From cadeaef67cb0f11bd968cfd6a183bcbfc73b0c70 Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Thu, 4 Sep 2025 12:48:35 +0200 Subject: [PATCH] test: Add test for nspawn's handling of cap_net_bind_service --- test/units/TEST-13-NSPAWN.nspawn.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/test/units/TEST-13-NSPAWN.nspawn.sh b/test/units/TEST-13-NSPAWN.nspawn.sh index eccf183d22f..fabb1a3d306 100755 --- a/test/units/TEST-13-NSPAWN.nspawn.sh +++ b/test/units/TEST-13-NSPAWN.nspawn.sh @@ -1470,4 +1470,22 @@ testcase_link_journal_host() { rm -fr "$root" } +testcase_cap_net_bind_service() { + local root + + root="$(mktemp -d /var/lib/machines/TEST-13-NSPAWN.cap-net-bind-service.XXX)" + create_dummy_container "$root" + + # Check that CAP_NET_BIND_SERVICE is available without --private-users + systemd-nspawn --register=no --directory="$root" capsh --has-p=cap_net_bind_service + + # Check that CAP_NET_BIND_SERVICE is not available with --private-users=identity + (! systemd-nspawn --register=no --directory="$root" --private-users=identity capsh --has-p=cap_net_bind_service) + + # Check that CAP_NET_BIND_SERVICE is not available with --private-users=pick + (! systemd-nspawn --register=no --directory="$root" --private-users=pick capsh --has-p=cap_net_bind_service) + + rm -fr "$root" +} + run_testcases -- 2.47.3