security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 35 Wiki Activity

nix: verify silent signal exit
All checks were successful
Test / Create distribution (push) Successful in 25s
Details
Test / Fortify (push) Successful in 1m40s
Details
Test / Data race detector (push) Successful in 2m1s
Details
Test / Flake checks (push) Successful in 41s
Details

Browse Source 
This catches errors in the cleanup process initiated by a signal.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-02-25 01:17:01 +09:00
parent 1818dc3a4c
commit b4549c72be
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
1 changed files with 18 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
test/test.py
View File

@ -110,12 +110,28 @@ output = machine.succeed("sudo -u alice -i fortify run -a 0 true &>/dev/stdout")
if output != "": if output != "":
raise Exception(f"unexpected output\n{output}") raise Exception(f"unexpected output\n{output}")
# Verify silent output permissive defaults signal:
def silent_output_interrupt(flags):
# aid 0 does not have home-manager
fortify(f"run {flags}-a 0 sh -c 'export PATH=/run/current-system/sw/bin:$PATH && touch /tmp/pd-silent-ready && sleep infinity' &>/tmp/pd-silent")
machine.wait_for_file("/tmp/fortify.1000/tmpdir/0/pd-silent-ready")
machine.succeed("rm /tmp/fortify.1000/tmpdir/0/pd-silent-ready")
machine.succeed(f"sudo -u alice pkill -u alice -f 'fortify run {flags}-a 0 '")
machine.wait_until_fails(f"sudo -u alice pgrep -u alice -f 'fortify run {flags}-a 0 '")
output = machine.succeed("cat /tmp/pd-silent && rm /tmp/pd-silent")
if output != "":
raise Exception(f"unexpected output\n{output}")
silent_output_interrupt("")
silent_output_interrupt("--dbus ") # this one is especially painful as it maintains a helper
silent_output_interrupt("--wayland -X --dbus --pulse ")
# Verify graceful failure on bad Wayland display name: # Verify graceful failure on bad Wayland display name:
print(machine.fail("sudo -u alice -i fortify -v run --wayland true")) print(machine.fail("sudo -u alice -i fortify -v run --wayland true"))
# Start fortify permissive defaults within Wayland session: # Start fortify permissive defaults within Wayland session:
fortify( fortify('-v run --wayland --dbus notify-send -a "NixOS Tests" "Test notification" "Notification from within sandbox." && touch /tmp/dbus-done')
'-v run --wayland --dbus notify-send -a "NixOS Tests" "Test notification" "Notification from within sandbox." && touch /tmp/dbus-done')
machine.wait_for_file("/tmp/dbus-done") machine.wait_for_file("/tmp/dbus-done")
collect_state_ui("dbus_notify_exited") collect_state_ui("dbus_notify_exited")
machine.succeed("pkill -9 mako") machine.succeed("pkill -9 mako")