ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Add fail-closed Linux process and descriptor primitives

Browse source
This commit is contained in:
ms2k 2026-07-14 22:08:29 +09:00
commit 1468f6b841
1 changed files with 1725 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

56
tests/tooling/test_verify.py
View file

@ -82,6 +82,41 @@ class VerificationTests(unittest.TestCase):
self.assertIsNotNone(VERIFY.LINT_BYPASS.search(source))
self.assertIsNone(VERIFY.LINT_BYPASS.search("#[allow(dead_code)]"))
def test_process_lint_allowances_are_exact_reviewed_functions(self) -> None:
self.assertEqual(
VERIFY.PROCESS_LINT_ALLOWANCES["crates/lazaret-linux/tests/capability-drop-helper.rs"],
{"main"},
)
self.assertNotIn("spawn_unreviewed", set().union(*VERIFY.PROCESS_LINT_ALLOWANCES.values()))
def test_process_lint_allowance_parser_rejects_false_exemptions(self) -> None:
with self.assertRaisesRegex(VERIFY.VerificationError, "whole-file"):
VERIFY.process_lint_allowances(
"example.rs", "#![allow(clippy::disallowed_methods)]\nfn reviewed() {}"
)
with self.assertRaisesRegex(VERIFY.VerificationError, "non-function"):
VERIFY.process_lint_allowances(
"example.rs",
"#[allow(clippy::disallowed_methods)]\nstruct Boundary;\nfn hidden() {}",
)
self.assertEqual(
VERIFY.process_lint_allowances(
"example.rs", "#[allow(clippy::disallowed_methods)]\nfn arbitrary() {}"
),
{"arbitrary"},
)
def test_license_audit_accepts_permitted_choice_only(self) -> None:
allowed = {"Apache-2.0", "MIT"}
self.assertTrue(
VERIFY.license_permitted(
"Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT", allowed
)
)
self.assertTrue(VERIFY.license_permitted("GPL-3.0-only OR MIT", allowed))
self.assertFalse(VERIFY.license_permitted("GPL-3.0-only", allowed))
self.assertFalse(VERIFY.license_permitted("MIT AND GPL-3.0-only", allowed))
def test_workspace_source_discovery_is_not_confined_to_crates(self) -> None:
with tempfile.TemporaryDirectory(dir=ROOT) as directory:
package_root = Path(directory)
@ -125,6 +160,14 @@ class VerificationTests(unittest.TestCase):
with self.assertRaisesRegex(VERIFY.VerificationError, "execve surface count 2"):
VERIFY.validate_process_trace("example", ["execve(a)", "execve(b)"])
def test_wrapper_trace_requires_its_exec_in_place(self) -> None:
VERIFY.validate_process_trace(
"lazaret-launch-wrapper",
["execve(wrapper)", "execve(/bin/true)"],
)
with self.assertRaisesRegex(VERIFY.VerificationError, "execve surface count 1"):
VERIFY.validate_process_trace("lazaret-launch-wrapper", ["execve(wrapper)"])
def test_process_trace_rejects_each_forbidden_surface(self) -> None:
forbidden = (
"clone(child_stack=NULL) = 1",
@ -157,6 +200,7 @@ class VerificationTests(unittest.TestCase):
"lazaret",
"lazaret-escalation-client",
"lazaret-host-coordinator",
"lazaret-launch-wrapper",
"lazaret-network-sidecar",
"lazaret-runtime-supervisor",
},
@ -224,6 +268,18 @@ class VerificationTests(unittest.TestCase):
"--workspace",
"--all-features",
"--locked",
"--filterset",
"not binary(capability-drop-helper)",
],
[
"cargo",
"test",
"--offline",
"-p",
"lazaret-linux",
"--test",
"capability-drop-helper",
"--locked",
],
[
"cargo",