diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-26 06:28:32 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-26 06:32:08 +0900 |
| commit | 52fcc48ac141147324c3baac0e87ea49e8c2ca09 (patch) | |
| tree | a3b2cc75d7d7266427580258cfdd11dc307cb92f /test/test.py | |
| parent | 8b69bcd2154fdc7903aceca662e9694588c982f2 (diff) | |
sandbox/init: drop capabilities
During development the syscall filter caused me to make an incorrect assumption about SysProcAttr.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'test/test.py')
| -rw-r--r-- | test/test.py | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/test/test.py b/test/test.py index 1b3bef0f..9288bb87 100644 --- a/test/test.py +++ b/test/test.py @@ -99,6 +99,13 @@ print(denyOutputVerbose) # Fail direct fsu call: print(machine.fail("sudo -u alice -i fsu")) +# Verify capabilities/securebits in user namespace: +print(machine.succeed("sudo -u alice -i fortify run capsh --has-no-new-privs")) +print(machine.fail("sudo -u alice -i fortify run capsh --has-a=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i fortify run capsh --has-b=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i fortify run capsh --has-p=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i fortify run umount -R /dev")) + # Verify PrintBaseError behaviour: if denyOutput != "fsu: uid 1001 is not in the fsurc file\n": raise Exception(f"unexpected deny output:\n{denyOutput}") |