aboutsummaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2025-03-23nix: filter test from sourceOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23sandbox: verify outcome via mountinfoOphestra
This contains much more information than /proc/mounts and allows for more fields to be checked. This also removes the dependency on the test package. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23test/sandbox: check mapuid outcomeOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23test/sandbox: check tty outcomeOphestra
This makes no difference currently but has different behaviour in the native sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23test/sandbox: print mismatching file contentOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23test: format path aid offsetsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23test/sandbox: pass want file as argumentOphestra
This avoids building the check program multiple times. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23test/sandbox: parse full test caseOphestra
This makes declaring multiple tests much cleaner. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23sandbox/vfs: match MS_NOSYMFOLLOW flagOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23sandbox: apply vfs options to bind mountsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23sandbox/vfs: unfold mount hierarchyOphestra
This presents all visible mount points under path. This is useful for applying extra vfs options to bind mounts. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-23sandbox/vfs: expose mountinfo line scanningOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-22go: 1.23Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21sandbox/vfs: parse vfs optionsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21sandbox: resolve inverted flags in opOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21test/sandbox: rename misleading bind destinationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21test/sandbox: check type handling host_passthroughOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21sandbox/vfs: count mountinfo entriesOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-21sandbox/vfs: implement proc_pid_mountinfo(5) parserOphestra
Test cases are mostly taken from util-linux. This implementation is more correct and slightly faster than the one found in github:kubernetes/utils. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-18sandbox: prepare ops earlyOphestra
Some setup code needs to run in host root. This change allows that to happen. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: pass cmd to cancel functionOphestra
This is not usually in scope otherwise. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: place files with contentOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: create directoriesOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/mount: pass absolute pathOphestra
This should never be used unless there is a good reason to, like using a file in the intermediate root. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: cancel process on serve errorOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: rename params structOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17internal/sys: wrap getuid/getgidOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: create symlinksOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/init: fail early on nil opOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/mount: rename device flagOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: mount container /dev/mqueueOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: unwrap path stringOphestra
Mount proc and dev takes no additional parameters. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox/seccomp: check for both partial read outcomesOphestra
This eliminates intermittent test failures. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17nix: clean up flake outputsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: move out of internalOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: move params setup functionsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: wrap fmsg interfaceOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17seccomp: install output atomicallyOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17dbus: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17ldd: always copy stderrOphestra
Dropping the buffer on success is unhelpful and could hide some useful information. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17ldd: mount /proc in containerOphestra
This covers host /proc. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16test: raise timeoutOphestra
Native container tooling is severely slowed down by race detector. Raise timeout so it reliably completes. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16sandbox: check command function pointerOphestra
Setting default CommandContext on initialisation is somewhat of a footgun. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16helper: implement native container backendOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16helper: raise WaitDelay during testsOphestra
Helper runs very slowly with race detector. This prevents it from timing out. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16test: run go tests with race detectorOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16ldd: lib paths resolve functionOphestra
This is what always happens right after a ldd call, so implement it here. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16helper/stub: copy args to stderrOphestra
Some helpers are implemented via go test itself in tests, and as a result stdout gets clobbered. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16sandbox: return on zero length opsOphestra
This dodges potentially confusing behaviour where init fails due to Ops being clobbered during transfer. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16helper: eliminate commandContext replacementOphestra
This is done more cleanly by modifying Args in cmdF. Signed-off-by: Ophestra <cat@gensokyo.uk>