From 31e81c88d0438d10d32d4865d10ac82c7d4ef5bf Mon Sep 17 00:00:00 2001 From: Viorel Munteanu Date: Sat, 5 Sep 2026 10:34:33 +0000 Subject: [PATCH] Skip individual namespace-type checks that policy disables Same class of test gap as the net-namespace test just fixed: this test filtered which of pid/uts/ipc/cgroup to check by kernel support alone, never by the config's own policy, so running the full suite as root with every unshare-* flag forced off (via -c/--config-file) correctly made bwrap skip requesting all four -- production code working as configured, not a bug -- while the test still asserted each was isolated and failed. Reuses namespace_type_would_isolate() (introduced in the previous commit) to filter to_check by both gates instead of kernel support alone. Full suite as root with everything disabled: 78 test cases, 76 passed, 2 skipped (this one and the net-namespace test), 0 failed -- the complete picture requested. --- tests/integration/test_rootless_run.cpp | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/tests/integration/test_rootless_run.cpp b/tests/integration/test_rootless_run.cpp index decb9df..43ed2c3 100644 --- a/tests/integration/test_rootless_run.cpp +++ b/tests/integration/test_rootless_run.cpp @@ -336,15 +336,20 @@ TEST_CASE("rootless -r/--run: every kernel-supported namespace type differs from // (rootful when run via `doas`/on the real device, rootless // otherwise), so asserting on "user" here would be wrong in the root // case. "net" is covered by the previous test case, more specifically. + // Filters on both kernel support *and* config policy (namespace_type_would_isolate()) + // rather than kernel support alone -- found by running the full suite as + // root with every unshare-* flag forced off via -c/--config-file: a type + // whose policy is disabled is correctly never requested by bwrap, so it's + // no more isolated than "user" already deliberately isn't (see above); + // asserting on it anyway was a test gap, not a product bug. std::vector to_check; - for (const auto& flag : detect_bwrap_unshare_args()) { - std::string type = flag.substr(std::string("--unshare-").size()); - if (type == "pid" || type == "uts" || type == "ipc" || type == "cgroup") { + for (const std::string type : {"pid", "uts", "ipc", "cgroup"}) { + if (namespace_type_would_isolate(type)) { to_check.push_back(type); } } if (to_check.empty()) { - SKIP("this kernel supports none of pid/uts/ipc/cgroup namespaces"); + SKIP("no pid/uts/ipc/cgroup namespace isolation is available under the current config/kernel"); } std::string script = "echo BEGIN-TEST-OUTPUT; ";