testcase for bgp container in container hardening

tests/container_hardening/test_container_hardening.py

@@ -0,0 +1,23 @@
+import pytest
+import logging
+from tests.common.helpers.assertions import pytest_assert
+
+pytestmark = [
+    pytest.mark.topology('any'),
+]
+
+logger = logging.getLogger(__name__)
+
+
+def test_bgp_dev(duthost):
+    """
+    Test bgp container has no access to /dev/vda* or /dev/sda*
+    """
+    cmd = duthost.shell("docker exec bgp bash -c 'df -h | grep /etc/hosts' | awk '{print $1}'")
+    rc, device = cmd['rc'], cmd['stdout']
+    if rc != 0:
+        pytest_assert(False, 'Failed to get the device name.')
+    if not device.startswith('/dev/'):
+        pytest_assert(False, 'Invalid device {}.'.format(device))
+    output = duthost.shell("docker exec bgp bash -c 'ls {}'".format(device), module_ignore_errors=True)['stdout']
+    pytest_assert(not output, 'The partition {} exists.'.format(device))

tests/python3_test_files.txt

@@ -37,6 +37,7 @@ console/test_console_loopback.py
 console/test_console_reversessh.py
 console/test_console_udevrule.py
 container_checker/test_container_checker.py
+container_hardening/test_container_hardening.py
 copp/test_copp.py
 crm/test_crm.py
 dash/test_dash_vnet.py