add support for guarding pipestream with NO_NEW_PRIVS

[libi2ncommon] / test / test_pipestream.cpp

diff --git a/test/test_pipestream.cpp b/test/test_pipestream.cpp
index 974f1a4..16e7635 100644 (file)
--- a/test/test_pipestream.cpp
+++ b/test/test_pipestream.cpp
@@ -393,5 +393,32 @@ BOOST_AUTO_TEST_CASE(env_nil)
 
 BOOST_AUTO_TEST_SUITE_END() /* [pipestream->env] */
 
+BOOST_AUTO_TEST_SUITE(privs)
+
+#define I2N_EXPECT_OUTPUT "the caged whale knows nothing of the mighty deeps"
+const char *const echo_argv [] = { "echo", I2N_EXPECT_OUTPUT, NULL };
+
+/*
+ * this is not as such a functionality test, in the sense that
+ * we can’t easily (let alone portably) test the behavior of suid
+ * binaries. thus we only check that the option is indeed accepted
+ * in a trivial case.
+ */
+BOOST_AUTO_TEST_CASE(no_new_privs)
+{
+    ExecResult exres = ExecResult ();
+
+    const std::string result = capture_exec (echo_argv, exres,
+                                               capture_flag::collect_out
+                                             | capture_flag::search_path
+                                             | capture_flag::no_new_privs);
+
+    BOOST_CHECK(exres.normal_exit);
+    BOOST_CHECK_EQUAL(exres.return_code, EXIT_SUCCESS);
+    BOOST_CHECK_EQUAL(result, (std::string)I2N_EXPECT_OUTPUT + "\n");
+}
+
+BOOST_AUTO_TEST_SUITE_END() /* [pipestream->privs] */
+
 BOOST_AUTO_TEST_SUITE_END() /* [pipestream] */