bekucera/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-09-10 22:52:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

test: Add test for nspawn's handling of cap_net_bind_service

Browse Source
This commit is contained in:
Daan De Meyer
2025-09-04 12:48:35 +02:00
parent 945e1fd37b
commit cadeaef67c
1 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
test/units/TEST-13-NSPAWN.nspawn.sh
View File

@@ -1470,4 +1470,22 @@ testcase_link_journal_host() {
rm -fr "$root"
}
testcase_cap_net_bind_service() {
local root
root="$(mktemp -d /var/lib/machines/TEST-13-NSPAWN.cap-net-bind-service.XXX)"
create_dummy_container "$root"
# Check that CAP_NET_BIND_SERVICE is available without --private-users
systemd-nspawn --register=no --directory="$root" capsh --has-p=cap_net_bind_service
# Check that CAP_NET_BIND_SERVICE is not available with --private-users=identity
(! systemd-nspawn --register=no --directory="$root" --private-users=identity capsh --has-p=cap_net_bind_service)
# Check that CAP_NET_BIND_SERVICE is not available with --private-users=pick
(! systemd-nspawn --register=no --directory="$root" --private-users=pick capsh --has-p=cap_net_bind_service)
rm -fr "$root"
}
run_testcases