From 655cc382286d88e5d39f2e38a347da3702bde6db Mon Sep 17 00:00:00 2001 From: Nicolas Lacasse Date: Fri, 17 Feb 2023 21:14:14 -0800 Subject: [PATCH] Support older versions of Docker that don't pass new caps in tests. Updates #8529 PiperOrigin-RevId: 510592431 --- test/e2e/exec_test.go | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/test/e2e/exec_test.go b/test/e2e/exec_test.go index b47df447c..979a64f67 100644 --- a/test/e2e/exec_test.go +++ b/test/e2e/exec_test.go @@ -111,9 +111,21 @@ func TestExecPrivileged(t *testing.T) { t.Fatalf("docker exec failed: %v", err) } t.Logf("Exec CapEff: %v", got) - want := fmt.Sprintf("CapEff:\t%016x\n", specutils.AllCapabilitiesUint64()&^bits.MaskOf64(int(linux.CAP_NET_RAW))) - if got != want { - t.Errorf("Wrong capabilities, got: %q, want: %q. Make sure runsc is not using '--net-raw'", got, want) + wantCaps := specutils.AllCapabilitiesUint64() &^ bits.MaskOf64(int(linux.CAP_NET_RAW)) + wantStr := fmt.Sprintf("CapEff:\t%016x\n", wantCaps) + if got == wantStr { + // All good. + return + } + // Older versions of Docker don't support CAP_PERFMON, _BPF, or + // _CHECKPOINT_RESTORE. Mask those and see if we are equal. + oldWantCaps := wantCaps + for _, cap := range []linux.Capability{linux.CAP_PERFMON, linux.CAP_BPF, linux.CAP_CHECKPOINT_RESTORE} { + oldWantCaps = oldWantCaps &^ bits.MaskOf64(int(cap)) + } + oldWantStr := fmt.Sprintf("CapEff:\t%016x\n", oldWantCaps) + if got != oldWantStr { + t.Errorf("Wrong capabilities, got: %q, want: %q or %q. Make sure runsc is not using '--net-raw'", got, wantStr, oldWantStr) } }