netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Support older versions of Docker that don't pass new caps in tests.

Browse Source 
Updates #8529

PiperOrigin-RevId: 510592431
This commit is contained in:
Nicolas Lacasse
2023-02-17 21:17:10 -08:00
committed by gVisor bot
parent bd9010d4c6
commit 655cc38228
1 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/e2e/exec_test.go
+15 -3
View File
@@ -111,9 +111,21 @@ func TestExecPrivileged(t *testing.T) {
t.Fatalf("docker exec failed: %v", err)
}
t.Logf("Exec CapEff: %v", got)
want := fmt.Sprintf("CapEff:\t%016x\n", specutils.AllCapabilitiesUint64()&^bits.MaskOf64(int(linux.CAP_NET_RAW)))
if got != want {
t.Errorf("Wrong capabilities, got: %q, want: %q. Make sure runsc is not using '--net-raw'", got, want)
wantCaps := specutils.AllCapabilitiesUint64() &^ bits.MaskOf64(int(linux.CAP_NET_RAW))
wantStr := fmt.Sprintf("CapEff:\t%016x\n", wantCaps)
if got == wantStr {
// All good.
return
}
// Older versions of Docker don't support CAP_PERFMON, _BPF, or
// _CHECKPOINT_RESTORE. Mask those and see if we are equal.
oldWantCaps := wantCaps
for _, cap := range []linux.Capability{linux.CAP_PERFMON, linux.CAP_BPF, linux.CAP_CHECKPOINT_RESTORE} {
oldWantCaps = oldWantCaps &^ bits.MaskOf64(int(cap))
}
oldWantStr := fmt.Sprintf("CapEff:\t%016x\n", oldWantCaps)
if got != oldWantStr {
t.Errorf("Wrong capabilities, got: %q, want: %q or %q. Make sure runsc is not using '--net-raw'", got, wantStr, oldWantStr)
}
}