| 724 | |
| 725 | |
| 726 | TEST_F(LinuxCapabilitiesIsolatorFlagsTest, ROOT_IsolatorFlags) |
| 727 | { |
| 728 | StandaloneMasterDetector detector; |
| 729 | |
| 730 | slave::Flags flags = CreateSlaveFlags(); |
| 731 | flags.isolation = "linux/capabilities"; |
| 732 | |
| 733 | Try<Owned<cluster::Slave>> slave = Owned<cluster::Slave>(); |
| 734 | |
| 735 | // Allowed is not a subset of bounding, so this should fail. |
| 736 | flags.effective_capabilities = convert(set<Capability>({NET_RAW, NET_ADMIN})); |
| 737 | flags.bounding_capabilities = convert(set<Capability>({NET_RAW})); |
| 738 | slave = StartSlave(&detector, flags); |
| 739 | ASSERT_ERROR(slave); |
| 740 | |
| 741 | // Allowed is the same as bounding, which is OK. |
| 742 | flags.effective_capabilities = convert(set<Capability>({NET_RAW, NET_ADMIN})); |
| 743 | flags.bounding_capabilities = convert(set<Capability>({NET_RAW, NET_ADMIN})); |
| 744 | slave = StartSlave(&detector, flags); |
| 745 | ASSERT_SOME(slave); |
| 746 | |
| 747 | slave->reset(); |
| 748 | |
| 749 | // Allowed is a subset of bounding, which is OK. |
| 750 | flags.effective_capabilities = convert(set<Capability>({NET_RAW})); |
| 751 | flags.bounding_capabilities = convert(set<Capability>({NET_RAW, NET_ADMIN})); |
| 752 | slave = StartSlave(&detector, flags); |
| 753 | ASSERT_SOME(slave); |
| 754 | |
| 755 | slave->reset(); |
| 756 | |
| 757 | // Both sets are allowed to be missing. |
| 758 | flags.effective_capabilities = None(); |
| 759 | flags.bounding_capabilities = None(); |
| 760 | slave = StartSlave(&detector, flags); |
| 761 | ASSERT_SOME(slave); |
| 762 | |
| 763 | slave->reset(); |
| 764 | |
| 765 | // Bounding capabilities are allowed to be missing. |
| 766 | flags.effective_capabilities = convert(set<Capability>({NET_RAW})); |
| 767 | flags.bounding_capabilities = None(); |
| 768 | slave = StartSlave(&detector, flags); |
| 769 | ASSERT_SOME(slave); |
| 770 | |
| 771 | slave->reset(); |
| 772 | |
| 773 | // Effective capabilities are allowed to be missing. |
| 774 | flags.effective_capabilities = None(); |
| 775 | flags.bounding_capabilities = convert(set<Capability>({NET_RAW})); |
| 776 | slave = StartSlave(&detector, flags); |
| 777 | ASSERT_SOME(slave); |
| 778 | } |
| 779 | |
| 780 | } // namespace tests { |
| 781 | } // namespace internal { |