ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Implement fail-closed ignored workspace routing

Browse source
This commit is contained in:
ms2k 2026-07-16 13:03:04 +09:00
commit 95104fa4e7
2 changed files with 6024 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

2
tests/fixtures/ignored-workspace-v1/corpus.json vendored
View file

@ -168,7 +168,7 @@
"path_hex": "6275696c642f737061727365",
"setup": ["isolated-sparse-source", "isolated-destination", "host-destination"],
"actions": ["seek-hole-data", "punch-hole", "same-route-copy-range", "cross-route-copy-range"],
"expect": ["sparse-extents-preserved", "same-route-bytes-match", "cross-route-EXDEV"]
"expect": ["same-route-returned-count-equals-request", "same-route-source-and-destination-offsets-advance", "same-route-size-and-bytes-match", "cross-route-returned-count-equals-request", "cross-route-destination-range-equals-source", "cross-route-source-unchanged", "cross-route-unrelated-objects-unchanged", "cross-route-handles-remain-pinned", "cross-route-sparse-layout-not-asserted"]
},
{
"id": "symlink-confinement",

88
tests/tooling/test_ignored_workspace_benchmark.py Normal file
View file

@ -0,0 +1,88 @@
import importlib.util
import json
from pathlib import Path
import tempfile
import unittest
from unittest import mock
ROOT = Path(__file__).resolve().parents[2]
SPEC = importlib.util.spec_from_file_location(
"ignored_workspace_benchmark",
ROOT / "tools/ignored_workspace_benchmark.py",
)
BENCHMARK = importlib.util.module_from_spec(SPEC)
SPEC.loader.exec_module(BENCHMARK)
class BenchmarkAdmissionTests(unittest.TestCase):
def test_storage_model_accepts_null_and_uses_last_nonblank_ancestor(self) -> None:
blockdevices = {
"blockdevices": [
{
"path": "/dev/nvme0n1",
"type": "disk",
"model": "Reference Storage",
"tran": "nvme",
"children": [
{
"path": "/dev/mapper/benchmark",
"type": "crypt",
"model": None,
"tran": None,
}
],
}
]
}
with (
mock.patch.object(BENCHMARK, "version_output", return_value=json.dumps(blockdevices)),
mock.patch.object(BENCHMARK.os.path, "realpath", side_effect=lambda path: path),
):
information = BENCHMARK.storage_information("/dev/mapper/benchmark")
self.assertEqual(information["storage_model"], "Reference Storage")
self.assertEqual(information["storage_transport"], "nvme")
self.assertEqual(information["storage_stack"], ["disk", "crypt"])
def test_current_cgroup_swap_max_reads_root_and_nested_v2_memberships(self) -> None:
with tempfile.TemporaryDirectory() as temporary:
temporary = Path(temporary)
cgroup = temporary / "cgroup"
cgroup.mkdir()
membership = temporary / "membership"
membership.write_text("0::/\n")
(cgroup / "memory.swap.max").write_text("max\n")
self.assertEqual(BENCHMARK.current_cgroup_swap_max(membership, cgroup), "max")
nested = cgroup / "user.slice/benchmark.scope"
nested.mkdir(parents=True)
(nested / "memory.swap.max").write_text("0\n")
membership.write_text("0::/user.slice/benchmark.scope\n")
self.assertEqual(BENCHMARK.current_cgroup_swap_max(membership, cgroup), "0")
def test_current_cgroup_swap_max_refuses_malformed_and_escaping_paths(self) -> None:
with tempfile.TemporaryDirectory() as temporary:
temporary = Path(temporary)
cgroup = temporary / "cgroup"
cgroup.mkdir()
membership = temporary / "membership"
for value in ("2:memory:/benchmark\n", "0::/../../outside\n", "0::/ok\n1:name:/other\n"):
with self.subTest(value=value):
membership.write_text(value)
with self.assertRaises(AssertionError):
BENCHMARK.current_cgroup_swap_max(membership, cgroup)
outside = temporary / "outside"
outside.mkdir()
(outside / "memory.swap.max").write_text("0\n")
(cgroup / "escape").symlink_to(outside, target_is_directory=True)
membership.write_text("0::/escape\n")
with self.assertRaisesRegex(AssertionError, "escapes cgroup root"):
BENCHMARK.current_cgroup_swap_max(membership, cgroup)
if __name__ == "__main__":
unittest.main()