Add is_privileged.sh

is_privileged.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+
+set -eu
+
+if [ "${DEBUG:-}" = true ]; then
+  set -x
+fi
+
+verbose() {
+  if [ "${VERBOSE:-}" = true ]; then
+    echo "VERBOSE(is_privileged.sh):" "$@" >&2
+  fi
+}
+
+# Get the capability bounding set
+cap_bnd=$(grep '^CapBnd:' /proc/$$/status | awk '{print $2}')
+# Convert to decimal
+cap_bnd=$(printf "%d" "0x${cap_bnd}")
+
+# Get the last capability number
+last_cap=$(cat /proc/sys/kernel/cap_last_cap)
+
+# Calculate the maximum capability value
+max_cap=$(((1 << (last_cap + 1)) - 1))
+
+if [ "${cap_bnd}" -eq "${max_cap}" ]; then
+  verbose "Container is running in privileged mode."
+  exit 0
+else
+  verbose "Container is not running in privileged mode."
+  exit 1
+fi

tests/test.sh

@@ -24,6 +24,12 @@ function expect() {
   fi
 }
 
+## is_privileged.sh tests
+"${docker_cmd[@]}" alpine sh -c './is_privileged.sh; echo $?' | expect 1
+"${docker_cmd[@]}" --privileged alpine sh -c './is_privileged.sh; echo $?' | expect 0
+"${docker_cmd[@]}" ubuntu sh -c './is_privileged.sh; echo $?' | expect 1
+"${docker_cmd[@]}" --privileged ubuntu sh -c './is_privileged.sh; echo $?' | expect 0
+
 ## get_cpus.sh test
 machine_cpus=$(grep -c ^processor /proc/cpuinfo)