diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-14 02:18:44 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-14 02:18:44 +0900 |
| commit | f332200ca4a18ae098e4c42509ba1256d8562cf9 (patch) | |
| tree | 7668eeb8d4c1672cf2f31cd7fdd49ddeed8ddcc7 /internal/sandbox/container_test.go | |
| parent | 2eff47009102d53844906aa90fb2b8eddae78c1b (diff) | |
sandbox: mount container /dev
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal/sandbox/container_test.go')
| -rw-r--r-- | internal/sandbox/container_test.go | 31 |
1 files changed, 25 insertions, 6 deletions
diff --git a/internal/sandbox/container_test.go b/internal/sandbox/container_test.go index 648e88c0..1579dbaa 100644 --- a/internal/sandbox/container_test.go +++ b/internal/sandbox/container_test.go @@ -13,6 +13,7 @@ import ( "time" "git.gensokyo.uk/security/fortify/fst" + "git.gensokyo.uk/security/fortify/helper/seccomp" "git.gensokyo.uk/security/fortify/internal" "git.gensokyo.uk/security/fortify/internal/fmsg" "git.gensokyo.uk/security/fortify/internal/sandbox" @@ -28,18 +29,34 @@ func TestContainer(t *testing.T) { } testCases := []struct { - name string - ops *sandbox.Ops - mnt []*check.Mntent - host string + name string + flags sandbox.HardeningFlags + ops *sandbox.Ops + mnt []*check.Mntent + host string }{ - {"minimal", new(sandbox.Ops), nil, "test-minimal"}, - {"tmpfs", + {"minimal", 0, new(sandbox.Ops), nil, "test-minimal"}, + {"allow", sandbox.FAllowUserns | sandbox.FAllowNet | sandbox.FAllowTTY, + new(sandbox.Ops), nil, "test-minimal"}, + {"tmpfs", 0, new(sandbox.Ops). Tmpfs(fst.Tmp, 0, 0755), []*check.Mntent{ {FSName: "tmpfs", Dir: fst.Tmp, Type: "tmpfs", Opts: "\x00"}, }, "test-tmpfs"}, + {"dev", sandbox.FAllowTTY, // go test output is not a tty + new(sandbox.Ops). + Dev("/dev"), + []*check.Mntent{ + {FSName: "devtmpfs", Dir: "/dev", Type: "tmpfs", Opts: "\x00"}, + {FSName: "devtmpfs", Dir: "/dev/null", Type: "devtmpfs", Opts: "\x00", Freq: -1, Passno: -1}, + {FSName: "devtmpfs", Dir: "/dev/zero", Type: "devtmpfs", Opts: "\x00", Freq: -1, Passno: -1}, + {FSName: "devtmpfs", Dir: "/dev/full", Type: "devtmpfs", Opts: "\x00", Freq: -1, Passno: -1}, + {FSName: "devtmpfs", Dir: "/dev/random", Type: "devtmpfs", Opts: "\x00", Freq: -1, Passno: -1}, + {FSName: "devtmpfs", Dir: "/dev/urandom", Type: "devtmpfs", Opts: "\x00", Freq: -1, Passno: -1}, + {FSName: "devtmpfs", Dir: "/dev/tty", Type: "devtmpfs", Opts: "\x00", Freq: -1, Passno: -1}, + {FSName: "devpts", Dir: "/dev/pts", Type: "devpts", Opts: "rw,nosuid,noexec,relatime,mode=620,ptmxmode=666", Freq: 0, Passno: 0}, + }, ""}, } for _, tc := range testCases { @@ -54,6 +71,8 @@ func TestContainer(t *testing.T) { return exec.CommandContext(ctx, os.Args[0], "-test.v", "-test.run=TestHelperInit", "--", "init") } + container.Seccomp |= seccomp.FlagExt + container.Flags |= tc.flags container.Stdout, container.Stderr = os.Stdout, os.Stderr container.Ops = tc.ops if container.Args[5] == "" { |