651 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Ophestra	e8809125d4	sandbox: verify outcome via mountinfo ... This contains much more information than /proc/mounts and allows for more fields to be checked. This also removes the dependency on the test package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 22:17:36 +09:00
Ophestra	806ce18c0a	test/sandbox: check mapuid outcome ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:56:07 +09:00
Ophestra	b71d2bf534	test/sandbox: check tty outcome ... This makes no difference currently but has different behaviour in the native sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:28:57 +09:00
Ophestra	46059b1840	test/sandbox: print mismatching file content ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:24:52 +09:00
Ophestra	d2c329bcea	test: format path aid offsets ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:21:14 +09:00
Ophestra	2d379b5a38	test/sandbox: pass want file as argument ... This avoids building the check program multiple times. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 15:00:59 +09:00
Ophestra	75e0c5d406	test/sandbox: parse full test case ... This makes declaring multiple tests much cleaner. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 14:53:50 +09:00
Ophestra	770b37ae16	sandbox/vfs: match MS_NOSYMFOLLOW flag ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 13:57:30 +09:00
Ophestra	c638193268	sandbox: apply vfs options to bind mounts ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 05:27:57 +09:00
Ophestra	8c3a817881	sandbox/vfs: unfold mount hierarchy ... This presents all visible mount points under path. This is useful for applying extra vfs options to bind mounts. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 05:23:31 +09:00
Ophestra	e2fce321c1	sandbox/vfs: expose mountinfo line scanning ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 02:46:58 +09:00
Ophestra	241702ae3a	go: 1.23 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-22 18:20:06 +09:00
Ophestra	d21d9c5b1d	sandbox/vfs: parse vfs options ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 17:12:10 +09:00
Ophestra	a70daf2250	sandbox: resolve inverted flags in op ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 12:58:38 +09:00
Ophestra	632b18addd	test/sandbox: rename misleading bind destination ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 12:56:11 +09:00
Ophestra	a57a7a6a16	test/sandbox: check type handling host_passthrough ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 12:21:08 +09:00
Ophestra	5098b12e4a	sandbox/vfs: count mountinfo entries ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 12:14:33 +09:00
Ophestra	9ddf5794dd	sandbox/vfs: implement proc_pid_mountinfo(5) parser ... Test cases are mostly taken from util-linux. This implementation is more correct and slightly faster than the one found in github:kubernetes/utils. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 00:35:49 +09:00
Ophestra	b74a08dda9	sandbox: prepare ops early ... Some setup code needs to run in host root. This change allows that to happen. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-18 02:17:46 +09:00
Ophestra	1b9408864f	sandbox: pass cmd to cancel function ... This is not usually in scope otherwise. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 22:36:39 +09:00
Ophestra	cc89dbdf63	sandbox: place files with content ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 22:13:22 +09:00
Ophestra	228f3301f2	sandbox: create directories ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 22:03:06 +09:00
Ophestra	07181138e5	sandbox/mount: pass absolute path ... This should never be used unless there is a good reason to, like using a file in the intermediate root. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 21:53:31 +09:00
Ophestra	816b372f14	sandbox: cancel process on serve error ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 21:49:45 +09:00
Ophestra	d7eddd54a2	sandbox: rename params struct ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 21:45:08 +09:00
Ophestra	7c063833e0	internal/sys: wrap getuid/getgid ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 17:10:03 +09:00
Ophestra	af3619d440	sandbox: create symlinks ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 16:37:56 +09:00
Ophestra	528674cb6e	sandbox/init: fail early on nil op ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 16:17:03 +09:00
Ophestra	70c9757e26	sandbox/mount: rename device flag ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 16:10:55 +09:00
Ophestra	c83a7e2efc	sandbox: mount container /dev/mqueue ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 15:42:40 +09:00
Ophestra	904208b87f	sandbox: unwrap path string ... Mount proc and dev takes no additional parameters. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 15:33:20 +09:00
Ophestra	007b52d81f	sandbox/seccomp: check for both partial read outcomes ... This eliminates intermittent test failures. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 12:51:21 +09:00
Ophestra	3385538142	nix: clean up flake outputs ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 12:26:19 +09:00
Ophestra	24618ab9a1	sandbox: move out of internal ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 02:55:36 +09:00
Ophestra	9ce4706a07	sandbox: move params setup functions ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 02:48:32 +09:00
Ophestra	9a1f8e129f	sandbox: wrap fmsg interface ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 02:44:07 +09:00
Ophestra	ee10860357	seccomp: install output atomically ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 01:10:27 +09:00
Ophestra	44277dc0f1	dbus: run in native sandbox ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 00:13:14 +09:00
Ophestra	bc54db54d2	ldd: always copy stderr ... Dropping the buffer on success is unhelpful and could hide some useful information. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 00:08:00 +09:00
Ophestra	bf07b7cd9e	ldd: mount /proc in container ... This covers host /proc. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-17 00:01:03 +09:00
Ophestra	5d3c8dcc92	test: raise timeout ... Native container tooling is severely slowed down by race detector. Raise timeout so it reliably completes. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 23:51:17 +09:00
Ophestra	48feca800f	sandbox: check command function pointer ... Setting default CommandContext on initialisation is somewhat of a footgun. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 23:29:14 +09:00
Ophestra	42de09e896	helper: implement native container backend ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 02:57:46 +09:00
Ophestra	1576fea8a3	helper: raise WaitDelay during tests ... Helper runs very slowly with race detector. This prevents it from timing out. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 02:49:41 +09:00
Ophestra	ae522ab364	test: run go tests with race detector ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 02:07:42 +09:00
Ophestra	273d97af85	ldd: lib paths resolve function ... This is what always happens right after a ldd call, so implement it here. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 01:20:09 +09:00
Ophestra	891316d924	helper/stub: copy args to stderr ... Some helpers are implemented via go test itself in tests, and as a result stdout gets clobbered. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 00:39:42 +09:00
Ophestra	9f5dad1998	sandbox: return on zero length ops ... This dodges potentially confusing behaviour where init fails due to Ops being clobbered during transfer. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 00:32:36 +09:00
Ophestra	6e7ddb2d2e	helper: eliminate commandContext replacement ... This is done more cleanly by modifying Args in cmdF. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-16 00:01:25 +09:00
Ophestra	bac4e67867	sandbox/init: early params nil check ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-15 04:03:10 +09:00