test/sandbox: migrate tests

This significantly improves performance, removing overhead of nix,
python, and virtualisation. Running this in an unprivileged container
required patching the kernel, but since special runner setup was already
needed, that was an acceptable tradeoff.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 140 insertions, 0 deletions

diff --git a/test/sandbox/testdata/simple.go b/test/sandbox/testdata/simple.go
new file mode 100644
index 00000000..c410e626
--- /dev/null
+++ b/test/sandbox/testdata/simple.go
@@ -0,0 +1,140 @@
+//go:build testsuite || tester
+
+package testdata
+
+import (
+	"os"
+	"syscall"
+
+	"hakurei.app/fhs"
+	"hakurei.app/hst"
+	"hakurei.app/test/internal/mountinfo"
+	"hakurei.app/test/internal/testsuite"
+)
+
+var _ = TestCase{
+	Hakurei: hst.Config{
+		ID:          "app.hakurei.sample.simple",
+		Enablements: new(hst.EWayland | hst.EPipeWire | hst.EDBus),
+		Identity:    1,
+
+		Container: &hst.ContainerConfig{
+			Hostname: "hakurei-sample-simple",
+			Env:      map[string]string{"HAKUREI_SAMPLE": "1"},
+
+			Filesystem: []hst.FilesystemConfigJSON{
+				fcLinker,
+				fcLib,
+				fcTestHelper,
+			},
+
+			Username: "u0_a1",
+			Shell:    fhs.AbsUsrBin.Append("bash"),
+			Home:     hst.AbsPrivateTmp,
+			Path:     absTestHelper,
+			Args:     []string{"tester", "simple"},
+		},
+	},
+
+	// 0, PresetStrict
+	Sum: sumSimple,
+
+	Env: []string{
+		"DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus",
+		"HAKUREI_SAMPLE=1",
+		"HOME=/.hakurei",
+		"SHELL=/usr/bin/bash",
+		"TERM=xterm",
+		"USER=u0_a1",
+		"WAYLAND_DISPLAY=wayland-0",
+		"XDG_RUNTIME_DIR=/run/user/65534",
+		"XDG_SESSION_CLASS=user",
+		"XDG_SESSION_TYPE=wayland",
+		"PULSE_SERVER=unix:/run/user/65534/pulse/native",
+	},
+
+	FS: &testsuite.FS{Dir: dir{
+		".hakurei": {Mode: os.ModeDir | 0755, Dir: dir{
+			"test-helper": {Mode: 0755},
+		}},
+
+		"dev": {Mode: os.ModeDir | 0755, Dir: dir{
+			"core":   {Mode: os.ModeSymlink | 0777},
+			"fd":     {Mode: os.ModeSymlink | 0777},
+			"full":   {Mode: os.ModeDevice | os.ModeCharDevice | 0666},
+			"mqueue": {Mode: os.ModeDir | os.ModeSticky | 0777, Dir: dir{}},
+			"null":   {Mode: os.ModeDevice | os.ModeCharDevice | 0666, Data: new("")},
+			"ptmx":   {Mode: os.ModeSymlink | 0777},
+			"pts": {Mode: os.ModeDir | 0755, Dir: dir{
+				"ptmx": {Mode: os.ModeDevice | os.ModeCharDevice | 0666},
+			}},
+			"random":  {Mode: os.ModeDevice | os.ModeCharDevice | 0666},
+			"shm":     {Mode: os.ModeDir | os.ModeSticky | 0777, Dir: dir{}},
+			"stderr":  {Mode: os.ModeSymlink | 0777},
+			"stdin":   {Mode: os.ModeSymlink | 0777},
+			"stdout":  {Mode: os.ModeSymlink | 0777},
+			"tty":     {Mode: os.ModeDevice | os.ModeCharDevice | 0666},
+			"urandom": {Mode: os.ModeDevice | os.ModeCharDevice | 0444},
+			"zero":    {Mode: os.ModeDevice | os.ModeCharDevice | 0666},
+		}},
+
+		"etc": {Mode: os.ModeDir | 0755, Dir: dir{
+			"passwd": {Mode: 0600,
+				Data: new("u0_a1:x:65534:65534:Hakurei:/.hakurei:/usr/bin/bash\n")},
+			"group": {Mode: 0600,
+				Data: new("hakurei:x:65534:\n")},
