security/hakurei
6
3
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

container/init: unwrap path errors
All checks were successful
Test / Create distribution (push) Successful in 34s
Details
Test / Sandbox (push) Successful in 1m49s
Details
Test / Hakurei (push) Successful in 3m18s
Details
Test / Hpkg (push) Successful in 3m43s
Details
Test / Sandbox (race detector) (push) Successful in 3m53s
Details
Test / Hakurei (race detector) (push) Successful in 5m16s
Details
Test / Flake checks (push) Successful in 1m36s
Details

Browse Source 
These are also now handled by init properly, so wrapping them in self is meaningless and unreachable.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra
2025-08-29 02:04:09 +09:00
parent eb3385d490
commit 4da6463135
24 changed files with 243 additions and 134 deletions
Download Patch File Download Diff File Expand all files Collapse all files

96
container/init_test.go
View File

@@ -410,13 +410,51 @@ func TestInitEntrypoint(t *testing.T) {
{"mount", expectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil},
/* begin early */
{"evalSymlinks", expectArgs{"/"}, "/", errUnique},
{"printBaseErr", expectArgs{wrapErrSelf(errUnique), "cannot prepare op at index 0:"}, nil, nil},
{"printBaseErr", expectArgs{errUnique, "cannot prepare op at index 0:"}, nil, nil},
{"beforeExit", expectArgs{}, nil, nil},
{"exit", expectArgs{1}, nil, nil},
/* end early */
},
}, nil},
{"early", func(k syscallDispatcher) error { initEntrypoint(k, assertPrefix, assertVerboseTrue); return nil }, [][]kexpect{
{
{"lockOSThread", expectArgs{}, nil, nil},
{"getpid", expectArgs{}, 1, nil},
{"setPtracer", expectArgs{uintptr(0)}, nil, nil},
{"receive", expectArgs{"HAKUREI_SETUP", new(initParams), new(uintptr), &initParams{Params{
Dir: MustAbs("/.hakurei"),
Env: []string{"DISPLAY=:0"},
Path: MustAbs("/bin/zsh"),
Args: []string{"zsh", "-c", "exec vim"},
ForwardCancel: true,
AdoptWaitDelay: 5 * time.Second,
Uid: 1 << 32,
Gid: 1 << 31,
Hostname: "hakurei-check",
Ops: new(Ops).Bind(MustAbs("/"), MustAbs("/"), BindDevice).Proc(MustAbs("/proc/")),
SeccompRules: make([]seccomp.NativeRule, 0),
SeccompPresets: seccomp.PresetStrict,
RetainSession: true,
Privileged: true,
}, 1000, 100, 3, true}, uintptr(9)}, errUnique, nil},
{"verbose", expectArgs{[]any{"received setup parameters"}}, nil, nil},
{"setDumpable", expectArgs{uintptr(1)}, nil, nil},
{"writeFile", expectArgs{"/proc/self/uid_map", []byte("4294967296 1000 1\n"), os.FileMode(0)}, nil, nil},
{"writeFile", expectArgs{"/proc/self/setgroups", []byte("deny\n"), os.FileMode(0)}, nil, nil},
{"writeFile", expectArgs{"/proc/self/gid_map", []byte("2147483648 100 1\n"), os.FileMode(0)}, nil, nil},
{"setDumpable", expectArgs{uintptr(0)}, nil, nil},
{"umask", expectArgs{0}, 022, nil},
{"sethostname", expectArgs{[]byte("hakurei-check")}, nil, nil},
{"lastcap", expectArgs{}, uintptr(40), nil},
{"mount", expectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil},
/* begin early */
{"evalSymlinks", expectArgs{"/"}, "/", &os.PathError{Op: "readlink", Path: "/", Err: errUnique}},
{"fatal", expectArgs{[]any{"cannot readlink /: unique error injected by the test suite"}}, nil, nil},
/* end early */
},
}, nil},
