diff options
Diffstat (limited to 'test/sandbox')
| -rw-r--r-- | test/sandbox/configuration.nix | 2 | ||||
| -rw-r--r-- | test/sandbox/test.py | 18 |
2 files changed, 10 insertions, 10 deletions
diff --git a/test/sandbox/configuration.nix b/test/sandbox/configuration.nix index 80c92fdf..bc189f7d 100644 --- a/test/sandbox/configuration.nix +++ b/test/sandbox/configuration.nix @@ -30,7 +30,7 @@ in # For checking pd outcome: (pkgs.writeShellScriptBin "check-sandbox-pd" '' - hakurei -v run hakurei-test \ + hakurei -v exec hakurei-test \ -p "/var/tmp/.hakurei-check-ok.0" \ -t ${toString (builtins.toFile "hakurei-pd-want.json" (builtins.toJSON testCases.pd.want))} \ -s ${testCases.pd.expectedFilter.${pkgs.stdenv.hostPlatform.system}} "$@" diff --git a/test/sandbox/test.py b/test/sandbox/test.py index c1191483..f188a01d 100644 --- a/test/sandbox/test.py +++ b/test/sandbox/test.py @@ -42,23 +42,23 @@ machine.wait_for_file("/run/user/1000/wayland-1") machine.wait_for_file("/tmp/sway-ipc.sock") # Check pd seccomp outcome: -swaymsg("exec hakurei run cat") +swaymsg("exec hakurei exec cat") check_filter(0, "pdlike", "cat") # Check fd leak: -swaymsg("exec exec 127</proc/cmdline && hakurei -v run sleep infinity") +swaymsg("exec exec 127</proc/cmdline && hakurei -v exec sleep infinity") pd_identity0_sleep_pid = int(machine.wait_until_succeeds("pgrep -U 10000 -x sleep", timeout=60)) print(machine.succeed(f"hakurei-test fd {pd_identity0_sleep_pid}")) machine.succeed(f"kill -INT {pd_identity0_sleep_pid}") # Verify capabilities/securebits in user namespace: -print(machine.succeed("sudo -u alice -i hakurei run capsh --print")) -print(machine.succeed("sudo -u alice -i hakurei run capsh --has-no-new-privs")) -print(machine.fail("sudo -u alice -i hakurei run capsh --has-a=CAP_SYS_ADMIN")) -print(machine.fail("sudo -u alice -i hakurei run capsh --has-b=CAP_SYS_ADMIN")) -print(machine.fail("sudo -u alice -i hakurei run capsh --has-i=CAP_SYS_ADMIN")) -print(machine.fail("sudo -u alice -i hakurei run capsh --has-p=CAP_SYS_ADMIN")) -print(machine.fail("sudo -u alice -i hakurei run umount -R /dev")) +print(machine.succeed("sudo -u alice -i hakurei exec capsh --print")) +print(machine.succeed("sudo -u alice -i hakurei exec capsh --has-no-new-privs")) +print(machine.fail("sudo -u alice -i hakurei exec capsh --has-a=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i hakurei exec capsh --has-b=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i hakurei exec capsh --has-i=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i hakurei exec capsh --has-p=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i hakurei exec umount -R /dev")) # Check sandbox outcome: machine.succeed("install -dm0777 /tmp/.hakurei-store-rw/{upper,work}") |