Test to ensure nosuid,nodev,noexec are set on /etc/reolv.conf mount.

vinayakankugoyal · vinayakankugoyal · commit 990199a021fc · 2023-03-29T20:34:05.000Z
Signed-off-by: Vinayak Goyal &lt;vinaygo@google.com&gt;
diff --git a/pkg/cri/server/sandbox_run_linux_test.go b/pkg/cri/server/sandbox_run_linux_test.go
@@ -91,6 +91,14 @@ func getRunPodSandboxTestData() (*runtime.PodSandboxConfig, *imagespec.ImageConf
 			assert.NotEqual(t, "", spec.Process.SelinuxLabel)
 			assert.NotEqual(t, "", spec.Linux.MountLabel)
 		}
+
+		assert.Contains(t, spec.Mounts, runtimespec.Mount{
+			Source:      "/test/root/sandboxes/test-id/resolv.conf",
+			Destination: resolvConfPath,
+			Type:        "bind",
+			Options:     []string{"rbind", "ro", "nosuid", "nodev", "noexec"},
+		})
+
 	}
 	return config, imageConfig, specCheck
 }

Original file line number	Diff line number	Diff line change
`@@ -91,6 +91,14 @@ func getRunPodSandboxTestData() (runtime.PodSandboxConfig, imagespec.ImageConf`
`91`	`91`	`assert.NotEqual(t, "", spec.Process.SelinuxLabel)`
`92`	`92`	`assert.NotEqual(t, "", spec.Linux.MountLabel)`
`93`	`93`	`}`
	`94`	`+`
	`95`	`+ assert.Contains(t, spec.Mounts, runtimespec.Mount{`
	`96`	`+ Source: "/test/root/sandboxes/test-id/resolv.conf",`
	`97`	`+ Destination: resolvConfPath,`
	`98`	`+ Type: "bind",`
	`99`	`+ Options: []string{"rbind", "ro", "nosuid", "nodev", "noexec"},`
	`100`	`+ })`
	`101`	`+`
`94`	`102`	`}`
`95`	`103`	`return config, imageConfig, specCheck`
`96`	`104`	`}`