test: ignore IAB capabilities in `test-execute`
authorFrantisek Sumsal <frantisek@sumsal.cz>
Mon, 9 Mar 2020 10:00:58 +0000 (11:00 +0100)
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
Wed, 18 Mar 2020 19:23:27 +0000 (20:23 +0100)
commit35c4d42040ec4539cbb2fd2391dea21abcf51a35
treec22c6a8edd84af7f212d6128f64068e235fad3f7
parent40737329d960e984e055df4385494779a5841e1a
test: ignore IAB capabilities in `test-execute`

libcap v2.33 introduces a new capability set called IAB[0] which is shown
in the output of `capsh --print` and interferes with the test checks. Let's
drop the IAB set from the output, for now, to mitigate this.

This could be (and probably should be) replaced in the future by the
newly introduced testing options[1][2] in libcap v2.32, namely:
    --has-p=xxx
    --has-i=xxx
    --has-a=xxx

but this needs to wait until the respective libcap version gets a wider
adoption. Until then, let's stick with the relatively ugly sed.

Fixes: #15046

[0] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=943b011b5e53624eb9cab4e96c1985326e077cdd
[1] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=588d0439cb6495b03f0ab9f213f0b6b339e7d4b7
[2] https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=e7709bbc1c4712f2ddfc6e6f42892928a8a03782

(cherry picked from commit e9cdcbed77971da3cb0b98b3eb91081142c91eb7)
test/test-execute/exec-capabilityboundingset-invert.service
test/test-execute/exec-privatedevices-no-capability-mknod.service
test/test-execute/exec-privatedevices-no-capability-sys-rawio.service
test/test-execute/exec-privatedevices-yes-capability-mknod.service
test/test-execute/exec-privatedevices-yes-capability-sys-rawio.service
test/test-execute/exec-protectkernellogs-no-capabilities.service
test/test-execute/exec-protectkernellogs-yes-capabilities.service
test/test-execute/exec-protectkernelmodules-no-capabilities.service
test/test-execute/exec-protectkernelmodules-yes-capabilities.service