah from --quiet --quiet $WITH_POLICY_JSON $image
|
|
cid1=$output
|
|
run_buildah run $cid1 sh -c 'tr \\0 \\n < /proc/self/attr/current'
|
|
assert "$output" != "$firstlabel" \
|
|
"Second container has the same label as first (both '$output')"
|
|
}
|
|
|
|
@test "selinux spc" {
|
|
if ! which selinuxenabled > /dev/null 2> /dev/null ; then
|
|
skip "No selinuxenabled"
|
|
elif ! selinuxenabled ; then
|
|
skip "selinux is disabled"
|
|
fi
|
|
|
|
image=alpine
|
|
_prefetch $image
|
|
|
|
# Create a container and read its context as a baseline.
|
|
run_buildah from --quiet --security-opt label=disable --quiet $WITH_POLICY_JSON $image
|
|
cid=$output
|
|
run_buildah run $cid sh -c 'tr \\0 \\n < /proc/self/attr/current'
|
|
context=$output
|
|
run id -Z
|
|
crole=$(secon -r $output)
|
|
# Role and Type should always be constant. (We don't check user)
|
|
role=$(awk -F: '{print $2}' <<<$context)
|
|
expect_output --from="$role" "${crole}" "SELinux role"
|
|
|
|
type=$(awk -F: '{print $3}' <<<$context)
|
|
expect_output --from="$type" "spc_t" "SELinux type"
|
|
|
|
# Range should match that of the invoking process
|
|
my_range=$(id -Z |awk -F: '{print $4 ":" $5}')
|
|
container_range=$(awk -F: '{print $4 ":" $5}' <<<$context)
|
|
expect_output --from="$container_range" "$my_range" "SELinux range: container matches process"
|
|
}
|
|
|
|
@test "selinux specific level" {
|
|
if ! which selinuxenabled > /dev/null 2> /dev/null ; then
|
|
skip "No selinuxenabled"
|
|
elif ! selinuxenabled ; then
|
|
skip "selinux is disabled"
|
|
fi
|
|
|
|
image=alpine
|
|
_prefetch $image
|
|
|
|
firstlabel="system_u:system_r:container_t:s0:c1,c2"
|
|
# Create a container and read its context as a baseline.
|
|
run_buildah from --quiet --security-opt label="level:s0:c1,c2" --quiet $WITH_POLICY_JSON $image
|
|
cid=$output
|
|
|
|
# Inspect image
|
|
run_buildah inspect --format '{{.ProcessLabel}}' $cid
|
|
expect_output "$firstlabel"
|
|
|
|
# Check actual running context
|
|
run_buildah run $cid sh -c 'tr \\0 \\n < /proc/self/attr/current'
|
|
expect_output "$firstlabel" "running container context"
|
|
}
|