From 9569e385036c05c0bf9fbccdbf3d131161398e2e Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Tue, 4 Feb 2020 13:49:01 +0100 Subject: [PATCH] test: adapt to the new capsh format Since libcap v2.29 the format of cap_to_text() has been changed which makes certain `test-execute` subtest fail. Let's remove the offending part of the output (dropped capabilities) to make it compatible with both the old and the new libcap. --- test/test-execute/exec-capabilityboundingset-invert.service | 3 ++- .../exec-privatedevices-no-capability-mknod.service | 3 ++- .../exec-privatedevices-no-capability-sys-rawio.service | 3 ++- .../exec-privatedevices-yes-capability-mknod.service | 3 ++- .../exec-privatedevices-yes-capability-sys-rawio.service | 3 ++- .../exec-protectkernellogs-no-capabilities.service | 3 ++- .../exec-protectkernellogs-yes-capabilities.service | 3 ++- .../exec-protectkernelmodules-no-capabilities.service | 3 ++- .../exec-protectkernelmodules-yes-capabilities.service | 3 ++- 9 files changed, 18 insertions(+), 9 deletions(-) diff --git a/test/test-execute/exec-capabilityboundingset-invert.service b/test/test-execute/exec-capabilityboundingset-invert.service index 1abe3906016..5f374276034 100644 --- a/test/test-execute/exec-capabilityboundingset-invert.service +++ b/test/test-execute/exec-capabilityboundingset-invert.service @@ -2,6 +2,7 @@ Description=Test for CapabilityBoundingSet [Service] -ExecStart=/bin/sh -x -c '! capsh --print | grep "^Bounding set .*cap_chown"' +# sed: remove dropped capabilities (cap_xxx-[epi]) from the output +ExecStart=/bin/sh -x -c '! capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep "^Bounding set .*cap_chown"' Type=oneshot CapabilityBoundingSet=~CAP_CHOWN diff --git a/test/test-execute/exec-privatedevices-no-capability-mknod.service b/test/test-execute/exec-privatedevices-no-capability-mknod.service index 6d39469da8f..4d61d9ffaa9 100644 --- a/test/test-execute/exec-privatedevices-no-capability-mknod.service +++ b/test/test-execute/exec-privatedevices-no-capability-mknod.service @@ -3,5 +3,6 @@ Description=Test CAP_MKNOD capability for PrivateDevices=no [Service] PrivateDevices=no -ExecStart=/bin/sh -x -c 'capsh --print | grep cap_mknod' +# sed: remove dropped capabilities (cap_xxx-[epi]) from the output +ExecStart=/bin/sh -x -c 'capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_mknod' Type=oneshot diff --git a/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service b/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service index e7f529c44c6..f7f7a16736d 100644 --- a/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service +++ b/test/test-execute/exec-privatedevices-no-capability-sys-rawio.service @@ -3,5 +3,6 @@ Description=Test CAP_SYS_RAWIO capability for PrivateDevices=no [Service] PrivateDevices=no -ExecStart=/bin/sh -x -c 'capsh --print | grep cap_sys_rawio' +# sed: remove dropped capabilities (cap_xxx-[epi]) from the output +ExecStart=/bin/sh -x -c 'capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_sys_rawio' Type=oneshot diff --git a/test/test-execute/exec-privatedevices-yes-capability-mknod.service b/test/test-execute/exec-privatedevices-yes-capability-mknod.service index fb1fc2875a3..5bcace08455 100644 --- a/test/test-execute/exec-privatedevices-yes-capability-mknod.service +++ b/test/test-execute/exec-privatedevices-yes-capability-mknod.service @@ -3,5 +3,6 @@ Description=Test CAP_MKNOD capability for PrivateDevices=yes [Service] PrivateDevices=yes -ExecStart=/bin/sh -x -c '! capsh --print | grep cap_mknod' +# sed: remove dropped capabilities (cap_xxx-[epi]) from the output +ExecStart=/bin/sh -x -c '! capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_mknod' Type=oneshot diff --git a/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service b/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service index cebc493a7ab..a246f950c11 100644 --- a/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service +++ b/test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service @@ -3,5 +3,6 @@ Description=Test CAP_SYS_RAWIO capability for PrivateDevices=yes [Service] PrivateDevices=yes -ExecStart=/bin/sh -x -c '! capsh --print | grep cap_sys_rawio' +# sed: remove dropped capabilities (cap_xxx-[epi]) from the output +ExecStart=/bin/sh -x -c '! capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_sys_rawio' Type=oneshot diff --git a/test/test-execute/exec-protectkernellogs-no-capabilities.service b/test/test-execute/exec-protectkernellogs-no-capabilities.service index f0c7d4d6858..47d88534a9b 100644 --- a/test/test-execute/exec-protectkernellogs-no-capabilities.service +++ b/test/test-execute/exec-protectkernellogs-no-capabilities.service @@ -3,5 +3,6 @@ Description=Test CAP_SYSLOG for ProtectKernelLogs=no [Service] ProtectKernelLogs=no -ExecStart=/bin/sh -x -c 'capsh --print | grep cap_syslog' +# sed: remove dropped capabilities (cap_xxx-[epi]) from the output +ExecStart=/bin/sh -x -c 'capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_syslog' Type=oneshot diff --git a/test/test-execute/exec-protectkernellogs-yes-capabilities.service b/test/test-execute/exec-protectkernellogs-yes-capabilities.service index 803ba7d5521..11350f288a5 100644 --- a/test/test-execute/exec-protectkernellogs-yes-capabilities.service +++ b/test/test-execute/exec-protectkernellogs-yes-capabilities.service @@ -3,5 +3,6 @@ Description=Test CAP_SYSLOG for ProtectKernelLogs=yes [Service] ProtectKernelLogs=yes -ExecStart=/bin/sh -x -c '! capsh --print | grep cap_syslog' +# sed: remove dropped capabilities (cap_xxx-[epi]) from the output +ExecStart=/bin/sh -x -c '! capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_syslog' Type=oneshot diff --git a/test/test-execute/exec-protectkernelmodules-no-capabilities.service b/test/test-execute/exec-protectkernelmodules-no-capabilities.service index b2f2cd6b8ab..8d7e2b52d44 100644 --- a/test/test-execute/exec-protectkernelmodules-no-capabilities.service +++ b/test/test-execute/exec-protectkernelmodules-no-capabilities.service @@ -3,5 +3,6 @@ Description=Test CAP_SYS_MODULE ProtectKernelModules=no [Service] ProtectKernelModules=no -ExecStart=/bin/sh -x -c 'capsh --print | grep cap_sys_module' +# sed: remove dropped capabilities (cap_xxx-[epi]) from the output +ExecStart=/bin/sh -x -c 'capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_sys_module' Type=oneshot diff --git a/test/test-execute/exec-protectkernelmodules-yes-capabilities.service b/test/test-execute/exec-protectkernelmodules-yes-capabilities.service index 84bf39be569..fe2ae208dd2 100644 --- a/test/test-execute/exec-protectkernelmodules-yes-capabilities.service +++ b/test/test-execute/exec-protectkernelmodules-yes-capabilities.service @@ -3,5 +3,6 @@ Description=Test CAP_SYS_MODULE for ProtectKernelModules=yes [Service] ProtectKernelModules=yes -ExecStart=/bin/sh -x -c '! capsh --print | grep cap_sys_module' +# sed: remove dropped capabilities (cap_xxx-[epi]) from the output +ExecStart=/bin/sh -x -c '! capsh --print | sed -r "s/[^ ]+?\-[epi]+//g" | grep cap_sys_module' Type=oneshot