tests: make the named socket and restore tests self-contained - #223
Open
congwang-mk wants to merge 2 commits into
Open
tests: make the named socket and restore tests self-contained#223congwang-mk wants to merge 2 commits into
congwang-mk wants to merge 2 commits into
Conversation
The named-socket tests put the socket under CARGO_TARGET_TMPDIR, so the bind address depended on where the checkout lives, and a deep checkout pushed it past the kernel's 108-byte AF_UNIX limit. They needed a dir outside /tmp only because the policy granted fs_write on all of /tmp. Give each test two short sibling dirs under the system temp dir, grant the output dir alone, and assert the address length so the limit shows up by name. The listener's stderr now lands in the readiness panic, so a bind failure is no longer reported as a missing ready file. Signed-off-by: Cong Wang <cwang@multikernel.io>
The vDSO restore test let the helper inherit the test runner's stdout and stderr, so the checkpoint's fd table depended on how cargo test was invoked. A pipe is skipped at restore, but a log file outside the test's grants makes the restore stub die reopening it. Redirect both to a file inside the granted temp dir for the spawn, so the fd table is the same for every invocation and the reopen path is exercised too. Signed-off-by: Cong Wang <cwang@multikernel.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two integration tests depended on how and where the suite was run rather than on sandlock.
Named unix socket tests built the socket address from
CARGO_TARGET_TMPDIR, so it encoded the checkout path. A deep checkout pushed it past the kernel's 108-byte AF_UNIX limit and the ten tests failed with "listener should signal readiness", hiding python's "AF_UNIX path too long". They lived outside /tmp only because the policy grantedfs_write("/tmp").Each test now gets two short sibling dirs under the system temp dir: one for the socket, one for the files the sandbox writes. Only the output dir is write-granted, so the socket dir stays outside every write grant (Landlock grants are additive) and the deny cases keep their meaning. The address length is asserted against the limit by name, and the listener's stderr is included in the readiness panic.
vDSO restore test let the checkpointed helper inherit the test runner's stdout and stderr. A pipe is skipped at restore, but a log file outside the test's grants makes the restore stub die reopening it (exit 10), so
cargo test > logfailed whilecargo test | tee logpassed. A small guard redirects fds 1 and 2 to a file inside the granted temp dir for the spawn, which makes the fd table the same on every invocation and exercises the reopen path on a real file.Verified in a worktree under a 100+ byte path with stdout redirected to a file, the conditions that broke both before: 10/10 socket tests pass, the restore test passes under file and pipe stdout, and the rest of the core integration suite is unchanged.
🤖 Generated with Claude Code