|
5 | 5 | "testing" |
6 | 6 |
|
7 | 7 | devices "github.com/opencontainers/runc/libcontainer/cgroups/devices/config" |
8 | | - "github.com/opencontainers/runc/libcontainer/specconv" |
9 | 8 | ) |
10 | 9 |
|
11 | 10 | func hash(s, comm string) string { |
@@ -53,6 +52,88 @@ block-0: |
53 | 52 | } |
54 | 53 |
|
55 | 54 | func TestDeviceFilter_BuiltInAllowList(t *testing.T) { |
| 55 | + // This is a copy of all rules from |
| 56 | + // github.com/opencontainers/runc/libcontainer/specconv.AllowedDevices. |
| 57 | + devices := []*devices.Rule{ |
| 58 | + { |
| 59 | + Type: devices.CharDevice, |
| 60 | + Major: devices.Wildcard, |
| 61 | + Minor: devices.Wildcard, |
| 62 | + Permissions: "m", |
| 63 | + Allow: true, |
| 64 | + }, |
| 65 | + { |
| 66 | + Type: devices.BlockDevice, |
| 67 | + Major: devices.Wildcard, |
| 68 | + Minor: devices.Wildcard, |
| 69 | + Permissions: "m", |
| 70 | + Allow: true, |
| 71 | + }, |
| 72 | + { |
| 73 | + Type: devices.CharDevice, |
| 74 | + Major: 1, |
| 75 | + Minor: 3, |
| 76 | + Permissions: "rwm", |
| 77 | + Allow: true, |
| 78 | + }, |
| 79 | + { |
| 80 | + Type: devices.CharDevice, |
| 81 | + Major: 1, |
| 82 | + Minor: 8, |
| 83 | + Permissions: "rwm", |
| 84 | + Allow: true, |
| 85 | + }, |
| 86 | + { |
| 87 | + Type: devices.CharDevice, |
| 88 | + Major: 1, |
| 89 | + Minor: 7, |
| 90 | + Permissions: "rwm", |
| 91 | + Allow: true, |
| 92 | + }, |
| 93 | + { |
| 94 | + Type: devices.CharDevice, |
| 95 | + Major: 5, |
| 96 | + Minor: 0, |
| 97 | + Permissions: "rwm", |
| 98 | + Allow: true, |
| 99 | + }, |
| 100 | + { |
| 101 | + Type: devices.CharDevice, |
| 102 | + Major: 1, |
| 103 | + Minor: 5, |
| 104 | + Permissions: "rwm", |
| 105 | + Allow: true, |
| 106 | + }, |
| 107 | + { |
| 108 | + Type: devices.CharDevice, |
| 109 | + Major: 1, |
| 110 | + Minor: 9, |
| 111 | + Permissions: "rwm", |
| 112 | + Allow: true, |
| 113 | + }, |
| 114 | + { |
| 115 | + Type: devices.CharDevice, |
| 116 | + Major: 136, |
| 117 | + Minor: devices.Wildcard, |
| 118 | + Permissions: "rwm", |
| 119 | + Allow: true, |
| 120 | + }, |
| 121 | + { |
| 122 | + Type: devices.CharDevice, |
| 123 | + Major: 5, |
| 124 | + Minor: 2, |
| 125 | + Permissions: "rwm", |
| 126 | + Allow: true, |
| 127 | + }, |
| 128 | + { |
| 129 | + Type: devices.CharDevice, |
| 130 | + Major: 10, |
| 131 | + Minor: 200, |
| 132 | + Permissions: "rwm", |
| 133 | + Allow: true, |
| 134 | + }, |
| 135 | + } |
| 136 | + |
56 | 137 | expected := ` |
57 | 138 | // load parameters into registers |
58 | 139 | 0: LdXMemW dst: r2 src: r1 off: 0 imm: 0 |
@@ -136,10 +217,6 @@ block-11: |
136 | 217 | 62: MovImm32 dst: r0 imm: 0 |
137 | 218 | 63: Exit |
138 | 219 | ` |
139 | | - var devices []*devices.Rule |
140 | | - for _, device := range specconv.AllowedDevices { |
141 | | - devices = append(devices, &device.Rule) |
142 | | - } |
143 | 220 | testDeviceFilter(t, devices, expected) |
144 | 221 | } |
145 | 222 |
|
|
0 commit comments