1 files changed, 181 insertions, 0 deletions
diff --git a/test/sandbox/main.go b/test/sandbox/main.go
new file mode 100644
index 00000000..a407d75d
--- /dev/null
+++ b/test/sandbox/main.go
@@ -0,0 +1,181 @@
+//go:build testsuite
+
+// The sandbox test program runs cmd/hakurei with configurations simulating
+// several common workloads and inspects the resulting container states.
+package main
+
+import (
+	"context"
+	"log"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"syscall"
+
+	"hakurei.app/fhs"
+	"hakurei.app/hst"
+	"hakurei.app/test/internal/testsuite"
+)
+
+// mustStart starts a hakurei container and returns the pid of a process within
+// the container. This process must be terminated by the caller.
+func mustStart(
+	ctx context.Context,
+	serial uint64,
+	username string,
+	files ...*os.File,
+) (pid int, done <-chan error) {
+	_serial := strconv.FormatUint(serial, 10)
+	_, done = testsuite.MustStartAs(
+		ctx, username, files,
+		"hakurei", "exec",
+		"sleep", "infinity", _serial,
+	)
+
+	var (
+		s testsuite.StatScanner
+
+		stat syscall.Stat_t
+	)
+	for s.Scan() {
+		select {
+		case err := <-done:
+			if err == nil {
+				log.Fatal("test process terminated unexpectedly")
+			}
+			log.Fatal(err)
+		default:
+			break
+		}
+
+		if s.Stat().Comm != "sleep" {
+			continue
+		}
+
+		if args, err := s.Stat().Args(); err != nil {
+			log.Fatal(err)
+		} else if !slices.Equal(args, []string{
+			"sleep",
+			"infinity",
+			_serial,
+		}) {
+			continue
+		}
+
+		if err := s.Stat().Stat(&stat); err != nil {
+			log.Fatal(err)
+		}
+
+		id := hst.ToUser[uint32](0, 0)
+		if stat.Uid != id || stat.Gid != id {
+			continue
+		}
+
+		break
+	}
+	if err := s.Err(); err != nil {
+		log.Fatal(err)
+	}
+	pid = s.Stat().PID
+	return
+}
+
+func main() {
+	go testsuite.ReceiveSignals()
+	username := testsuite.GetUsername()
+
+	// the signal handler does not wait for termination
+	ctx := context.Background()
+
+	var wg sync.WaitGroup
+	defer wg.Wait()
+
+	var serial atomic.Uint64
+	newSerial := func() uint64 { serial.Add(1); return serial.Load() }
+
+	testsuite.MustRunAs(
+		username, "-i",
+		"hakurei", "exec", "capsh", "--print",
+	)
+	wg.Go(func() {
+		defer log.Println("validated capabilities/securebits in user namespace")
+
+		testsuite.MustRunAs(
+			username, "-i",
+			"hakurei", "exec", "capsh", "--has-no-new-privs",
+		)
+
+		for _, p := range []byte{'a', 'b', 'i', 'p'} {
+			testsuite.MustFailAs(
+				username, "-i",
+				"hakurei", "exec", "capsh", "--has-"+string(p)+"=CAP_SYS_ADMIN",
+			)
+		}
+		testsuite.MustFailAs(
+			username, "-i",
+			"hakurei", "exec", "umount", "-R", "/dev",
+		)
+	})
+
+	wg.Go(func() {
+		defer log.Println("validated pd seccomp outcome")
+
+		c, cancel := context.WithCancel(ctx)
+		defer cancel()
+
+		pid, done := mustStart(c, newSerial(), username)
+		testsuite.MustCheckFilter(pid, pdSum)
+		if err := testsuite.FilterTerminated(<-done); err != nil {
+			log.Fatal(err)
+		}
+	})
+
+	wg.Go(func() {
+		defer log.Println("validated fd leak")
+
+		c, cancel := context.WithCancel(ctx)
+		defer cancel()
+
+		pid, done := mustStart(c, newSerial(), username, os.Stdin, os.Stdout, os.Stderr)
+		prefix := filepath.Join(fhs.Proc, strconv.Itoa(pid), "fd")
+
+		var fail bool
+		if entries, err := os.ReadDir(prefix); err != nil {
+			log.Fatal(err.Error())
+		} else {
+			for _, ent := range entries {
+				var fd int
+				if fd, err = strconv.Atoi(ent.Name()); err != nil {
+					log.Fatal(err.Error())
+				}
+
+				// skip standard streams
+				if fd <= 2 {
+					continue
+				}
+				fail = true
+
+				var d string
+				if d, err = os.Readlink(filepath.Join(
+					prefix,
+					ent.Name(),
+				)); err != nil {
+					log.Fatal(err.Error())
+				}
+				log.Printf("extra fd %d -> %s", fd, d)
+			}
+		}
+		if fail {
+			log.Fatal("file descriptors leaked")
+		}
+
+		if err := syscall.Kill(pid, syscall.SIGTERM); err != nil {
+			log.Fatalf("cannot terminate anchor: %v", err)
+		} else if err = testsuite.FilterTerminated(<-done); err != nil {
+			log.Fatal(err)
+		}
+	})
+}