From 318df0f7e1f743c7b4ebc979c77ec34d68d0f2e3 Mon Sep 17 00:00:00 2001
From: Ophestra <cat@gensokyo.uk>
Date: Thu, 13 Feb 2025 22:01:16 +0900
Subject: [PATCH] nix: test syscall filter

Signed-off-by: Ophestra <cat@gensokyo.uk>
---
 test.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/test.nix b/test.nix
index 85c4da9..874e619 100644
--- a/test.nix
+++ b/test.nix
@@ -147,6 +147,18 @@ nixosTest {
               pulse = false;
             };
           }
+          {
+            name = "strace-failure";
+            verbose = true;
+            share = pkgs.strace;
+            command = "strace true";
+            capability = {
+              wayland = false;
+              x11 = false;
+              dbus = false;
+              pulse = false;
+            };
+          }
         ];
       };
 
@@ -310,6 +322,9 @@ nixosTest {
     machine.send_chars("exit\n")
     machine.wait_until_fails("pgrep alacritty")
 
+    # Test syscall filter:
+    print(machine.fail("sudo -u alice -i XDG_RUNTIME_DIR=/run/user/1000 strace-failure"))
+
     # Exit Sway and verify process exit status 0:
     swaymsg("exit", succeed=False)
     machine.wait_until_fails("pgrep -x sway")