ceamac
1f52bc5f6f
test_session_cleanup.cpp exercises kill_via_cgroup() directly against two
plain forked processes (one setsid()-ing away from the other before it
exits), confirming a reparented straggler is actually reaped -- reproducing
the real escape shape (no pid namespace support at all) through a full
mount/bwrap session isn't possible from the CLI on a single run, since
--unshare-pid is a config-file-only setting, not a flag.
Also resolves TODO.md's SIGINT/SIGTERM entry and extends the relevant
CLAUDE.md sections (bwrap.{h,cpp}, session_cgroup.{h,cpp}, kill_session.{h,cpp})
with the fix's rationale and its known residual limitation (a kernel with
neither cgroup v2 nor pid namespace support still can't be reached
automatically).
76 lines
3.5 KiB
Meson
76 lines
3.5 KiB
Meson
project('slocker-lite', 'cpp',
|
|
version : '0.0.1',
|
|
default_options : ['warning_level=3', 'cpp_std=c++20'])
|
|
|
|
fmt_dep = dependency('fmt')
|
|
catch2_dep = dependency('catch2', required : get_option('enable_tests'))
|
|
yaml_dep = dependency('yaml-0.1')
|
|
archive_dep = dependency('libarchive')
|
|
json_dep = dependency('nlohmann_json')
|
|
spdlog_dep = dependency('spdlog')
|
|
|
|
conf_data = configuration_data()
|
|
conf_data.set_quoted('PACKAGE', meson.project_name())
|
|
conf_data.set_quoted('VERSION', meson.project_version())
|
|
conf_data.set10('ENABLE_TESTS', get_option('enable_tests'))
|
|
|
|
configure_file(output : 'config.h', configuration : conf_data)
|
|
|
|
# TEST_CASE-containing sources -- only buildable/linkable when catch2_dep is
|
|
# actually present, so kept out of the executable's sources entirely (not
|
|
# just "compiled but unused") when enable_tests is off, matching config.h's
|
|
# own ENABLE_TESTS-guarded runtime message in self_test.cpp.
|
|
test_sources = []
|
|
if get_option('enable_tests')
|
|
test_sources = [
|
|
'tests/unit/test_port_forward.cpp',
|
|
'tests/unit/test_env_spec.cpp',
|
|
'tests/unit/test_network_subnet.cpp',
|
|
'tests/unit/test_cli_args.cpp',
|
|
'tests/support/fixtures.cpp',
|
|
'tests/integration/test_config_bwrap_chain.cpp',
|
|
'tests/integration/test_rootless_run.cpp',
|
|
'tests/integration/test_root_networking.cpp',
|
|
'tests/integration/test_session_cleanup.cpp',
|
|
]
|
|
endif
|
|
|
|
slocker_lite = executable('slocker-lite',
|
|
['src/main.cpp', 'src/cli_args.cpp', 'src/commands.cpp', 'src/self_test.cpp',
|
|
'src/process.cpp', 'src/oci_image.cpp', 'src/containers_storage.cpp',
|
|
'src/bwrap.cpp', 'src/user_spec.cpp', 'src/config_file.cpp', 'src/volume_mount.cpp',
|
|
'src/pid_file.cpp', 'src/exec_session.cpp', 'src/env_spec.cpp', 'src/daemonize.cpp',
|
|
'src/sandbox_process.cpp', 'src/session_cgroup.cpp', 'src/kill_session.cpp',
|
|
'src/network_subnet.cpp', 'src/persistent_netns.cpp', 'src/network_bridge.cpp',
|
|
'src/network_join.cpp', 'src/port_forward.cpp', 'src/network_tap_relay.cpp',
|
|
'src/network_dns.cpp'] + test_sources,
|
|
include_directories : include_directories('.', 'src', 'tests/support'),
|
|
dependencies : [fmt_dep, catch2_dep, yaml_dep, archive_dep, json_dep, spdlog_dep],
|
|
install : true)
|
|
|
|
# Bind-mounted into the sandbox by -r/--run's --user/--group handling (src/bwrap.cpp),
|
|
# so it must be dependency-free and statically linked to run regardless of what
|
|
# libc/libraries the container image itself has.
|
|
priv_drop_helper = executable('slocker-lite-priv-drop',
|
|
['src/priv_drop_helper.cpp'],
|
|
link_args : ['-static'],
|
|
install : true)
|
|
|
|
fixture_tar = custom_target('oci-fixture',
|
|
output : 'fixture.tar',
|
|
command : [find_program('python3'), files('tests/gen_fixture.py'), '@OUTPUT@'])
|
|
|
|
test('test', find_program('python3'), args : [files('tests/run_test.py'), slocker_lite, fixture_tar])
|
|
|
|
# Only the categories safe to run unprivileged with no network setup --
|
|
# [integration]~[net] excludes both the rootless-network (tests_rootless_run.cpp)
|
|
# and root (test_root_networking.cpp) tests, matching how this project's
|
|
# self-tests were never part of `meson test` either. Only registered when
|
|
# enable_tests is on -- with it off there's no TEST_CASE compiled in at all
|
|
# (see test_sources above), so -t would just fail cleanly rather than have
|
|
# anything real to run here.
|
|
if get_option('enable_tests')
|
|
test('unit-tests', slocker_lite, args : ['-t', '--', '[unit]'])
|
|
test('integration-tests', slocker_lite, args : ['-t', '--', '[integration]~[net]'])
|
|
endif
|