From d613257841492a1e8aa7a42f9f15c93aeb6e5649 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 26 Mar 2025 07:46:13 +0900 Subject: sandbox/init: clear inheritable set Inheritable should not be able to affect anything regardless of its value, due to no_new_privs. Signed-off-by: Ophestra --- test/test.py | 2 ++ 1 file changed, 2 insertions(+) (limited to 'test') diff --git a/test/test.py b/test/test.py index 9288bb87..f0137183 100644 --- a/test/test.py +++ b/test/test.py @@ -100,9 +100,11 @@ print(denyOutputVerbose) print(machine.fail("sudo -u alice -i fsu")) # Verify capabilities/securebits in user namespace: +print(machine.succeed("sudo -u alice -i fortify run capsh --print")) print(machine.succeed("sudo -u alice -i fortify run capsh --has-no-new-privs")) print(machine.fail("sudo -u alice -i fortify run capsh --has-a=CAP_SYS_ADMIN")) print(machine.fail("sudo -u alice -i fortify run capsh --has-b=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i fortify run capsh --has-i=CAP_SYS_ADMIN")) print(machine.fail("sudo -u alice -i fortify run capsh --has-p=CAP_SYS_ADMIN")) print(machine.fail("sudo -u alice -i fortify run umount -R /dev")) -- cgit v1.3.1