fortify

Author	SHA1	Message	Date
Ophestra	5098b12e4a	sandbox/vfs: count mountinfo entries All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m39s Details Test / Fpkg (push) Successful in 3m37s Details Test / Data race detector (push) Successful in 4m10s Details Test / Flake checks (push) Successful in 52s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 12:14:33 +09:00
Ophestra	9ddf5794dd	sandbox/vfs: implement proc_pid_mountinfo(5) parser All checks were successful Test / Create distribution (push) Successful in 28s Details Test / Fortify (push) Successful in 2m43s Details Test / Fpkg (push) Successful in 3m38s Details Test / Data race detector (push) Successful in 4m11s Details Test / Flake checks (push) Successful in 53s Details Test cases are mostly taken from util-linux. This implementation is more correct and slightly faster than the one found in github:kubernetes/utils. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 00:35:49 +09:00
Ophestra	b74a08dda9	sandbox: prepare ops early All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m27s Details Test / Fpkg (push) Successful in 3m33s Details Test / Data race detector (push) Successful in 4m9s Details Test / Flake checks (push) Successful in 53s Details Some setup code needs to run in host root. This change allows that to happen. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-18 02:17:46 +09:00
Ophestra	1b9408864f	sandbox: pass cmd to cancel function All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m35s Details Test / Fpkg (push) Successful in 3m36s Details Test / Data race detector (push) Successful in 4m11s Details Test / Flake checks (push) Successful in 49s Details This is not usually in scope otherwise. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 22:36:39 +09:00
Ophestra	cc89dbdf63	sandbox: place files with content All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m35s Details Test / Fpkg (push) Successful in 3m35s Details Test / Data race detector (push) Successful in 4m7s Details Test / Flake checks (push) Successful in 47s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 22:13:22 +09:00
Ophestra	228f3301f2	sandbox: create directories All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m29s Details Test / Fpkg (push) Successful in 3m30s Details Test / Data race detector (push) Successful in 4m2s Details Test / Flake checks (push) Successful in 48s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 22:03:06 +09:00
Ophestra	07181138e5	sandbox/mount: pass absolute path All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m31s Details Test / Fpkg (push) Successful in 3m24s Details Test / Data race detector (push) Successful in 4m6s Details Test / Flake checks (push) Successful in 48s Details This should never be used unless there is a good reason to, like using a file in the intermediate root. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 21:53:31 +09:00
Ophestra	816b372f14	sandbox: cancel process on serve error All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m32s Details Test / Fpkg (push) Successful in 3m28s Details Test / Data race detector (push) Successful in 4m4s Details Test / Flake checks (push) Successful in 49s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 21:49:45 +09:00
Ophestra	d7eddd54a2	sandbox: rename params struct All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m33s Details Test / Fpkg (push) Successful in 3m27s Details Test / Data race detector (push) Successful in 4m3s Details Test / Flake checks (push) Successful in 59s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 21:45:08 +09:00
Ophestra	7c063833e0	internal/sys: wrap getuid/getgid All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m34s Details Test / Fpkg (push) Successful in 3m26s Details Test / Data race detector (push) Successful in 4m8s Details Test / Flake checks (push) Successful in 50s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 17:10:03 +09:00
Ophestra	af3619d440	sandbox: create symlinks All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m30s Details Test / Fpkg (push) Successful in 3m21s Details Test / Data race detector (push) Successful in 4m3s Details Test / Flake checks (push) Successful in 48s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 16:37:56 +09:00
Ophestra	528674cb6e	sandbox/init: fail early on nil op All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m27s Details Test / Fpkg (push) Successful in 3m21s Details Test / Data race detector (push) Successful in 4m3s Details Test / Flake checks (push) Successful in 49s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 16:17:03 +09:00
Ophestra	70c9757e26	sandbox/mount: rename device flag All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m28s Details Test / Fpkg (push) Successful in 3m30s Details Test / Data race detector (push) Successful in 4m5s Details Test / Flake checks (push) Successful in 51s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 16:10:55 +09:00
