1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
|
#!/usr/bin/env bats
load helpers
@test "selinux test" {
if ! which selinuxenabled > /dev/null 2> /dev/null ; then
skip 'selinuxenabled command not found in $PATH'
elif ! selinuxenabled ; then
skip "selinux is disabled"
fi
image=alpine
_prefetch $image
# Create a container and read its context as a baseline.
run_buildah from --quiet --quiet $WITH_POLICY_JSON $image
cid=$output
run_buildah run $cid sh -c 'tr \\0 \\n < /proc/self/attr/current'
assert "$output" != "" "/proc/self/attr/current cannot be empty"
firstlabel="$output"
# Ensure that we label the same container consistently across multiple "run" instructions.
run_buildah run $cid sh -c 'tr \\0 \\n < /proc/self/attr/current'
expect_output "$firstlabel" "label of second container == first"
# Ensure that different containers get different labels.
run_buildah from --quiet --quiet $WITH_POLICY_JSON $image
cid1=$output
run_buildah run $cid1 sh -c 'tr \\0 \\n < /proc/self/attr/current'
assert "$output" != "$firstlabel" \
"Second container has the same label as first (both '$output')"
}
@test "selinux spc" {
if ! which selinuxenabled > /dev/null 2> /dev/null ; then
skip "No selinuxenabled"
elif ! selinuxenabled ; then
skip "selinux is disabled"
fi
image=alpine
_prefetch $image
# Create a container and read its context as a baseline.
run_buildah from --quiet --security-opt label=disable --quiet $WITH_POLICY_JSON $image
cid=$output
run_buildah run $cid sh -c 'tr \\0 \\n < /proc/self/attr/current'
context=$output
run id -Z
crole=$(secon -r $output)
# Role and Type should always be constant. (We don't check user)
role=$(awk -F: '{print $2}' <<<$context)
expect_output --from="$role" "${crole}" "SELinux role"
type=$(awk -F: '{print $3}' <<<$context)
expect_output --from="$type" "spc_t" "SELinux type"
# Range should match that of the invoking process
my_range=$(id -Z |awk -F: '{print $4 ":" $5}')
container_range=$(awk -F: '{print $4 ":" $5}' <<<$context)
expect_output --from="$container_range" "$my_range" "SELinux range: container matches process"
}
@test "selinux specific level" {
if ! which selinuxenabled > /dev/null 2> /dev/null ; then
skip "No selinuxenabled"
elif ! selinuxenabled ; then
skip "selinux is disabled"
fi
image=alpine
_prefetch $image
firstlabel="system_u:system_r:container_t:s0:c1,c2"
# Create a container and read its context as a baseline.
run_buildah from --quiet --security-opt label="level:s0:c1,c2" --quiet $WITH_POLICY_JSON $image
cid=$output
# Inspect image
run_buildah inspect --format '{{.ProcessLabel}}' $cid
expect_output "$firstlabel"
# Check actual running context
run_buildah run $cid sh -c 'tr \\0 \\n < /proc/self/attr/current'
expect_output "$firstlabel" "running container context"
}
|
