diff options
Diffstat (limited to 'test/test.py')
| -rw-r--r-- | test/test.py | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/test/test.py b/test/test.py index 1b3bef0f..9288bb87 100644 --- a/test/test.py +++ b/test/test.py @@ -99,6 +99,13 @@ print(denyOutputVerbose) # Fail direct fsu call: print(machine.fail("sudo -u alice -i fsu")) +# Verify capabilities/securebits in user namespace: +print(machine.succeed("sudo -u alice -i fortify run capsh --has-no-new-privs")) +print(machine.fail("sudo -u alice -i fortify run capsh --has-a=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i fortify run capsh --has-b=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i fortify run capsh --has-p=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i fortify run umount -R /dev")) + # Verify PrintBaseError behaviour: if denyOutput != "fsu: uid 1001 is not in the fsurc file\n": raise Exception(f"unexpected deny output:\n{denyOutput}") |