Ophestra	c83a7e2efc	sandbox: mount container /dev/mqueue All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m26s Details Test / Fpkg (push) Successful in 3m21s Details Test / Data race detector (push) Successful in 4m0s Details Test / Flake checks (push) Successful in 49s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 15:42:40 +09:00
Ophestra	904208b87f	sandbox: unwrap path string All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m35s Details Test / Fpkg (push) Successful in 3m21s Details Test / Data race detector (push) Successful in 4m9s Details Test / Flake checks (push) Successful in 50s Details Mount proc and dev takes no additional parameters. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 15:33:20 +09:00
Ophestra	007b52d81f	sandbox/seccomp: check for both partial read outcomes All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m28s Details Test / Fpkg (push) Successful in 3m17s Details Test / Data race detector (push) Successful in 4m1s Details Test / Flake checks (push) Successful in 47s Details This eliminates intermittent test failures. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 12:51:21 +09:00
Ophestra	3385538142	nix: clean up flake outputs All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fpkg (push) Successful in 32s Details Test / Fortify (push) Successful in 2m0s Details Test / Data race detector (push) Successful in 2m32s Details Test / Flake checks (push) Successful in 48s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 12:26:19 +09:00
Ophestra	24618ab9a1	sandbox: move out of internal All checks were successful Test / Create distribution (push) Successful in 18s Details Test / Fpkg (push) Successful in 2m40s Details Test / Data race detector (push) Successful in 3m13s Details Test / Fortify (push) Successful in 3m1s Details Test / Flake checks (push) Successful in 51s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 02:55:36 +09:00
Ophestra	9ce4706a07	sandbox: move params setup functions All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m37s Details Test / Fpkg (push) Successful in 3m30s Details Test / Data race detector (push) Successful in 4m8s Details Test / Flake checks (push) Successful in 57s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 02:48:32 +09:00
Ophestra	9a1f8e129f	sandbox: wrap fmsg interface All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m27s Details Test / Fpkg (push) Successful in 3m36s Details Test / Data race detector (push) Successful in 4m16s Details Test / Flake checks (push) Successful in 55s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 02:44:07 +09:00
Ophestra	ee10860357	seccomp: install output atomically All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m33s Details Test / Fpkg (push) Successful in 3m17s Details Test / Data race detector (push) Successful in 4m1s Details Test / Flake checks (push) Successful in 49s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 01:10:27 +09:00
Ophestra	44277dc0f1	dbus: run in native sandbox All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m31s Details Test / Fpkg (push) Successful in 3m25s Details Test / Data race detector (push) Successful in 4m5s Details Test / Flake checks (push) Successful in 53s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 00:13:14 +09:00
Ophestra	bc54db54d2	ldd: always copy stderr All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m30s Details Test / Fpkg (push) Successful in 3m34s Details Test / Data race detector (push) Successful in 3m55s Details Test / Flake checks (push) Successful in 53s Details Dropping the buffer on success is unhelpful and could hide some useful information. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 00:08:00 +09:00
Ophestra	bf07b7cd9e	ldd: mount /proc in container All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fpkg (push) Successful in 3m45s Details Test / Data race detector (push) Successful in 4m0s Details Test / Fortify (push) Successful in 1m54s Details Test / Flake checks (push) Successful in 53s Details This covers host /proc. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 00:01:03 +09:00
Ophestra	5d3c8dcc92	test: raise timeout All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fpkg (push) Successful in 32s Details Test / Fortify (push) Successful in 2m11s Details Test / Data race detector (push) Successful in 2m42s Details Test / Flake checks (push) Successful in 51s Details Native container tooling is severely slowed down by race detector. Raise timeout so it reliably completes. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 23:51:17 +09:00
Ophestra	48feca800f	sandbox: check command function pointer All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m37s Details Test / Fpkg (push) Successful in 3m25s Details Test / Data race detector (push) Successful in 3m59s Details Test / Flake checks (push) Successful in 55s Details Setting default CommandContext on initialisation is somewhat of a footgun. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 23:29:14 +09:00
