toolshed/docker-cli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #29984 from jmzwcn/issueNNP

Browse Source 
[feature]: add daemon flag to set no_new_priv as default for unprivileged containers
Upstream-commit: 6dd2a82458016d15786b0bb12ba4cecde9b6bb90
Component: engine
This commit is contained in:
Anusha Ragunathan
2017-02-17 11:43:43 -08:00
committed by GitHub
parent b7f72f988d 3ba3328157
commit 00a09015ca
9 changed files with 67 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/engine/integration-cli/docker_cli_run_unix_test.go
+14 -1
View File
@@ -1140,12 +1140,25 @@ func (s *DockerSuite) TestRunSeccompDefaultProfileNS(c *check.C) {
}
}
// TestRunNoNewPrivSetuid checks that --security-opt=no-new-privileges prevents
// TestRunNoNewPrivSetuid checks that --security-opt='no-new-privileges=true' prevents
// effective uid transtions on executing setuid binaries.
func (s *DockerSuite) TestRunNoNewPrivSetuid(c *check.C) {
testRequires(c, DaemonIsLinux, NotUserNamespace, SameHostDaemon)
ensureNNPTest(c)
// test that running a setuid binary results in no effective uid transition
icmd.RunCommand(dockerBinary, "run", "--security-opt", "no-new-privileges=true", "--user", "1000",
"nnp-test", "/usr/bin/nnp-test").Assert(c, icmd.Expected{
Out: "EUID=1000",
})
}
// TestLegacyRunNoNewPrivSetuid checks that --security-opt=no-new-privileges prevents
// effective uid transtions on executing setuid binaries.
func (s *DockerSuite) TestLegacyRunNoNewPrivSetuid(c *check.C) {
testRequires(c, DaemonIsLinux, NotUserNamespace, SameHostDaemon)
ensureNNPTest(c)
// test that running a setuid binary results in no effective uid transition
icmd.RunCommand(dockerBinary, "run", "--security-opt", "no-new-privileges", "--user", "1000",
"nnp-test", "/usr/bin/nnp-test").Assert(c, icmd.Expected{