ceamac/slocker-lite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Skip individual namespace-type checks that policy disables

Browse Source 
Same class of test gap as the net-namespace test just fixed: this test
filtered which of pid/uts/ipc/cgroup to check by kernel support alone,
never by the config's own policy, so running the full suite as root with
every unshare-* flag forced off (via -c/--config-file) correctly made
bwrap skip requesting all four -- production code working as configured,
not a bug -- while the test still asserted each was isolated and failed.

Reuses namespace_type_would_isolate() (introduced in the previous commit)
to filter to_check by both gates instead of kernel support alone.

Full suite as root with everything disabled: 78 test cases, 76 passed, 2
skipped (this one and the net-namespace test), 0 failed -- the complete
picture requested.
This commit is contained in:
Viorel Munteanu
2026-09-05 10:34:33 +00:00
parent 4f988c1bbc
commit 31e81c88d0
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/integration/test_rootless_run.cpp
+9 -4
View File
@@ -336,15 +336,20 @@ TEST_CASE("rootless -r/--run: every kernel-supported namespace type differs from
// (rootful when run via `doas`/on the real device, rootless // (rootful when run via `doas`/on the real device, rootless
// otherwise), so asserting on "user" here would be wrong in the root // otherwise), so asserting on "user" here would be wrong in the root
// case. "net" is covered by the previous test case, more specifically. // case. "net" is covered by the previous test case, more specifically.
// Filters on both kernel support *and* config policy (namespace_type_would_isolate())
// rather than kernel support alone -- found by running the full suite as
// root with every unshare-* flag forced off via -c/--config-file: a type
// whose policy is disabled is correctly never requested by bwrap, so it's
// no more isolated than "user" already deliberately isn't (see above);
// asserting on it anyway was a test gap, not a product bug.
std::vector<std::string> to_check; std::vector<std::string> to_check;
for (const auto& flag : detect_bwrap_unshare_args()) { for (const std::string type : {"pid", "uts", "ipc", "cgroup"}) {
std::string type = flag.substr(std::string("--unshare-").size()); if (namespace_type_would_isolate(type)) {
if (type == "pid" || type == "uts" || type == "ipc" || type == "cgroup") {
to_check.push_back(type); to_check.push_back(type);
} }
} }
if (to_check.empty()) { if (to_check.empty()) {
SKIP("this kernel supports none of pid/uts/ipc/cgroup namespaces"); SKIP("no pid/uts/ipc/cgroup namespace isolation is available under the current config/kernel");
} }
std::string script = "echo BEGIN-TEST-OUTPUT; "; std::string script = "echo BEGIN-TEST-OUTPUT; ";