49600a6f46
container/stub: export stub helpers
...
These are very useful in many packages containing relatively large amount of code making calls to difficult or impossible to stub functions.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-31 23:11:25 +09:00
780e3e5465
container/msg: optionally provide error messages
...
This makes handling of fatal errors a lot less squirmy.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-31 11:57:59 +09:00
712cfc06d7
container: wrap container init start errors
...
This helps indicate the exact origin and nature of the error. This eliminates generic WrapErr from container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-30 23:44:48 +09:00
08eeafe817
container/mount: unwrap vfs decoder errors
...
These are now handled by init. This eliminates generic WrapErr from mount and procPaths.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 22:15:05 +09:00
d7c7c69a13
container/dispatcher: check simple test errors via reflect
...
Again, avoids the errors package concealing unexpected behaviours.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 22:12:21 +09:00
50972096cd
container/vfs: wrap decoder errors
...
This passes line information and handles strconv errors so it reads better.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 21:51:31 +09:00
905b9f9785
container/initoverlay: invalid argument type
...
This eliminates generic WrapErr from overlay.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 02:56:56 +09:00
1c7e634f09
container/dispatcher: check test errors via reflect
...
Using the errors package might conceal some incorrect behaviour.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 02:35:24 +09:00
8d472ebf2b
container/inittmpfs: unwrap out of bounds error
...
This eliminates generic WrapErr from tmpfs.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 02:15:48 +09:00
4da6463135
container/init: unwrap path errors
...
These are also now handled by init properly, so wrapping them in self is meaningless and unreachable.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 02:04:09 +09:00
eb3385d490
container/initsymlink: unwrap mount errors
...
The mount function now wraps its own errors in a much more descriptive type with proper message formatting. Wrapping them no longer makes any sense.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 01:46:54 +09:00
b8669338da
container/initsymlink: unwrap absolute error
...
This is now handled properly by the init.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 01:43:11 +09:00
f24dd4ab8c
container/init: handle unwrapped errors
...
This is much cleaner from both the return statement and the error handling.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 01:37:13 +09:00
a462341a0a
container: repeat and impossible state types
...
This moves repeated Op errors and impossible internal state errors off of msg.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 01:12:02 +09:00
84ad9791e2
container: wrap mount syscall errno
...
This is the first step to deprecating the generalised error wrapping error message pattern.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-29 01:06:12 +09:00
9bc8532d56
container/initdev: mount tmpfs on shm for ro dev
...
Programs expect /dev/shm to be a writable tmpfs.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-26 03:27:07 +09:00
2e0a4795f6
container/initbind: optional ensure host directory
...
This is used for ensuring persistent data directories specific to the container.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-26 00:44:45 +09:00
8db906ee64
container/dispatcher: remove exit stub test log
...
Turns out testing.T does not like being called in defer.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-25 17:33:35 +09:00
cedfceded5
container/autoroot: remove prefix field
...
This field has been a noop for a long time. Remove it to prevent further confusion.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-25 03:39:20 +09:00
33d2dcce1b
container/initoverlay: internal bypass sysroot prefix
...
This is for supporting overlay mounts for autoroot.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-25 02:42:22 +09:00
2baa2d7063
container/init: measure init behaviour
...
This used to be entirely done via integration tests, with almost no hope of error injection and coverage profile. These tests significantly increase confidence of future work in this area.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-24 04:52:32 +09:00
0166833431
container/dispatcher: start goroutine in dispatcher
...
This allows instrumentation of calls from goroutine without relying on finalizers.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-23 21:58:40 +09:00
b3da3da525
container/init: avoid multiple lastcap calls
...
This reduces the size of []kexpect in the test suite.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-23 11:09:11 +09:00
1b3902df78
container/dispatcher: instrument each goroutine individually
...
Scheduler nondeterminism cannot be accounted for, so do this instead.
There should not be any performance penalty as these calls are optimised out for direct.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-23 11:07:16 +09:00
ea1e3ebae9
container/params: pass fd instead of file
...
The file is very difficult to stub. Pass fd instead as it is the value that is actually useful.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-23 00:16:46 +09:00
1c692bfb79
container/init: call lockOSThread through dispatcher
...
This degrades test performance if not stubbed out.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-22 22:24:14 +09:00
141a18999f
container: move integration test helpers
...
With the new instrumentation it is now possible to run init code outside integration tests.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-22 22:07:19 +09:00
afe23600d2
container/path: use syscall dispatcher
...
This allows path and mount functions to be instrumented.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-22 22:02:21 +09:00
09d2844981
container/init: wrap syscall helper functions
...
This allows tests to stub all kernel behaviour, enabling measurement of all function call arguments and error injection.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-22 19:27:31 +09:00
5b73316ae0
container/syscall: doc comments from manpages
...
These are pulled straight from the manpages.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-21 00:33:46 +09:00
5d8a2199b6
container/init: op interface valid method
...
Check ops early and eliminate duplicate checks.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-21 00:18:50 +09:00
a1482ecdd0
container/inittmpfs: check path equivalence by value
...
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 20:17:28 +09:00
a07f9ed84c
container/initsymlink: check path equivalence by value
...
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 20:03:02 +09:00
51304b03af
container/initremount: check path equivalence by value
...
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 19:55:51 +09:00
c6397b941f
container/initproc: check path equivalence by value
...
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 19:29:45 +09:00
d65e5f817a
container/initplace: check path equivalence by value
...
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 19:19:27 +09:00
696e593898
container/initoverlay: check path equivalence by value
...
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 17:33:15 +09:00
97ab24feef
container/init: use absolute compare method
...
More checks are also added.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 17:14:36 +09:00
31f0dd36df
absolute: efficient equivalence check method
...
This is more efficient and makes the call site cleaner.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 17:06:38 +09:00
9aec2f46fe
container/initdev: check path equivalence by value
...
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 02:55:45 +09:00
022cc26b2e
container/capability: check CAP_TO_INDEX and CAP_TO_MASK
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 02:45:00 +09:00
b4c018da8f
container/autoetc: do not bypass absolute check
...
This can now be done cleanly via path function wrappers.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 02:37:11 +09:00
66f52407d3
container/initmkdir: check path equivalence by value
...
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 02:32:22 +09:00
e463faf649
container/initbind: check path equivalence by value
...
Same problem as autoroot, never updated the checks after integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 02:22:04 +09:00
375acb476d
container/autoroot: check host path equivalence by value
...
This will never return true otherwise unless the equivalent paths happen to be interned by the caller.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 02:14:39 +09:00
c81c9a9d75
container/init: split setup ops into individual files
...
This significantly increases readability.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 01:28:31 +09:00
339e4080dc
container/ops: move Op type to init file
...
This helps with the eventual separation of all setup ops into individual files.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 01:11:24 +09:00
e0533aaa68
container/autoroot: filter dentry with empty name
...
This is unreachable, but nice to have just in case.
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 01:03:49 +09:00
13c7083bc0
container: ptrace protection via Yama LSM
...
This is only a nice to have feature as the init process has no additional privileges and the monitor process was never reachable anyway.
Closes #4 .
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-20 00:43:55 +09:00
140fe21237
container/params: check setup/receive behaviour
...
Signed-off-by: Ophestra <cat@gensokyo.uk >
2025-08-18 22:30:34 +09:00