Ophestra	42de09e896	helper: implement native container backend All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m36s Details Test / Fpkg (push) Successful in 3m23s Details Test / Data race detector (push) Successful in 3m52s Details Test / Flake checks (push) Successful in 49s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 02:57:46 +09:00
Ophestra	1576fea8a3	helper: raise WaitDelay during tests All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fpkg (push) Successful in 3m19s Details Test / Data race detector (push) Successful in 3m54s Details Test / Fortify (push) Successful in 1m39s Details Test / Flake checks (push) Successful in 49s Details Helper runs very slowly with race detector. This prevents it from timing out. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 02:49:41 +09:00
Ophestra	ae522ab364	test: run go tests with race detector All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fpkg (push) Successful in 32s Details Test / Fortify (push) Successful in 2m21s Details Test / Data race detector (push) Successful in 2m38s Details Test / Flake checks (push) Successful in 48s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 02:07:42 +09:00
Ophestra	273d97af85	ldd: lib paths resolve function All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m37s Details Test / Fpkg (push) Successful in 3m37s Details Test / Data race detector (push) Successful in 3m50s Details Test / Flake checks (push) Successful in 56s Details This is what always happens right after a ldd call, so implement it here. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 01:20:09 +09:00
Ophestra	891316d924	helper/stub: copy args to stderr All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m33s Details Test / Fpkg (push) Successful in 3m30s Details Test / Data race detector (push) Successful in 3m52s Details Test / Flake checks (push) Successful in 53s Details Some helpers are implemented via go test itself in tests, and as a result stdout gets clobbered. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 00:39:42 +09:00
Ophestra	9f5dad1998	sandbox: return on zero length ops All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m30s Details Test / Fpkg (push) Successful in 3m24s Details Test / Data race detector (push) Successful in 3m53s Details Test / Flake checks (push) Successful in 52s Details This dodges potentially confusing behaviour where init fails due to Ops being clobbered during transfer. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 00:32:36 +09:00
Ophestra	6e7ddb2d2e	helper: eliminate commandContext replacement All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m44s Details Test / Fpkg (push) Successful in 3m42s Details Test / Data race detector (push) Successful in 3m51s Details Test / Flake checks (push) Successful in 57s Details This is done more cleanly by modifying Args in cmdF. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 00:01:25 +09:00
Ophestra	bac4e67867	sandbox/init: early params nil check All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m31s Details Test / Fpkg (push) Successful in 3m48s Details Test / Data race detector (push) Successful in 3m53s Details Test / Flake checks (push) Successful in 51s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-15 04:03:10 +09:00
Ophestra	4230281194	sandbox: return error on doubled start All checks were successful Test / Create distribution (push) Successful in 18s Details Test / Fpkg (push) Successful in 35s Details Test / Fortify (push) Successful in 38s Details Test / Data race detector (push) Successful in 36s Details Test / Flake checks (push) Successful in 58s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-15 03:30:14 +09:00
Ophestra	e64e7608ca	sandbox: expose cancel behaviour All checks were successful Test / Create distribution (push) Successful in 40s Details Test / Fpkg (push) Successful in 11m53s Details Test / Fortify (push) Successful in 1m57s Details Test / Data race detector (push) Successful in 2m33s Details Test / Flake checks (push) Successful in 58s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-15 03:04:27 +09:00
Ophestra	10a21ce3ef	helper: expose extra files to direct All checks were successful Test / Create distribution (push) Successful in 42s Details Test / Fpkg (push) Successful in 11m23s Details Test / Fortify (push) Successful in 5m32s Details Test / Data race detector (push) Successful in 2m35s Details Test / Flake checks (push) Successful in 56s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-15 02:27:40 +09:00
Ophestra	0f1f0e4364	helper: combine helper ipc setup All checks were successful Test / Create distribution (push) Successful in 43s Details Test / Fortify (push) Successful in 6m53s Details Test / Fpkg (push) Successful in 11m51s Details Test / Data race detector (push) Successful in 2m32s Details Test / Flake checks (push) Successful in 56s Details The two-step args call is no longer necessary since stat is passed on initialisation. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-15 02:10:22 +09:00
