vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

reload default apparmor profile if it is unloaded

Browse source 
Signed-off-by: Xianglin Gao <xlgao@zju.edu.cn>
This commit is contained in:
Xianglin Gao 2016-12-07 19:32:50 +08:00
parent 8547c0dbd9
commit cb5ed1ce9d
8 changed files with 95 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

62
test/apparmor.bats
View file

@ -15,8 +15,8 @@ function teardown() {
fi
# this test requires apparmor, so skip this test if apparmor is not enabled.
enabled=is_apparmor_enabled
if [[ "$enabled" = "0" ]]; then
enabled=$(is_apparmor_enabled)
if [[ "$enabled" -eq 0 ]]; then
skip "skip this test since apparmor is not enabled."
fi
@ -52,12 +52,12 @@ function teardown() {
fi
# this test requires apparmor, so skip this test if apparmor is not enabled.
enabled=is_apparmor_enabled
if [[ "$enabled" -eq "0" ]]; then
enabled=$(is_apparmor_enabled)
if [[ "$enabled" -eq 0 ]]; then
skip "skip this test since apparmor is not enabled."
fi
load_apparmor_test_profile
load_apparmor_profile "$APPARMOR_TEST_PROFILE_PATH"
start_ocid "" "$APPARMOR_TEST_PROFILE_NAME"
sed -e 's/%VALUE%/,"container\.apparmor\.security\.beta\.kubernetes\.io\/testname2": "apparmor-test-deny-write"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/apparmor2.json
@ -79,7 +79,7 @@ function teardown() {
cleanup_ctrs
cleanup_pods
stop_ocid
remove_apparmor_test_profile
remove_apparmor_profile "$APPARMOR_TEST_PROFILE_PATH"
}
# 3. test running with loading a specific apparmor profile but not as ocid default apparmor profile.
@ -91,12 +91,12 @@ function teardown() {
fi
# this test requires apparmor, so skip this test if apparmor is not enabled.
enabled=is_apparmor_enabled
if [[ "$enabled" -eq "0" ]]; then
enabled=$(is_apparmor_enabled)
if [[ "$enabled" -eq 0 ]]; then
skip "skip this test since apparmor is not enabled."
fi
load_apparmor_test_profile
load_apparmor_profile "$APPARMOR_TEST_PROFILE_PATH"
start_ocid
sed -e 's/%VALUE%/,"container\.apparmor\.security\.beta\.kubernetes\.io\/testname3": "apparmor-test-deny-write"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/apparmor3.json
@ -118,7 +118,7 @@ function teardown() {
cleanup_ctrs
cleanup_pods
stop_ocid
remove_apparmor_test_profile
remove_apparmor_profile "$APPARMOR_TEST_PROFILE_PATH"
}
# 4. test running with wrong apparmor profile name.
@ -130,8 +130,8 @@ function teardown() {
fi
# this test requires apparmor, so skip this test if apparmor is not enabled.
enabled=is_apparmor_enabled
if [[ "$enabled" -eq "0" ]]; then
enabled=$(is_apparmor_enabled)
if [[ "$enabled" -eq 0 ]]; then
skip "skip this test since apparmor is not enabled."
fi
@ -149,6 +149,44 @@ function teardown() {
[[ "$output" =~ "Creating container failed" ]]
cleanup_ctrs
cleanup_pods
stop_ocid
}
# 5. test running with default apparmor profile unloaded.
# test that we can will fail when running a ctr with rong apparmor profile name.
@test "run a container after unloading default apparmor profile" {
# this test requires docker, thus it can't yet be run in a container
if [ "$TRAVIS" = "true" ]; then # instead of $TRAVIS, add a function is_containerized to skip here
skip "cannot yet run this test in a container, use sudo make localintegration"
fi
# this test requires apparmor, so skip this test if apparmor is not enabled.
enabled=$(is_apparmor_enabled)
if [[ "$enabled" -eq 0 ]]; then
skip "skip this test since apparmor is not enabled."
fi
start_ocid
remove_apparmor_profile "$FAKE_OCID_DEFAULT_PROFILE_PATH"
sed -e 's/%VALUE%/,"container\.apparmor\.security\.beta\.kubernetes\.io\/testname5": "runtime\/default"/g' "$TESTDATA"/sandbox_config_seccomp.json > "$TESTDIR"/apparmor5.json
run ocic pod create --name apparmor5 --config "$TESTDIR"/apparmor5.json
echo "$output"
[ "$status" -eq 0 ]
pod_id="$output"
run ocic ctr create --name testname5 --config "$TESTDATA"/container_redis.json --pod "$pod_id"
echo "$output"
[ "$status" -eq 0 ]
ctr_id="$output"
[ "$status" -eq 0 ]
run ocic ctr execsync --id "$ctr_id" touch test.txt
echo "$output"
[ "$status" -eq 0 ]
cleanup_ctrs
cleanup_pods
stop_ocid