security/hakurei
security/hakurei
5
2
Fork 0
Code Issues 9 Pull Requests Actions 1 Packages Projects Releases 7 Wiki Activity

internal/outcome/shim: params check early
All checks were successful
Test / Create distribution (push) Successful in 35s
Details
Test / Sandbox (push) Successful in 2m16s
Details
Test / Hakurei (push) Successful in 3m18s
Details
Test / Hpkg (push) Successful in 4m0s
Details
Test / Hakurei (race detector) (push) Successful in 4m56s
Details
Test / Sandbox (race detector) (push) Successful in 4m11s
Details
Test / Flake checks (push) Successful in 1m29s
Details

Browse Source 
This is unreachable, but keeping it here as a failsafe until more test cases are added.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-10-29 23:10:12 +09:00
parent a0b4e47acc
commit 2563391086
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
2 changed files with 25 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
internal/outcome/shim.go
View File

@ -147,6 +147,9 @@ func shimEntrypoint(k syscallDispatcher) {
} }
} }
} }
if stateParams.params.Ops == nil { // unreachable
k.fatal("invalid container params")
}
// shim exit outcomes // shim exit outcomes
var cancelContainer atomic.Pointer[context.CancelFunc] var cancelContainer atomic.Pointer[context.CancelFunc]
@ -187,10 +190,6 @@ func shimEntrypoint(k syscallDispatcher) {
} }
}) })
if stateParams.params.Ops == nil {
k.fatal("invalid container params")
}
// close setup socket // close setup socket
if err := closeSetup(); err != nil { if err := closeSetup(); err != nil {
msg.Verbosef("cannot close setup pipe: %v", err) msg.Verbosef("cannot close setup pipe: %v", err)

16
internal/outcome/shim_test.go
View File

@ -106,12 +106,7 @@ func TestShimEntrypoint(t *testing.T) {
Remount(fhs.AbsRoot, syscall.MS_RDONLY), Remount(fhs.AbsRoot, syscall.MS_RDONLY),
} }
checkSimple(t, "shimEntrypoint", []simpleTestCase{ templateState := outcomeState{
{"success", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
call("getMsg", stub.ExpectArgs{}, nil, nil),
call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
call("receive", stub.ExpectArgs{"HAKUREI_SHIM", outcomeState{
Shim: &shimParams{PrivPID: 0xbad, WaitDelay: 0xf, Verbose: true, Ops: []outcomeOp{ Shim: &shimParams{PrivPID: 0xbad, WaitDelay: 0xf, Verbose: true, Ops: []outcomeOp{
&spParamsOp{"xterm-256color", true}, &spParamsOp{"xterm-256color", true},
&spRuntimeOp{sessionTypeWayland}, &spRuntimeOp{sessionTypeWayland},
@ -130,7 +125,14 @@ func TestShimEntrypoint(t *testing.T) {
Mapuid: 1000, Mapuid: 1000,
Mapgid: 100, Mapgid: 100,
Paths: &env.Paths{TempDir: fhs.AbsTmp, RuntimePath: fhs.AbsRunUser.Append("1000")}, Paths: &env.Paths{TempDir: fhs.AbsTmp, RuntimePath: fhs.AbsRunUser.Append("1000")},
}, nil}, nil, nil), }
checkSimple(t, "shimEntrypoint", []simpleTestCase{
{"success", func(k *kstub) error { shimEntrypoint(k); return nil }, stub.Expect{Calls: []stub.Call{
call("getMsg", stub.ExpectArgs{}, nil, nil),
call("getLogger", stub.ExpectArgs{}, (*log.Logger)(nil), nil),
call("setDumpable", stub.ExpectArgs{uintptr(container.SUID_DUMP_DISABLE)}, nil, nil),
call("receive", stub.ExpectArgs{"HAKUREI_SHIM", templateState, nil}, nil, nil),
call("swapVerbose", stub.ExpectArgs{true}, false, nil), call("swapVerbose", stub.ExpectArgs{true}, false, nil),
call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil), call("verbosef", stub.ExpectArgs{"process share directory at %q, runtime directory at %q", []any{m("/tmp/hakurei.10"), m("/run/user/1000/hakurei")}}, nil, nil),
call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil), call("setupContSignal", stub.ExpectArgs{0xbad}, 0, nil),