kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity
moby--moby/contrib/syscall-test/Dockerfile

16 lines
565 B
Text
Raw Normal View History

Switch "syscall-test" image from "debian:jessie" to "buildpack-deps:jessie" so that "gcc" is already included This results in a significant time savings during repeated builds (since we don't have to re-download gcc for every test run). Signed-off-by: Andrew "Tianon" Page <admwiggin@gmail.com>
2016-01-14 13:51:30 -08:00
FROM buildpack-deps:jessie
add more seccomp profile tests Signed-off-by: Jessica Frazelle <acidburn@docker.com>
2015-12-30 11:20:23 -08:00
COPY . /usr/src/
WORKDIR /usr/src/
RUN gcc -g -Wall -static userns.c -o /usr/bin/userns-test \
&& gcc -g -Wall -static ns.c -o /usr/bin/ns-test \
Use runc version built without ambient capabilities Until we can support existing behaviour with `sudo` disable ambient capabilities in runc build. Add tests that non root user cannot use default capabilities, and that capabilities are working as expected. Test for #27590 Update runc. Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-10-21 13:34:37 +01:00
&& gcc -g -Wall -static acct.c -o /usr/bin/acct-test \
&& gcc -g -Wall -static setuid.c -o /usr/bin/setuid-test \
&& gcc -g -Wall -static setgid.c -o /usr/bin/setgid-test \
&& gcc -g -Wall -static socket.c -o /usr/bin/socket-test \
Revert "Block obsolete socket families in the default seccomp profile" This reverts commit 7e3a596a63fd8d0ab958132901b6ded81f8b44c0. Unfortunately, it was pointed out in https://github.com/moby/moby/pull/29076#commitcomment-21831387 that the `socketcall` syscall takes a pointer to a struct so it is not possible to use seccomp profiles to filter it. This means these cannot be blocked as you can use `socketcall` to call them regardless, as we currently allow 32 bit syscalls. Users who wish to block these should use a seccomp profile that blocks all 32 bit syscalls and then just block the non socketcall versions. Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-05-09 14:21:19 +01:00
&& gcc -g -Wall -static raw.c -o /usr/bin/raw-test
Add a test that the default seccomp profile allows execution of 32 bit binaries While testing #24510 I noticed that 32 bit syscalls were incorrectly being blocked and we did not have a test for this, so adding one. This is only tested on amd64 as it is the only architecture that reliably supports 32 bit code execution, others only do sometimes. There is no 32 bit libc in the buildpack-deps so we cannot build 32 bit C code easily so use the simplest assembly program which just calls the exit syscall. Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2016-07-27 18:42:34 +01:00
RUN [ "$(uname -m)" = "x86_64" ] && gcc -s -m32 -nostdlib exit32.s -o /usr/bin/exit32-test || true
Copy permalink