Adjust tests related to /etc/shadow #510
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Ordinarily, we would not be able to read /etc/shadow if we're not uid 0; but when building in a sysroot owned by the current user (for example by setting it up using bwrap, as steam-runtime-tools does), we might actually be able to read it. Skip the assertion that we cannot read it in this case. Signed-off-by: Simon McVittie <[email protected]>
The goal of this assertion was to demonstrate that a setuid bwrap does not give us access to otherwise unreadable files, but if we want to check that, we should probably be looking at the bind-mount destination instead of the source file. Leave the old assertion in too, just in case *that* fails. Signed-off-by: Simon McVittie <[email protected]>
RyuzakiKK
approved these changes
May 12, 2022
Contributor
RyuzakiKK
left a comment
RyuzakiKK
left a comment
There was a problem hiding this comment.
I reviewed this patch as part of a steam-runtime-tools MR.
Not a maintainer but LGTM.
Collaborator
Author
|
Timed out waiting for review from another maintainer, merging based on positive review from my colleague @RyuzakiKK. |
zeyuwzy
added a commit
to zeyuwzy/bubblewrap-annotated
that referenced
this pull request
Nov 8, 2022
bubblewrap 0.7.0 New features: * `--size` option controls the size of a subsequent `--tmpfs` (containers#509) * Better error messages if a mount operation fails (containers#472) * Better error message if creating the new user namespace fails with `ENOSPC` (containers#487) * When building as a Meson subproject, a `RUNPATH` can be set on the executable to make it easier to bundle its `libcap` dependency Bug fixes: * When building with Autotools, ensure initial setup for `pkg-config` is not disabled by `--with-bash-completion-dir=PATH` (containers#316, containers#342, containers#441) * Fix test failures when running as uid 0 but with limited capabilities (containers#510) * Use POSIX `command -v` in preference to non-standard `which` (containers#527) * Fix a copy/paste error in `--help` (containers#531) Git-EVTag-v0-SHA512: f4f6e2a92493461c2c39bacc1c3003167162113c88d2142f2041dcb830f3bd3a7df541aad361d1e6ce99576d66bd7eac1065340406e294cd4769b9c4c81c2a2c
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
test-run: Skip a test if we can read /etc/shadow
Ordinarily, we would not be able to read /etc/shadow if we're not uid 0;
but when building in a sysroot owned by the current user (for example
by setting it up using bwrap, as steam-runtime-tools does), we might
actually be able to read it. Skip the assertion that we cannot read it
in this case.
test-run: Add another assertion that we cannot read /etc/shadow
The goal of this assertion was to demonstrate that a setuid bwrap does
not give us access to otherwise unreadable files, but if we want to
check that, we should probably be looking at the bind-mount destination
instead of the source file.
Leave the old assertion in too, just in case that fails.
@RyuzakiKK will probably find this useful.