1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Commit graph

9 commits

Author SHA1 Message Date
Kir Kolyshkin
771256b305 TestRunSeccompProfileAllow32Bit: fix
Since the update to Debian Stretch, this test fails. The reason is dynamic
binary, which requires i386 ld.so for loading (and apparently it is no longer
installed by default):

> root@09d4b173c3dc:/go/src/github.com/docker/docker# file exit32-test
> exit32-test: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, BuildID[sha1]=a0d3d6cb59788453b983f65f8dc6ac52920147b6, stripped
> root@09d4b173c3dc:/go/src/github.com/docker/docker# ls -l /lib/ld-linux.so.2
> ls: cannot access '/lib/ld-linux.so.2': No such file or directory

To fix, just add -static.

Interestingly, ldd can'f figure it out.

> root@a324f8edfcaa:/go/src/github.com/docker/docker# ldd exit32-test
>	not a dynamic executable

Other tools (e.g. objdump) also show it's a dynamic binary.

While at it, remove the extra "id" argument (a copy-paste error I
guess).

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2017-09-17 22:04:31 -07:00
Daniel Nephin
f85ef42ea5 Refactor test environment
split all non-cli portions into a new internal/test/environment package

Set a test environment on packages instead of creating new ones.

Signed-off-by: Daniel Nephin <dnephin@docker.com>
2017-08-30 13:13:18 -04:00
Daniel Nephin
5fa134b906 Protect images in the integration/ suite
Signed-off-by: Daniel Nephin <dnephin@docker.com>
2017-08-09 11:02:57 -04:00
Justin Cormack
dcf2632945 Revert "Block obsolete socket families in the default seccomp profile"
This reverts commit 7e3a596a63.

Unfortunately, it was pointed out in https://github.com/moby/moby/pull/29076#commitcomment-21831387
that the `socketcall` syscall takes a pointer to a struct so it is not possible to
use seccomp profiles to filter it. This means these cannot be blocked as you can
use `socketcall` to call them regardless, as we currently allow 32 bit syscalls.

Users who wish to block these should use a seccomp profile that blocks all
32 bit syscalls and then just block the non socketcall versions.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-05-09 14:26:00 +01:00
Vincent Demeester
1858656925
Move TearDownTest cleaning to environment package
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2017-03-01 21:04:11 +01:00
Justin Cormack
7e3a596a63 Block obsolete socket families in the default seccomp profile
Linux supports many obsolete address families, which are usually available in
common distro kernels, but they are less likely to be properly audited and
may have security issues

This blocks all socket families in the socket (and socketcall where applicable) syscall
except
- AF_UNIX - Unix domain sockets
- AF_INET - IPv4
- AF_INET6 - IPv6
- AF_NETLINK - Netlink sockets for communicating with the ekrnel
- AF_PACKET - raw sockets, which are only allowed with CAP_NET_RAW

All other socket families are blocked, including Appletalk (native, not
over IP), IPX (remember that!), VSOCK and HVSOCK, which should not generally
be used in containers, etc.

Note that users can of course provide a profile per container or in the daemon
config if they have unusual use cases that require these.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
2017-01-17 17:50:44 +00:00
Vincent Demeester
c8016e669f
Use testEnv methods and remove most of the global variables
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2017-01-17 12:39:08 +01:00
Vincent Demeester
33968e6c7d
Remove pkg/integration and move it to testutil or integration-cli
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2016-12-30 18:26:34 +01:00
Vincent Demeester
433e2e8a1e
Introduce a environment package in integration-cli
Signed-off-by: Vincent Demeester <vincent@sbr.pm>
2016-12-29 11:00:50 +01:00
Renamed from integration-cli/fixtures_linux_daemon.go (Browse further)