You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
79 lines
2.2 KiB
79 lines
2.2 KiB
import logging
|
|
|
|
import pytest
|
|
from conftest import proxy
|
|
from plumbum import ProcessExecutionError
|
|
from plumbum.cmd import docker
|
|
|
|
logger = logging.getLogger()
|
|
|
|
|
|
def _check_permissions(allowed_calls, forbidden_calls):
|
|
for args in allowed_calls:
|
|
docker(*args)
|
|
for args in forbidden_calls:
|
|
with pytest.raises(ProcessExecutionError):
|
|
docker(*args)
|
|
|
|
|
|
def test_default_permissions():
|
|
with proxy() as test_container:
|
|
allowed_calls = (("version",),)
|
|
forbidden_calls = (
|
|
("pull", "alpine"),
|
|
("--rm", "alpine", "--name", test_container),
|
|
("logs", test_container),
|
|
("wait", test_container),
|
|
("rm", "-f", test_container),
|
|
("restart", test_container),
|
|
("network", "ls"),
|
|
("config", "ls"),
|
|
("service", "ls"),
|
|
("stack", "ls"),
|
|
("secret", "ls"),
|
|
("plugin", "ls"),
|
|
("info",),
|
|
("system", "info"),
|
|
("build", "."),
|
|
("swarm", "init"),
|
|
)
|
|
_check_permissions(allowed_calls, forbidden_calls)
|
|
|
|
|
|
def test_container_permissions():
|
|
with proxy(CONTAINERS=1) as test_container:
|
|
allowed_calls = [
|
|
("logs", test_container),
|
|
("inspect", test_container),
|
|
]
|
|
forbidden_calls = [
|
|
("wait", test_container),
|
|
("run", "--rm", "alpine"),
|
|
("rm", "-f", test_container),
|
|
("restart", test_container),
|
|
]
|
|
_check_permissions(allowed_calls, forbidden_calls)
|
|
|
|
|
|
def test_post_permissions():
|
|
with proxy(POST=1) as test_container:
|
|
allowed_calls = []
|
|
forbidden_calls = [
|
|
("rm", "-f", test_container),
|
|
("pull", "alpine"),
|
|
("run", "--rm", "alpine"),
|
|
("network", "create", "foobar"),
|
|
]
|
|
_check_permissions(allowed_calls, forbidden_calls)
|
|
|
|
|
|
def test_network_post_permissions():
|
|
with proxy(POST=1, NETWORKS=1):
|
|
allowed_calls = [
|
|
("network", "ls"),
|
|
("network", "create", "foo"),
|
|
("network", "rm", "foo"),
|
|
]
|
|
forbidden_calls = []
|
|
_check_permissions(allowed_calls, forbidden_calls)
|