From 2b4c4a789969d12baca17689911021ba88d7ed10 Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Wed, 11 May 2022 16:01:11 +0100 Subject: test-run: Add another assertion that we cannot read /etc/shadow The goal of this assertion was to demonstrate that a setuid bwrap does not give us access to otherwise unreadable files, but if we want to check that, we should probably be looking at the bind-mount destination instead of the source file. Leave the old assertion in too, just in case *that* fails. Signed-off-by: Simon McVittie --- tests/test-run.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/test-run.sh b/tests/test-run.sh index 85c97dd..da92ffb 100755 --- a/tests/test-run.sh +++ b/tests/test-run.sh @@ -39,10 +39,16 @@ for ALT in "" "--unshare-user-try" "--unshare-pid" "--unshare-user-try --unshare CAP="" fi + if ! cat /etc/shadow >/dev/null && + $RUN $CAP $ALT --unshare-net --proc /proc --bind /etc/shadow /tmp/foo cat /tmp/foo; then + assert_not_reached Could read /etc/shadow via /tmp/foo bind-mount + fi + if ! cat /etc/shadow >/dev/null && $RUN $CAP $ALT --unshare-net --proc /proc --bind /etc/shadow /tmp/foo cat /etc/shadow; then assert_not_reached Could read /etc/shadow fi + echo "ok - cannot read /etc/shadow with $ALT" # Unreadable dir if [ "x$UNREADABLE" != "x" ]; then -- cgit v1.2.1