Ophestra	f9bf20a3c7	helper: rearrange initialisation args All checks were successful Test / Create distribution (push) Successful in 41s Details Test / Fortify (push) Successful in 3m3s Details Test / Data race detector (push) Successful in 4m32s Details Test / Fpkg (push) Successful in 4m47s Details Test / Flake checks (push) Successful in 1m3s Details This improves consistency across two different helper implementations. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-15 01:06:31 +09:00
Ophestra	73c1a83032	helper: move process wrapper to direct All checks were successful Test / Create distribution (push) Successful in 27s Details Test / Fortify (push) Successful in 2m42s Details Test / Fpkg (push) Successful in 3m49s Details Test / Data race detector (push) Successful in 4m1s Details Test / Flake checks (push) Successful in 59s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-15 00:33:25 +09:00
Ophestra	f443d315ad	helper: clean up interface All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m37s Details Test / Fpkg (push) Successful in 3m40s Details Test / Data race detector (push) Successful in 3m54s Details Test / Flake checks (push) Successful in 59s Details The helper interface was messy due to odd context acquisition order. That has changed, so this cleans it up. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-15 00:27:44 +09:00
Ophestra	9e18d1de77	helper/proc: pass extra files and start All checks were successful Test / Create distribution (push) Successful in 28s Details Test / Fortify (push) Successful in 2m41s Details Test / Fpkg (push) Successful in 3m38s Details Test / Data race detector (push) Successful in 3m53s Details Test / Flake checks (push) Successful in 59s Details For integration with native container tooling. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-14 23:23:57 +09:00
Ophestra	2647a71be1	seccomp: move out of helper All checks were successful Test / Create distribution (push) Successful in 29s Details Test / Fortify (push) Successful in 2m53s Details Test / Fpkg (push) Successful in 4m0s Details Test / Data race detector (push) Successful in 4m9s Details Test / Flake checks (push) Successful in 59s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-14 22:42:40 +09:00
Ophestra	7c60a4d8e8	helper: embed context on creation All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m34s Details Test / Fpkg (push) Successful in 3m22s Details Test / Data race detector (push) Successful in 3m44s Details Test / Flake checks (push) Successful in 49s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-14 18:30:22 +09:00
Ophestra	4bb5d9780f	ldd: run in native sandbox All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m27s Details Test / Fpkg (push) Successful in 3m22s Details Test / Data race detector (push) Successful in 3m43s Details Test / Flake checks (push) Successful in 48s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-14 17:55:55 +09:00
Ophestra	f41fd94628	sandbox: write uid/gid map as init All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m30s Details Test / Fpkg (push) Successful in 3m21s Details Test / Data race detector (push) Successful in 3m39s Details Test / Flake checks (push) Successful in 48s Details This avoids PR_SET_DUMPABLE in the parent process. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-14 17:42:22 +09:00
Ophestra	94895bbacb	sandbox: invert seccomp ruleset defaults All checks were successful Test / Create distribution (push) Successful in 24s Details Test / Fortify (push) Successful in 2m31s Details Test / Fpkg (push) Successful in 3m20s Details Test / Data race detector (push) Successful in 3m35s Details Test / Flake checks (push) Successful in 50s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-14 02:38:32 +09:00
Ophestra	f332200ca4	sandbox: mount container /dev All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m29s Details Test / Fpkg (push) Successful in 3m26s Details Test / Data race detector (push) Successful in 3m33s Details Test / Flake checks (push) Successful in 51s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-14 02:18:44 +09:00
Ophestra	2eff470091	sandbox/mount: pass custom tmpfs name All checks were successful Test / Create distribution (push) Successful in 27s Details Test / Fortify (push) Successful in 2m51s Details Test / Data race detector (push) Successful in 3m53s Details Test / Fpkg (push) Successful in 3m59s Details Test / Flake checks (push) Successful in 55s Details The tmpfs driver allows arbitrary fsname. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-14 02:12:35 +09:00
Ophestra	a092b042ab	sandbox: pass params to setup ops All checks were successful Test / Create distribution (push) Successful in 20s Details Test / Fortify (push) Successful in 2m5s Details Test / Fpkg (push) Successful in 3m26s Details Test / Data race detector (push) Successful in 3m49s Details Test / Flake checks (push) Successful in 55s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-14 02:11:38 +09:00

1 2 3 4 5 ...

635 Commits