netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Check that we have access to the trusted.* xattr namespace directly.

Browse Source 
These operations require CAP_SYS_ADMIN in the root user namespace. There's no
easy way to check that other than trying the operation and seeing what happens.

PiperOrigin-RevId: 331242256
This commit is contained in:
Nicolas Lacasse
2020-09-11 16:10:12 -07:00
committed by gVisor bot
parent 325f7036b0
commit 1f4fb817c8
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/syscalls/linux/xattr.cc
+9 -3
View File
@@ -615,12 +615,18 @@ TEST_F(XattrTest, TrustedNamespaceWithCapSysAdmin) {
SKIP_IF(IsRunningOnGvisor() &&
!ASSERT_NO_ERRNO_AND_VALUE(IsTmpfs(test_file_name_)));
// Setting/Getting in the trusted namespace requires CAP_SYS_ADMIN.
SKIP_IF(!ASSERT_NO_ERRNO_AND_VALUE(HaveCapability(CAP_SYS_ADMIN)));
const char* path = test_file_name_.c_str();
const char name[] = "trusted.test";
// Writing to the trusted.* xattr namespace requires CAP_SYS_ADMIN in the root
// user namespace. There's no easy way to check that, other than trying the
// operation and seeing what happens. We'll call removexattr because it's
// simplest.
if (removexattr(path, name) < 0) {
SKIP_IF(errno == EPERM);
FAIL() << "unexpected errno from removexattr: " << errno;
}
// Set.
char val = 'a';
size_t size = sizeof(val);