Skip to content

Commit

Permalink
make test generic
Browse files Browse the repository at this point in the history
Signed-off-by: Mai Bui <[email protected]>
  • Loading branch information
maipbui committed Jul 5, 2023
1 parent 28f3c99 commit 5ba3fa6
Showing 1 changed file with 12 additions and 10 deletions.
22 changes: 12 additions & 10 deletions tests/container_hardening/test_container_hardening.py
Original file line number Diff line number Diff line change
Expand Up @@ -9,15 +9,17 @@
logger = logging.getLogger(__name__)


def test_bgp_dev(duthost):
def test_container_privileged(duthost):
"""
Test bgp container has no access to /dev/vda* or /dev/sda*
Test container without --privileged flag has no access to /dev/vda* or /dev/sda*
"""
cmd = duthost.shell("docker exec bgp bash -c 'df -h | grep /etc/hosts' | awk '{print $1}'")
rc, device = cmd['rc'], cmd['stdout']
if rc != 0:
pytest_assert(False, 'Failed to get the device name.')
if not device.startswith('/dev/'):
pytest_assert(False, 'Invalid device {}.'.format(device))
output = duthost.shell("docker exec bgp bash -c 'ls {}'".format(device), module_ignore_errors=True)['stdout']
pytest_assert(not output, 'The partition {} exists.'.format(device))
container_names = duthost.shell(r'docker ps -a --format \{\{.Names\}\}')['stdout_lines']
for container_name in container_names:
if container_name == 'bgp':
docker_exec_cmd = 'docker exec {} bash -c '.format(container_name)
cmd = duthost.shell(docker_exec_cmd + "'df -h | grep /etc/hosts' | awk '{print $1}'")
rc, device = cmd['rc'], cmd['stdout']
pytest_assert(rc == 0, 'Failed to get the device name.')
pytest_assert(device.startswith('/dev/'), 'Invalid device {}.'.format(device))
output = duthost.shell(docker_exec_cmd + "'ls {}'".format(device), module_ignore_errors=True)['stdout']
pytest_assert(not output, 'The partition {} exists.'.format(device))

0 comments on commit 5ba3fa6

Please sign in to comment.