Merge pull request #13335 from jfrazelle/add-apparmor-unshare-test

add unshare apparmor profile test
Upstream-commit: aee9ac302d06ebcc56713142245aa19584c8b99f
Component: engine

components/engine/integration-cli/docker_cli_run_test.go

@@ -3170,3 +3170,19 @@ func (s *DockerSuite) TestTwoContainersInNetHost(c *check.C) {
 	dockerCmd(c, "stop", "first")
 	dockerCmd(c, "stop", "second")
 }
+
+func (s *DockerSuite) TestRunUnshareProc(c *check.C) {
+	testRequires(c, Apparmor)
+
+	name := "acidburn"
+	runCmd := exec.Command(dockerBinary, "run", "--name", name, "jess/unshare", "unshare", "-p", "-m", "-f", "-r", "--mount-proc=/proc", "mount")
+	if out, _, err := runCommandWithOutput(runCmd); err == nil || !strings.Contains(out, "Permission denied") {
+		c.Fatalf("unshare should have failed with permission denied, got: %s, %v", out, err)
+	}
+
+	name = "cereal"
+	runCmd = exec.Command(dockerBinary, "run", "--name", name, "jess/unshare", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc")
+	if out, _, err := runCommandWithOutput(runCmd); err == nil || !strings.Contains(out, "Permission denied") {
+		c.Fatalf("unshare should have failed with permission denied, got: %s, %v", out, err)
+	}
+}

components/engine/integration-cli/requirements.go

@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"fmt"
+	"io/ioutil"
 	"log"
 	"net/http"
 	"os/exec"
@@ -44,6 +45,13 @@ var (
 		},
 		"Test requires network availability, environment variable set to none to run in a non-network enabled mode.",
 	}
+	Apparmor = TestRequirement{
+		func() bool {
+			buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
+			return err == nil && len(buf) > 1 && buf[0] == 'Y'
+		},
+		"Test requires apparmor is enabled.",
+	}
 	RegistryHosting = TestRequirement{
 		func() bool {
 			// for now registry binary is built only if we're running inside
@@ -78,7 +86,6 @@ var (
 		},
 		"Test requires the native (libcontainer) exec driver.",
 	}
-
 	NotOverlay = TestRequirement{
 		func() bool {
 			cmd := exec.Command("grep", "^overlay / overlay", "/proc/mounts")