1#!/usr/bin/env bash
2# Detect if we are running inside bats (i.e. inside integration tests) or just
3# called by an end-user
4# bats-core v1.2.1 defines BATS_RUN_TMPDIR
5if [ -z "$BATS_RUN_TMPDIR" ]; then
6 # When not running in bats, we create the config.json
7 set -e
8 runc spec
9fi
10
11# We can't source $(dirname $0)/../../../tests/integration/helpers.bash as that
12# exits when not running inside bats. We can do hacks, but just to redefine
13# update_config() seems clearer. We don't even really need to keep them in sync.
14function update_config() {
15 jq "$1" "./config.json" | awk 'BEGIN{RS="";getline<"-";print>ARGV[1]}' "./config.json"
16}
17
18update_config '.linux.seccomp = {
19 "defaultAction": "SCMP_ACT_ALLOW",
20 "listenerPath": "/run/seccomp-agent.socket",
21 "listenerMetadata": "foo",
22 "architectures": [ "SCMP_ARCH_X86", "SCMP_ARCH_X32", "SCMP_ARCH_X86_64" ],
23 "syscalls": [
24 {
25 "names": [ "chmod", "fchmod", "fchmodat", "mkdir" ],
26 "action": "SCMP_ACT_NOTIFY"
27 }
28 ]
29 }'
30
31update_config '.process.args = [
32 "sh",
33 "-c",
34 "set -x; cd /dev/shm; mkdir test-dir; touch test-file; chmod 777 test-file; stat /dev/shm/test-dir-foo && ls -l /dev/shm && echo \"Note the agent added a suffix for the directory name and chmod fails\" "
35 ]'
View as plain text