| Age | Commit message (Collapse) | Author |
|---|
|
Check ops early and eliminate duplicate checks.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
More checks are also added.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is more efficient and makes the call site cleaner.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This can now be done cleanly via path function wrappers.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Fixes regression introduced while integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Same problem as autoroot, never updated the checks after integrating Absolute.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This will never return true otherwise unless the equivalent paths happen to be interned by the caller.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This significantly increases readability.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This helps with the eventual separation of all setup ops into individual files.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is unreachable, but nice to have just in case.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is only a nice to have feature as the init process has no additional privileges and the monitor process was never reachable anyway.
Closes #4.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These can quite easily be checked within the framework. The scanner fault injection might require updating at some point if the implementation changes.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
|
|
This allows some LSM setup in the parent.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This allows setup that relies on per-thread state like securebits and landlock, from the parent side.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The container test suite has always been somewhat inadequate due to the inability of coverage tooling to reach into containers. This has become an excuse for not testing non-container code as well, which lead to the general lack of confidence when working with container code. This change aims to be one of many to address that to some extent.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These keep track of some internal state, and they don't make sense to have multiple instances of anyway, so instead of dealing with that, just make them nonrepetable.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is useful for ops that need to be aware of previous instances of themselves.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These functions do not change the absoluteness of a pathname.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is way higher level than the container package and does not even work unless every path is mounted in the exact same location.
This behaviour causes nothing but confusion and problems,
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is less error-prone, and allows pathname to be checked once.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There are significant limitations to using the overlay mount, and the implementation in the kernel is quite quirky. For now the Op is quite robust, however a higher level interface for it has not been decided yet.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This allows for more sophisticated test setup.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This restores verbose behaviour.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is required for upperdir and workdir checks in overlayfs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This further reduces noise on test failure by only passing through output of the failed test.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This reduces noise on test failure.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These literals were missed when the constants were first defined.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This increases readability since this can help disambiguate absolute paths from similarly named path segments.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There is no reason to mount mqueue anywhere else, and these Ops usually follow each other. This change merges them. This helps decrease IPC overhead and also enables mounting dev readonly.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The mountTmpfs helper is a relatively low level function that is not exposed as part of the API. Prefixing sysroot here not only introduces overhead but is also quite error-prone.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is used for symlink resolution and is only used internally.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
For formatting user-supplied path strings into overlayfs mount data.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
