This test verifies that an operation ('ping') that needs `NET_RAW` capability does not succeed if the capability `NET_RAW` is dropped.
| 80 | // This test verifies that an operation ('ping') that needs `NET_RAW` |
| 81 | // capability does not succeed if the capability `NET_RAW` is dropped. |
| 82 | TEST_F(CapabilitiesTest, ROOT_PingWithNoNetRawCaps) |
| 83 | { |
| 84 | Try<Capabilities> manager = Capabilities::create(); |
| 85 | ASSERT_SOME(manager); |
| 86 | |
| 87 | Try<ProcessCapabilities> capabilities = manager->get(); |
| 88 | ASSERT_SOME(capabilities); |
| 89 | |
| 90 | capabilities->drop(capabilities::PERMITTED, capabilities::NET_RAW); |
| 91 | |
| 92 | Try<Subprocess> s = ping(capabilities->get(capabilities::PERMITTED)); |
| 93 | ASSERT_SOME(s); |
| 94 | |
| 95 | AWAIT_EXPECT_WEXITSTATUS_NE(0, s->status()); |
| 96 | } |
| 97 | |
| 98 | |
| 99 | // This test verifies that the effective capabilities of a process can |