nrabulinski/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity
lix/tests/linux-sandbox.sh

67 lines
2.3 KiB
Bash
Raw Normal View History

Add a test for diverted stores
2017-05-02 13:09:35 +00:00
source common.sh
Allow running all the tests with the daemon When `NIX_DAEMON_PACKAGE` is set, make all the tests use the Nix daemon. That way we can test every piece of Nix functionality both with and without the daemon. Tests for which using the daemon isn’t possible or doesn’t make sens can selectively be disabled with `needLocalStore`
2021-07-26 04:54:55 +00:00
needLocalStore "the sandbox only runs on the builder side, so it makes no sense to test it with the daemon"
Add a test for diverted stores
2017-05-02 13:09:35 +00:00
clearStore
Cleanup test skipping - Try not to put cryptic "99" in many places Factor out `exit 99` into `skipTest` function - Alows make sure skipping a test is done with a reason `skipTest` takes a mandatory argument - Separate pure conditionals vs side-effectful test skipping. "require daemon" already had this, but "sandbox support" did not.
2023-03-16 20:00:20 +00:00
requireSandboxSupport
Add a test for diverted stores
2017-05-02 13:09:35 +00:00
# Note: we need to bind-mount $SHELL into the chroot. Currently we
# only support the case where $SHELL is in the Nix store, because
# otherwise things get complicated (e.g. if it's in /bin, do we need
# /lib as well?).
Cleanup test skipping - Try not to put cryptic "99" in many places Factor out `exit 99` into `skipTest` function - Alows make sure skipping a test is done with a reason `skipTest` takes a mandatory argument - Separate pure conditionals vs side-effectful test skipping. "require daemon" already had this, but "sandbox support" did not.
2023-03-16 20:00:20 +00:00
if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi
Add a test for diverted stores
2017-05-02 13:09:35 +00:00
chmod -R u+w $TEST_ROOT/store0 || true
rm -rf $TEST_ROOT/store0
export NIX_STORE_DIR=/my/store
Allow shorter syntax for chroot stores You can now say '--store /tmp/nix' instead of '--store local?root=/tmp/nix'.
2017-10-24 13:16:18 +00:00
export NIX_REMOTE=$TEST_ROOT/store0
Add a test for diverted stores
2017-05-02 13:09:35 +00:00
Test: Replace --option with the corresponding flag
2017-11-20 16:50:49 +00:00
outPath=$(nix-build dependencies.nix --no-out-link --sandbox-paths /nix/store)
Add a test for diverted stores
2017-05-02 13:09:35 +00:00
[[ $outPath =~ /my/store/.*-dependencies ]]
nix path-info -r $outPath | grep input-2
Move NAR-related commands to 'nix nar'
2020-07-24 18:42:24 +00:00
nix store ls -R -l $outPath | grep foobar
Add a test for diverted stores
2017-05-02 13:09:35 +00:00
Move NAR-related commands to 'nix nar'
2020-07-24 18:42:24 +00:00
nix store cat $outPath/foobar | grep FOOBAR
build: add test for sandboxed --check
2019-05-12 14:46:21 +00:00
# Test --check without hash rewriting.
nix-build dependencies.nix --no-out-link --check --sandbox-paths /nix/store
Fix nix-build --check -K in sandbox w/o root Temporarily add user-write permission to build directory so that it can be moved out of the sandbox to the store with a .check suffix. This is necessary because the build directory has already had its permissions set read-only, but write permission is required to update the directory's parent link to move it out of the sandbox. Updated the related --check "derivation may not be deterministic" messages to consistently use the real store paths. Added test for non-root sandbox nix-build --check -K to demonstrate issue and help prevent regressions.
2019-02-17 19:34:31 +00:00
# Test that sandboxed builds with --check and -K can move .check directory to store
nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link
(! nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link --check -K 2> $TEST_ROOT/log)
Harden tests' bash Use `set -u` and `set -o pipefail` to catch accidental mistakes and failures more strongly. - `set -u` catches the use of undefined variables - `set -o pipefail` catches failures (like `set -e`) earlier in the pipeline. This makes the tests a bit more robust. It is nice to read code not worrying about these spurious success paths (via uncaught) errors undermining the tests. Indeed, I caught some bugs doing this. There are a few tests where we run a command that should fail, and then search its output to make sure the failure message is one that we expect. Before, since the `grep` was the last command in the pipeline the exit code of those failing programs was silently ignored. Now with `set -o pipefail` it won't be, and we have to do something so the expected failure doesn't accidentally fail the test. To do that we use `expect` and a new `expectStderr` to check for the exact failing exit code. See the comments on each for why. `grep -q` is replaced with `grepQuiet`, see the comments on that function for why. `grep -v` when we just want the exit code is replaced with `grepInverse, see the comments on that function for why. `grep -q -v` together is, surprise surprise, replaced with `grepQuietInverse`, which is both combined. Co-authored-by: Robert Hensing <roberth@users.noreply.github.com>
2021-12-09 15:26:46 +00:00
if grepQuiet 'error: renaming' $TEST_ROOT/log; then false; fi
grepQuiet 'may not be deterministic' $TEST_ROOT/log
Don't allow writing to /etc
2023-02-14 11:03:34 +00:00
# Test that sandboxed builds cannot write to /etc easily
(! nix-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' --no-out-link --sandbox-paths /nix/store)
Add tests for bind mount of SSL certs in sandbox
2023-05-22 00:32:09 +00:00
## Test mounting of SSL certificates into the sandbox
testCert () {
(! nix-build linux-sandbox-cert-test.nix --argstr fixed-output "$2" --no-out-link --sandbox-paths /nix/store --option ssl-cert-file "$3" 2> $TEST_ROOT/log)
cat $TEST_ROOT/log
grepQuiet "CERT_${1}_IN_SANDBOX" $TEST_ROOT/log
}
nocert=$TEST_ROOT/no-cert-file.pem
cert=$TEST_ROOT/some-cert-file.pem
echo -n "CERT_CONTENT" > $cert
# No cert in sandbox when not a fixed-output derivation
testCert missing normal "$cert"
# No cert in sandbox when ssl-cert-file is empty
testCert missing fixed-output ""
# No cert in sandbox when ssl-cert-file is a nonexistent file
testCert missing fixed-output "$nocert"
# Cert in sandbox when ssl-cert-file is set to an existing file
testCert present fixed-output "$cert"
Copy permalink