diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-26 07:46:13 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-26 07:46:13 +0900 |
| commit | d613257841492a1e8aa7a42f9f15c93aeb6e5649 (patch) | |
| tree | 1d656ff3b19c156c54229b1756573b02795d207a /test/test.py | |
| parent | 18644d90bef239100f3a89982f27b4b6792068d2 (diff) | |
sandbox/init: clear inheritable set
Inheritable should not be able to affect anything regardless of its value, due to no_new_privs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'test/test.py')
| -rw-r--r-- | test/test.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/test/test.py b/test/test.py index 9288bb87..f0137183 100644 --- a/test/test.py +++ b/test/test.py @@ -100,9 +100,11 @@ print(denyOutputVerbose) print(machine.fail("sudo -u alice -i fsu")) # Verify capabilities/securebits in user namespace: +print(machine.succeed("sudo -u alice -i fortify run capsh --print")) print(machine.succeed("sudo -u alice -i fortify run capsh --has-no-new-privs")) print(machine.fail("sudo -u alice -i fortify run capsh --has-a=CAP_SYS_ADMIN")) print(machine.fail("sudo -u alice -i fortify run capsh --has-b=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i fortify run capsh --has-i=CAP_SYS_ADMIN")) print(machine.fail("sudo -u alice -i fortify run capsh --has-p=CAP_SYS_ADMIN")) print(machine.fail("sudo -u alice -i fortify run umount -R /dev")) |