diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-28 02:24:27 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-28 02:24:27 +0900 |
| commit | ff3cfbb437795c7fee547b8340014071625a61a8 (patch) | |
| tree | 4e26cf960b815021fc4b96d1ab943adc1a59fb8c /test/test.py | |
| parent | c13eb70d7dbb73ab2353cc56944c652ea16f9be9 (diff) | |
test/sandbox: check seccomp outcome
This is as ugly as it is because it has to have CAP_SYS_ADMIN and not be in seccomp mode.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'test/test.py')
| -rw-r--r-- | test/test.py | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/test/test.py b/test/test.py index f0137183..baf074e2 100644 --- a/test/test.py +++ b/test/test.py @@ -99,6 +99,12 @@ print(denyOutputVerbose) # Fail direct fsu call: print(machine.fail("sudo -u alice -i fsu")) +# Check seccomp outcome: +swaymsg("exec fortify run cat") +pid = int(machine.wait_until_succeeds("pgrep -U 1000000 -x cat", timeout=5)) +print(machine.succeed(f"fortify-test filter {pid} c698b081ff957afe17a6d94374537d37f2a63f6f9dd75da7546542407a9e32476ebda3312ba7785d7f618542bcfaf27ca27dcc2dddba852069d28bcfe8cad39a &>/dev/stdout", timeout=5)) +machine.succeed(f"kill -TERM {pid}") + # Verify capabilities/securebits in user namespace: print(machine.succeed("sudo -u alice -i fortify run capsh --print")) print(machine.succeed("sudo -u alice -i fortify run capsh --has-no-new-privs")) |