src/tests/lxc-test-no-new-privs

   1 #!/bin/bash
   2
   3 # lxc: linux Container library
   4
   5 # Authors:
   6 # Christian Brauner <christian.brauner@mailbox.org>
   7 #
   8 # This is a test script for PR_SET_NO_NEW_PRIVS
   9
  10 # This library is free software; you can redistribute it and/or
  11 # modify it under the terms of the GNU Lesser General Public
  12 # License as published by the Free Software Foundation; either
  13 # version 2.1 of the License, or (at your option) any later version.
  14
  15 # This library is distributed in the hope that it will be useful,
  16 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18 # Lesser General Public License for more details.
  19
  20 # You should have received a copy of the GNU Lesser General Public
  21 # License along with this library; if not, write to the Free Software
  22 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  23
  24 set -eux
  25
  26 DONE=0
  27 cleanup() {
  28         cd /
  29         lxc-destroy -n c1 -f || true
  30         if [ $DONE -eq 0 ]; then
  31                 echo "FAIL"
  32                 exit 1
  33         fi
  34         echo "PASS"
  35 }
  36
  37 trap cleanup EXIT SIGHUP SIGINT SIGTERM
  38
  39 if [ ! -d /etc/lxc ]; then
  40     mkdir -p /etc/lxc/
  41     cat > /etc/lxc/default.conf << EOF
  42 lxc.net.0.type = veth
  43 lxc.net.0.link = lxcbr0
  44 EOF
  45 fi
  46
  47 lxc-create -t busybox -n c1
  48 echo "lxc.no_new_privs = 1" >> /var/lib/lxc/c1/config
  49
  50 lxc-start -n c1
  51 p1=$(lxc-info -n c1 -p -H)
  52 [ "$p1" != "-1" ] || { echo "Failed to start container c1"; false; }
  53
  54 lxc-attach -n c1 --clear-env -- mkdir -p /home/ubuntu
  55 lxc-attach -n c1 --clear-env -- /bin/sh -c "cat <<EOF >> /etc/passwd
  56 ubuntu:x:1000:1000:ubuntu:/home/ubuntu:/bin/sh
  57 EOF"
  58
  59 # Check that lxc-attach obeys PR_SET_NO_NEW_PRIVS when it is set.
  60 ! lxc-attach -n c1 --clear-env --uid 1000 --gid 1000 -- ping -c 1 127.0.0.1 || { echo "Managed to ping localhost"; false; }
  61 lxc-stop -n c1 -k
  62
  63 # Check that lxc-attach obeys PR_SET_NO_NEW_PRIVS when it is not set.
  64 sed -i 's/lxc.no_new_privs = 1/lxc.no_new_privs = 0/' /var/lib/lxc/c1/config
  65 lxc-start -n c1
  66 lxc-attach -n c1 --clear-env --uid 1000 --gid 1000 -- ping -c 1 127.0.0.1 || { echo "Managed to ping localhost"; false; }
  67 lxc-stop -n c1 -k
  68
  69 DONE=1