piegames/lix
0
0
Fork 0
forked from lix-project/lix
Code Pull requests Activity

Merge pull request #8387 from layus/fix-tests

Browse source 
Check exact error codes in linux-sandbox.sh
This commit is contained in:
John Ericson 2023-06-22 13:56:03 -04:00 committed by GitHub
parent 78e1e3c753 3a20c7c46c
commit 2291232dc1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 38 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
tests/linux-sandbox-cert-test.nix
View file

@ -1,29 +1,30 @@
{ fixed-output }: { mode }:
with import ./config.nix; with import ./config.nix;
mkDerivation ({ mkDerivation (
name = "ssl-export"; {
buildCommand = '' name = "ssl-export";
# Add some indirection, otherwise grepping into the debug output finds the string. buildCommand = ''
report () { echo CERT_$1_IN_SANDBOX; } # Add some indirection, otherwise grepping into the debug output finds the string.
report () { echo CERT_$1_IN_SANDBOX; }
if [ -f /etc/ssl/certs/ca-certificates.crt ]; then if [ -f /etc/ssl/certs/ca-certificates.crt ]; then
content=$(</etc/ssl/certs/ca-certificates.crt) content=$(</etc/ssl/certs/ca-certificates.crt)
if [ "$content" == CERT_CONTENT ]; then if [ "$content" == CERT_CONTENT ]; then
report present report present
fi
else
report missing
fi fi
else
report missing
fi
# Always fail, because we do not want to bother with fixed-output # Always fail, because we do not want to bother with fixed-output
# derivations being cached, and do not want to compute the right hash. # derivations being cached, and do not want to compute the right hash.
false; false;
''; '';
} // ( } // {
if fixed-output == "fixed-output" fixed-output = { outputHash = "sha256:0000000000000000000000000000000000000000000000000000000000000000"; };
then { outputHash = "sha256:0000000000000000000000000000000000000000000000000000000000000000"; } normal = { };
else { } }.${mode}
)) )

24
tests/linux-sandbox.sh
View file

@ -11,6 +11,8 @@ requireSandboxSupport
# otherwise things get complicated (e.g. if it's in /bin, do we need # otherwise things get complicated (e.g. if it's in /bin, do we need
# /lib as well?). # /lib as well?).
if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi if [[ ! $SHELL =~ /nix/store ]]; then skipTest "Shell is not from Nix store"; fi
# An alias to automatically bind-mount the $SHELL on nix-build invocations
nix-sandbox-build () { nix-build --no-out-link --sandbox-paths /nix/store "$@"; }
chmod -R u+w $TEST_ROOT/store0 || true chmod -R u+w $TEST_ROOT/store0 || true
rm -rf $TEST_ROOT/store0 rm -rf $TEST_ROOT/store0
@ -18,7 +20,7 @@ rm -rf $TEST_ROOT/store0
export NIX_STORE_DIR=/my/store export NIX_STORE_DIR=/my/store
export NIX_REMOTE=$TEST_ROOT/store0 export NIX_REMOTE=$TEST_ROOT/store0
outPath=$(nix-build dependencies.nix --no-out-link --sandbox-paths /nix/store) outPath=$(nix-sandbox-build dependencies.nix)
[[ $outPath =~ /my/store/.*-dependencies ]] [[ $outPath =~ /my/store/.*-dependencies ]]
@ -29,24 +31,28 @@ nix store ls -R -l $outPath | grep foobar
nix store cat $outPath/foobar | grep FOOBAR nix store cat $outPath/foobar | grep FOOBAR
# Test --check without hash rewriting. # Test --check without hash rewriting.
nix-build dependencies.nix --no-out-link --check --sandbox-paths /nix/store nix-sandbox-build dependencies.nix --check
# Test that sandboxed builds with --check and -K can move .check directory to store # Test that sandboxed builds with --check and -K can move .check directory to store
nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link nix-sandbox-build check.nix -A nondeterministic
(! nix-build check.nix -A nondeterministic --sandbox-paths /nix/store --no-out-link --check -K 2> $TEST_ROOT/log) expectStderr 104 nix-sandbox-build check.nix -A nondeterministic --check -K > $TEST_ROOT/log
if grepQuiet 'error: renaming' $TEST_ROOT/log; then false; fi grepQuietInverse 'error: renaming' $TEST_ROOT/log
grepQuiet 'may not be deterministic' $TEST_ROOT/log grepQuiet 'may not be deterministic' $TEST_ROOT/log
# Test that sandboxed builds cannot write to /etc easily # Test that sandboxed builds cannot write to /etc easily
(! nix-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' --no-out-link --sandbox-paths /nix/store) expectStderr 100 nix-sandbox-build -E 'with import ./config.nix; mkDerivation { name = "etc-write"; buildCommand = "echo > /etc/test"; }' |
grepQuiet "/etc/test: Permission denied"
## Test mounting of SSL certificates into the sandbox ## Test mounting of SSL certificates into the sandbox
testCert () { testCert () {
(! nix-build linux-sandbox-cert-test.nix --argstr fixed-output "$2" --no-out-link --sandbox-paths /nix/store --option ssl-cert-file "$3" 2> $TEST_ROOT/log) expectation=$1 # "missing" | "present"
cat $TEST_ROOT/log mode=$2 # "normal" | "fixed-output"
grepQuiet "CERT_${1}_IN_SANDBOX" $TEST_ROOT/log certFile=$3 # a string that can be the path to a cert file
[ "$mode" == fixed-output ] && ret=1 || ret=100
expectStderr $ret nix-sandbox-build linux-sandbox-cert-test.nix --argstr mode "$mode" --option ssl-cert-file "$certFile" |
grepQuiet "CERT_${expectation}_IN_SANDBOX"
} }
nocert=$TEST_ROOT/no-cert-file.pem nocert=$TEST_ROOT/no-cert-file.pem