diff --git a/container/container.go b/container/container.go index 8001673..ecfb94c 100644 --- a/container/container.go +++ b/container/container.go @@ -17,6 +17,12 @@ import ( "hakurei.app/container/seccomp" ) +const ( + // Nonexistent is a path that cannot exist. + // /proc is chosen because a system with covered /proc is unsupported by this package. + Nonexistent = "/proc/nonexistent" +) + type ( // Container represents a container environment being prepared or run. // None of [Container] methods are safe for concurrent use. diff --git a/container/seccomp/libseccomp_test.go b/container/seccomp/libseccomp_test.go index 8443ade..1ae3f76 100644 --- a/container/seccomp/libseccomp_test.go +++ b/container/seccomp/libseccomp_test.go @@ -79,7 +79,7 @@ func TestExport(t *testing.T) { func BenchmarkExport(b *testing.B) { buf := make([]byte, 8) - for i := 0; i < b.N; i++ { + for b.Loop() { e := New( Preset(PresetExt|PresetDenyNS|PresetDenyTTY|PresetDenyDevel|PresetLinux32, AllowMultiarch|AllowCAN|AllowBluetooth), diff --git a/helper/cmd_test.go b/helper/cmd_test.go index 00342e6..64ac643 100644 --- a/helper/cmd_test.go +++ b/helper/cmd_test.go @@ -8,12 +8,13 @@ import ( "os/exec" "testing" + "hakurei.app/container" "hakurei.app/helper" ) func TestCmd(t *testing.T) { t.Run("start non-existent helper path", func(t *testing.T) { - h := helper.NewDirect(t.Context(), "/proc/nonexistent", argsWt, false, argF, nil, nil) + h := helper.NewDirect(t.Context(), container.Nonexistent, argsWt, false, argF, nil, nil) if err := h.Start(); !errors.Is(err, os.ErrNotExist) { t.Errorf("Start: error = %v, wantErr %v", diff --git a/helper/container_test.go b/helper/container_test.go index a65e87f..71c25bd 100644 --- a/helper/container_test.go +++ b/helper/container_test.go @@ -15,7 +15,7 @@ import ( func TestContainer(t *testing.T) { t.Run("start empty container", func(t *testing.T) { - h := helper.New(t.Context(), "/nonexistent", argsWt, false, argF, nil, nil) + h := helper.New(t.Context(), container.Nonexistent, argsWt, false, argF, nil, nil) wantErr := "sandbox: starting an empty container" if err := h.Start(); err == nil || err.Error() != wantErr { diff --git a/system/acl_test.go b/system/acl_test.go index a66207e..886a62e 100644 --- a/system/acl_test.go +++ b/system/acl_test.go @@ -3,6 +3,7 @@ package system import ( "testing" + "hakurei.app/container" "hakurei.app/system/acl" ) @@ -52,19 +53,19 @@ func TestACLString(t *testing.T) { et Enablement perms []acl.Perm }{ - {`--- type: process path: "/nonexistent"`, Process, []acl.Perm{}}, - {`r-- type: user path: "/nonexistent"`, User, []acl.Perm{acl.Read}}, - {`-w- type: wayland path: "/nonexistent"`, EWayland, []acl.Perm{acl.Write}}, - {`--x type: x11 path: "/nonexistent"`, EX11, []acl.Perm{acl.Execute}}, - {`rw- type: dbus path: "/nonexistent"`, EDBus, []acl.Perm{acl.Read, acl.Write}}, - {`r-x type: pulseaudio path: "/nonexistent"`, EPulse, []acl.Perm{acl.Read, acl.Execute}}, - {`rwx type: user path: "/nonexistent"`, User, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, - {`rwx type: process path: "/nonexistent"`, Process, []acl.Perm{acl.Read, acl.Write, acl.Write, acl.Execute}}, + {`--- type: process path: "/proc/nonexistent"`, Process, []acl.Perm{}}, + {`r-- type: user path: "/proc/nonexistent"`, User, []acl.Perm{acl.Read}}, + {`-w- type: wayland path: "/proc/nonexistent"`, EWayland, []acl.Perm{acl.Write}}, + {`--x type: x11 path: "/proc/nonexistent"`, EX11, []acl.Perm{acl.Execute}}, + {`rw- type: dbus path: "/proc/nonexistent"`, EDBus, []acl.Perm{acl.Read, acl.Write}}, + {`r-x type: pulseaudio path: "/proc/nonexistent"`, EPulse, []acl.Perm{acl.Read, acl.Execute}}, + {`rwx type: user path: "/proc/nonexistent"`, User, []acl.Perm{acl.Read, acl.Write, acl.Execute}}, + {`rwx type: process path: "/proc/nonexistent"`, Process, []acl.Perm{acl.Read, acl.Write, acl.Write, acl.Execute}}, } for _, tc := range testCases { t.Run(tc.want, func(t *testing.T) { - a := &ACL{et: tc.et, perms: tc.perms, path: "/nonexistent"} + a := &ACL{et: tc.et, perms: tc.perms, path: container.Nonexistent} if got := a.String(); got != tc.want { t.Errorf("String() = %v, want %v", got, tc.want) diff --git a/system/mkdir_test.go b/system/mkdir_test.go index 4b00bb3..706b3d1 100644 --- a/system/mkdir_test.go +++ b/system/mkdir_test.go @@ -3,6 +3,8 @@ package system import ( "os" "testing" + + "hakurei.app/container" ) func TestEnsure(t *testing.T) { @@ -60,11 +62,11 @@ func TestMkdirString(t *testing.T) { t.Run(tc.want, func(t *testing.T) { m := &Mkdir{ et: tc.et, - path: "/nonexistent", + path: container.Nonexistent, perm: 0701, ephemeral: tc.ephemeral, } - want := "mode: " + os.FileMode(0701).String() + " type: " + tc.want + " path: \"/nonexistent\"" + want := "mode: " + os.FileMode(0701).String() + " type: " + tc.want + ` path: "/proc/nonexistent"` if got := m.String(); got != want { t.Errorf("String() = %v, want %v", got, want) }