fix(tests): run handlers integration tests in landlock sandbox #1129
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vlaci
reviewed
Feb 12, 2025
a841190 to
7ad8cd2
Compare
vlaci
reviewed
Feb 12, 2025
7ad8cd2 to
bef4fd4
Compare
vlaci
approved these changes
Feb 12, 2025
bef4fd4 to
154e90f
Compare
It's cleaner to check for Landlock's availability by executing a syscall with an empty ruleset. Plus it was already used by the rust part of our python library.
154e90f to
46a2f85
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Handlers tests were not previously run within the landlock sandbox, and even if it was they would have full access to the filesystem since our
is_sandbox_available()was checking for landlock's API availability by requesting read-write access to '/'.It's now fixed by:
is_sandbox_available()within its own thread, not to pollute the main threadThe objective is to identify early any issues we may get into when running extraction within the sandbox.