security/hakurei
security/hakurei
5
2
Fork 0
Code Issues 8 Pull Requests Actions Packages Projects Releases 6 Wiki Activity

test/sandbox: check extra writable paths
All checks were successful
Test / Hakurei (push) Successful in 48s
Details
Test / Create distribution (push) Successful in 39s
Details
Test / Hakurei (race detector) (push) Successful in 49s
Details
Test / Hpkg (push) Successful in 47s
Details
Test / Sandbox (push) Successful in 1m52s
Details
Test / Sandbox (race detector) (push) Successful in 2m54s
Details
Test / Flake checks (push) Successful in 1m21s
Details

Browse Source 
This is not always obvious from mountinfo.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-09-14 15:12:09 +09:00
parent d0ddd71934
commit 83c4f8b767
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
6 changed files with 28 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
test/sandbox/assert.go
View File

@ -17,6 +17,7 @@ import (
"log"
"net"
"os"
"path"
"syscall"
)
@ -52,12 +53,29 @@ func (t *T) MustCheckFile(wantFilePath string) {
t.MustCheck(want)
}
func mustAbs(s string) string {
if !path.IsAbs(s) {
fatalf("[FAIL] %q is not absolute", s)
panic("unreachable")
}
return s
}
func (t *T) MustCheck(want *TestCase) {
// check /dev/shm writable
if err := os.WriteFile("/dev/shm/.hakurei-check", make([]byte, 1<<8), 0600); err != nil {
checkWritableDirPaths := []string{
"/dev/shm",
"/tmp",
os.Getenv("XDG_RUNTIME_DIR"),
}
for _, a := range checkWritableDirPaths {
pathname := path.Join(mustAbs(a), ".hakurei-check")
if err := os.WriteFile(pathname, make([]byte, 1<<8), 0600); err != nil {
fatalf("[FAIL] %s", err)
} else if err = os.Remove(pathname); err != nil {
fatalf("[FAIL] %s", err)
} else {
printf("[ OK ] /dev/shm is writable")
printf("[ OK ] %s is writable", a)
}
}
if want.Env != nil {

2
test/sandbox/case/mapuid.nix
View File

@ -73,7 +73,7 @@ in
ptmx = fs "80001ff" null null;
pts = fs "800001ed" { ptmx = fs "42001b6" null null; } null;
random = fs "42001b6" null null;
shm = fs "801001ff" { ".hakurei-check" = fs "180" null null; } null;
shm = fs "801001ff" { } null;
stderr = fs "80001ff" null null;
stdin = fs "80001ff" null null;
stdout = fs "80001ff" null null;

2
test/sandbox/case/pd.nix
View File

@ -36,7 +36,7 @@
ptmx = fs "80001ff" null null;
pts = fs "800001ed" { ptmx = fs "42001b6" null null; } null;
random = fs "42001b6" null null;
shm = fs "801001ff" { ".hakurei-check" = fs "180" null null; } null;
shm = fs "801001ff" { } null;
stderr = fs "80001ff" null null;
stdin = fs "80001ff" null null;
stdout = fs "80001ff" null null;

2
test/sandbox/case/pdlike.nix
View File

@ -71,7 +71,7 @@ in
ptmx = fs "80001ff" null null;
pts = fs "800001ed" { ptmx = fs "42001b6" null null; } null;
random = fs "42001b6" null null;
shm = fs "801001ff" { ".hakurei-check" = fs "180" null null; } null;
shm = fs "801001ff" { } null;
stderr = fs "80001ff" null null;
stdin = fs "80001ff" null null;
stdout = fs "80001ff" null null;

2
test/sandbox/case/preset.nix
View File

@ -70,7 +70,7 @@ in
ptmx = fs "80001ff" null null;
pts = fs "800001ed" { ptmx = fs "42001b6" null null; } null;
random = fs "42001b6" null null;
shm = fs "801001ff" { ".hakurei-check" = fs "180" null null; } null;
shm = fs "801001ff" { } null;
stderr = fs "80001ff" null null;
stdin = fs "80001ff" null null;
stdout = fs "80001ff" null null;

2
test/sandbox/case/tty.nix
View File

@ -75,7 +75,7 @@ in
ptmx = fs "80001ff" null null;
pts = fs "800001ed" { ptmx = fs "42001b6" null null; } null;
random = fs "42001b6" null null;
shm = fs "801001ff" { ".hakurei-check" = fs "180" null null; } null;
shm = fs "801001ff" { } null;
stderr = fs "80001ff" null null;
stdin = fs "80001ff" null null;
stdout = fs "80001ff" null null;