Function compileAndExecSocketDenied

integration/container/exec_afalg_linux_test.go:31–60

compileAndExecSocketDenied writes a C source file into the container, compiles it with the given compiler command, runs the binary as uid 1000, and asserts that socket creation fails.

(ctx context.Context, t *testing.T, apiClient client.APIClient, cID string, name string, src string, cc []string)

// compiles it with the given compiler command, runs the binary as uid 1000,
// and asserts that socket creation fails.
func compileAndExecSocketDenied(ctx context.Context, t *testing.T, apiClient client.APIClient, cID string, name string, src string, cc []string) {
	t.Helper()

	binPath := "/tmp/" + name
	srcPath := binPath + ".c"

	res := container.ExecT(ctx, t, apiClient, cID, []string{
		"sh", "-c", "cat > " + srcPath + " << 'CEOF'\n" + src + "\nCEOF",
	})
	res.AssertSuccess(t)

	compileCmd := append(cc, srcPath, "-o", binPath)
	res = container.ExecT(ctx, t, apiClient, cID, compileCmd)
	res.AssertSuccess(t)

	res, err := container.Exec(ctx, apiClient, cID, []string{binPath},
		func(ec *client.ExecCreateOptions) {
			ec.User = "1000"
		},
	)
	assert.NilError(t, err)
	assert.Check(t, is.Equal(res.ExitCode, 1), "expected %s socket program to fail", name)

	out := strings.ToLower(res.Combined())
	assert.Check(t, is.Contains(out, "socket"), "expected socket-related error message")
	// Seccomp returns EPERM ("not permitted"), AppArmor returns EACCES
	// ("permission denied"). Accept either.
	denied := strings.Contains(out, "not permitted") || strings.Contains(out, "permission denied")
	assert.Check(t, denied, "expected EPERM or EACCES, got: %s", res.Combined())
}

// TestExecSocketDenied verifies that AF_ALG and AF_VSOCK sockets cannot be
// created inside a container. AF_ALG is blocked by the default seccomp profile