+		}},
+
+		"lib64": {Mode: os.ModeDir | 0755, Dir: dir{
+			"ld-linux-x86-64.so.2": {Mode: os.ModeSymlink | 0777},
+		}},
+
+		"run": {Mode: os.ModeDir | 0755, Dir: dir{
+			"user": {Mode: os.ModeDir | 0755, Dir: dir{
+				"65534": {Mode: os.ModeDir | 0700, Dir: dir{
+					"bus":       {Mode: os.ModeSocket | 0775},
+					"wayland-0": {Mode: os.ModeSocket | 070},
+					"pulse": {Mode: os.ModeDir | 0700, Dir: dir{
+						"native": {Mode: os.ModeSocket | 0777},
+					}},
+				}},
+			}},
+		}},
+
+		"tmp": {Mode: os.ModeDir | os.ModeSticky | 0777, Dir: dir{}},
+
+		"lib":  {Mode: os.ModeDir | 0755},
+		"proc": {Mode: os.ModeDir | 0555},
+	}},
+
+	Mount: []*mountinfo.Entry{
+		r("/sysroot", "/", "ro,nosuid,nodev,relatime", "tmpfs", "rootfs", "rw,uid=110000,gid=110000,inode64"),
+		r("/", "/proc", "rw,nosuid,nodev,noexec,relatime", "proc", "proc", "rw"),
+		r("/", "/.hakurei", "rw,nosuid,nodev,relatime", "tmpfs", "ephemeral", "rw,size=4k,mode=755,uid=110000,gid=110000,inode64"),
+		r("/", "/dev", "ro,nosuid,nodev,relatime", "tmpfs", "devtmpfs", "rw,mode=755,uid=110000,gid=110000,inode64"),
+		r("/null", "/dev/null", "rw,nosuid,noexec,relatime", "devtmpfs", "devtmpfs", ignore),
+		r("/zero", "/dev/zero", "rw,nosuid,noexec,relatime", "devtmpfs", "devtmpfs", ignore),
+		r("/full", "/dev/full", "rw,nosuid,noexec,relatime", "devtmpfs", "devtmpfs", ignore),
+		r("/random", "/dev/random", "rw,nosuid,noexec,relatime", "devtmpfs", "devtmpfs", ignore),
+		r("/urandom", "/dev/urandom", "rw,nosuid,noexec,relatime", "devtmpfs", "devtmpfs", ignore),
+		r("/tty", "/dev/tty", "rw,nosuid,noexec,relatime", "devtmpfs", "devtmpfs", ignore),
+		r("/", "/dev/pts", "rw,nosuid,noexec,relatime", "devpts", "devpts", "rw,mode=620,ptmxmode=666"),
+		r("/", "/dev/mqueue", "rw,nosuid,nodev,noexec,relatime", "mqueue", "mqueue", "rw"),
+		r("/", "/dev/shm", "rw,nosuid,nodev,relatime", "tmpfs", "ephemeral", "rw,uid=110000,gid=110000,inode64"),
+		r("/", "/run/user", "rw,nosuid,nodev,relatime", "tmpfs", "ephemeral", "rw,size=16384k,mode=755,uid=110000,gid=110000,inode64"),
+		r("/", "/tmp", "rw,nosuid,nodev,relatime", "tmpfs", "ephemeral", "rw,uid=110000,gid=110000,inode64"),
+		r(ignore, "/etc/passwd", "ro,nosuid,nodev,relatime", "tmpfs", "rootfs", "rw,uid=110000,gid=110000,inode64"),
+		r(ignore, "/etc/group", "ro,nosuid,nodev,relatime", "tmpfs", "rootfs", "rw,uid=110000,gid=110000,inode64"),
+		r(ignore, "/run/user/65534/wayland-0", "ro,nosuid,nodev,relatime", "overlay", "overlay", ignore),
+		r(ignore, "/run/user/65534/bus", "ro,nosuid,nodev,relatime", "overlay", "overlay", ignore),
+		r("/usr/lib", "/lib", "ro,nosuid,nodev,relatime", "overlay", "overlay", ignore),
+		r("/opt/test-helper/bin/tester", "/.hakurei/test-helper", "ro,nosuid,nodev,relatime", "overlay", "overlay", ignore),
+		r(ignore, "/run/user/65534/pulse/native", "ro,nosuid,nodev,relatime", "overlay", "overlay", ignore),
+	},
+
+	Seccomp: true,
+
+	TrySocket:     "/tmp/.X11-unix/X0",
+	ErrnoAbstract: syscall.ECONNREFUSED,
+	ErrnoPathname: syscall.ENOENT,
+}.register("simple")