86 lines
2.9 KiB
Rust
86 lines
2.9 KiB
Rust
#[path = "../dever-tests/tests/support/process.rs"]
|
|
mod process;
|
|
#[path = "../dever-tests/tests/support/temp.rs"]
|
|
mod temp;
|
|
|
|
use std::fs;
|
|
use std::process::Command;
|
|
|
|
#[test]
|
|
fn runtime_assets_have_no_sandbox_executables() {
|
|
assert!(dever_process::asset_executable("lib/ld-linux-x86-64.so.2"));
|
|
assert!(dever_process::asset_executable("lib/ld-linux-aarch64.so.1"));
|
|
assert!(!dever_process::asset_executable("bin/bwrap"));
|
|
assert!(!dever_process::asset_executable("bin/guard"));
|
|
assert!(!dever_process::asset_executable("lib/libc.so.6"));
|
|
}
|
|
|
|
#[cfg(target_os = "linux")]
|
|
#[test]
|
|
fn direct_child_keeps_the_container_namespace_and_explicit_paths() {
|
|
let directory = temp::TemporaryDirectory::new();
|
|
let input = directory.path().join("input");
|
|
fs::write(&input, "trusted input").unwrap();
|
|
let mut command = Command::new(std::env::current_exe().unwrap());
|
|
command.env("DEVER_TEST_AMBIENT", "must not reach the child");
|
|
dever_process::configure(&mut command);
|
|
command
|
|
.args(["--ignored", "--exact", "direct_child_probe"])
|
|
.env("DEVER_TEST_INPUT", &input)
|
|
.env(
|
|
"DEVER_TEST_MOUNT",
|
|
fs::read_link("/proc/self/ns/mnt").unwrap(),
|
|
);
|
|
assert!(
|
|
process::status(&mut command, std::time::Duration::from_secs(5))
|
|
.unwrap()
|
|
.success()
|
|
);
|
|
assert_eq!(fs::read(input).unwrap(), b"trusted output");
|
|
}
|
|
|
|
#[cfg(target_os = "linux")]
|
|
#[test]
|
|
fn process_group_observes_exit_before_reaping_the_leader() {
|
|
let mut command = Command::new(std::env::current_exe().unwrap());
|
|
dever_process::configure(&mut command);
|
|
let mut child = command
|
|
.args(["--ignored", "--exact", "direct_child_probe"])
|
|
.env("DEVER_TEST_WAIT", "1")
|
|
.spawn()
|
|
.unwrap();
|
|
let group = dever_process::ProcessGroup::pin(child.id()).unwrap();
|
|
assert!(!group.exited().unwrap());
|
|
group.terminate().unwrap();
|
|
let deadline = std::time::Instant::now() + std::time::Duration::from_secs(2);
|
|
while !group.exited().unwrap() && std::time::Instant::now() < deadline {
|
|
std::thread::sleep(std::time::Duration::from_millis(5));
|
|
}
|
|
let exited = group.exited().unwrap();
|
|
drop(group);
|
|
assert!(
|
|
!process::wait(&mut child, std::time::Duration::from_secs(2))
|
|
.unwrap()
|
|
.success()
|
|
);
|
|
assert!(exited);
|
|
}
|
|
|
|
#[cfg(target_os = "linux")]
|
|
#[test]
|
|
#[ignore = "internal direct-process probe"]
|
|
fn direct_child_probe() {
|
|
if std::env::var_os("DEVER_TEST_WAIT").is_some() {
|
|
std::thread::sleep(std::time::Duration::from_secs(2));
|
|
return;
|
|
}
|
|
assert!(std::env::var_os("DEVER_TEST_AMBIENT").is_none());
|
|
assert_eq!(
|
|
fs::read_link("/proc/self/ns/mnt").unwrap().as_os_str(),
|
|
std::env::var_os("DEVER_TEST_MOUNT").unwrap()
|
|
);
|
|
let path = std::env::var_os("DEVER_TEST_INPUT").unwrap();
|
|
assert_eq!(fs::read(&path).unwrap(), b"trusted input");
|
|
fs::write(path, "trusted output").unwrap();
|
|
}
|