{"mount ih", func(k syscallDispatcher) error { initEntrypoint(k, assertPrefix, assertVerboseTrue); return nil }, [][]kexpect{
{
{"lockOSThread", expectArgs{}, nil, nil},
@@ -711,6 +749,62 @@ func TestInitEntrypoint(t *testing.T) {
},
}, nil},
{"apply unhandled error", func(k syscallDispatcher) error { initEntrypoint(k, assertPrefix, assertVerboseTrue); return nil }, [][]kexpect{
{
{"lockOSThread", expectArgs{}, nil, nil},
{"getpid", expectArgs{}, 1, nil},
{"setPtracer", expectArgs{uintptr(0)}, nil, nil},
{"receive", expectArgs{"HAKUREI_SETUP", new(initParams), new(uintptr), &initParams{Params{
Dir: MustAbs("/.hakurei"),
Env: []string{"DISPLAY=:0"},
Path: MustAbs("/bin/zsh"),
Args: []string{"zsh", "-c", "exec vim"},
ForwardCancel: true,
AdoptWaitDelay: 5 * time.Second,
Uid: 1 << 32,
Gid: 1 << 31,
Hostname: "hakurei-check",
Ops: new(Ops).Bind(MustAbs("/"), MustAbs("/"), BindDevice).Proc(MustAbs("/proc/")),
SeccompRules: make([]seccomp.NativeRule, 0),
SeccompPresets: seccomp.PresetStrict,
RetainSession: true,
Privileged: true,
}, 1000, 100, 3, true}, uintptr(9)}, errUnique, nil},
{"verbose", expectArgs{[]any{"received setup parameters"}}, nil, nil},
{"setDumpable", expectArgs{uintptr(1)}, nil, nil},
{"writeFile", expectArgs{"/proc/self/uid_map", []byte("4294967296 1000 1\n"), os.FileMode(0)}, nil, nil},
{"writeFile", expectArgs{"/proc/self/setgroups", []byte("deny\n"), os.FileMode(0)}, nil, nil},
{"writeFile", expectArgs{"/proc/self/gid_map", []byte("2147483648 100 1\n"), os.FileMode(0)}, nil, nil},
{"setDumpable", expectArgs{uintptr(0)}, nil, nil},
{"umask", expectArgs{0}, 022, nil},
{"sethostname", expectArgs{[]byte("hakurei-check")}, nil, nil},
{"lastcap", expectArgs{}, uintptr(40), nil},
{"mount", expectArgs{"", "/", "", uintptr(0x8c000), ""}, nil, nil},
/* begin early */
{"evalSymlinks", expectArgs{"/"}, "/", nil},
/* end early */
{"mount", expectArgs{"rootfs", "/proc/self/fd", "tmpfs", uintptr(6), ""}, nil, nil},
{"chdir", expectArgs{"/proc/self/fd"}, nil, nil},
{"mkdir", expectArgs{"sysroot", os.FileMode(0755)}, nil, nil},
{"mount", expectArgs{"sysroot", "sysroot", "", uintptr(0xd000), ""}, nil, nil},
{"mkdir", expectArgs{"host", os.FileMode(0755)}, nil, nil},
{"pivotRoot", expectArgs{"/proc/self/fd", "host"}, nil, nil},
{"chdir", expectArgs{"/"}, nil, nil},
/* begin apply */
{"verbosef", expectArgs{"%s %s", []any{"mounting", &BindMountOp{sourceFinal: MustAbs("/"), Source: MustAbs("/"), Target: MustAbs("/"), Flags: BindDevice}}}, nil, nil},
{"stat", expectArgs{"/host"}, isDirFi(true), nil},
{"mkdirAll", expectArgs{"/sysroot", os.FileMode(0700)}, nil, nil},
{"bindMount", expectArgs{"/host", "/sysroot", uintptr(0x4001), false}, nil, nil},
{"verbosef", expectArgs{"%s %s", []any{"mounting", &MountProcOp{Target: MustAbs("/proc/")}}}, nil, nil},
{"mkdirAll", expectArgs{"/sysroot/proc", os.FileMode(0755)}, nil, nil},
{"mount", expectArgs{"proc", "/sysroot/proc", "proc", uintptr(0xe), ""}, nil, errUnique},
{"printBaseErr", expectArgs{errUnique, "cannot apply op at index 1:"}, nil, nil},
{"beforeExit", expectArgs{}, nil, nil},
{"exit", expectArgs{1}, nil, nil},
/* end apply */
},
}, nil},
{"apply", func(k syscallDispatcher) error { initEntrypoint(k, assertPrefix, assertVerboseTrue); return nil }, [][]kexpect{
{
{"lockOSThread", expectArgs{}, nil, nil},