diff options
| -rw-r--r-- | container/container_test.go | 54 |
1 files changed, 53 insertions, 1 deletions
diff --git a/container/container_test.go b/container/container_test.go index 1bdc28a1..00a86b29 100644 --- a/container/container_test.go +++ b/container/container_test.go @@ -16,7 +16,7 @@ import ( "strings" "syscall" "testing" - _ "unsafe" // for go:linkname + "unsafe" "hakurei.app/check" "hakurei.app/command" @@ -658,6 +658,58 @@ func init() { return fmt.Errorf("gid: %d, want %d", gid, tc.gid) } + const ( + PR_CAP_AMBIENT = 0x2f + PR_CAP_AMBIENT_IS_SET = 0x1 + ) + for i := range container.LastCap(nil) { + r, _, errno := syscall.Syscall( + syscall.SYS_PRCTL, + PR_CAP_AMBIENT, + PR_CAP_AMBIENT_IS_SET, + i, + ) + if errno != 0 { + return os.NewSyscallError("prctl", errno) + } + if r != 0 { + return fmt.Errorf("capability %d is set", i) + } + + r, _, errno = syscall.Syscall( + syscall.SYS_PRCTL, + syscall.PR_CAPBSET_READ, + i, + 0, + ) + if errno != 0 { + return os.NewSyscallError("prctl", errno) + } + if r != 0 { + return fmt.Errorf("capability %d in set", i) + } + } + + const _LINUX_CAPABILITY_VERSION_3 = 0x20080522 + var capData struct { + effective uint32 + permitted uint32 + inheritable uint32 + } + if _, _, errno := syscall.Syscall(syscall.SYS_CAPGET, uintptr(unsafe.Pointer(&struct { + version uint32 + pid int32 + }{_LINUX_CAPABILITY_VERSION_3, 0})), uintptr(unsafe.Pointer(&capData)), 0); errno != 0 { + return os.NewSyscallError("capget", errno) + } + + if max(capData.effective, capData.permitted, capData.inheritable) != 0 { + return fmt.Errorf( + "effective = %d, permitted = %d, inheritable = %d", + capData.effective, capData.permitted, capData.inheritable, + ) + } + wantHost := hostnameFromTestCase(tc.name) if host, err := os.Hostname(); err != nil { return fmt.Errorf("cannot get hostname: %v", err) |