CI: check default chroot hierarchy
# SPDX-License-Identifier: Apache-2.0
"""Tests that verify the jailer's behavior."""
import os
+import stat
+
+# These are the permissions that all files/dirs inside the jailer have.
+REG_PERMS = stat.S_IRUSR | stat.S_IWUSR | \
+ stat.S_IXUSR | stat.S_IRGRP | stat.S_IXGRP | \
+ stat.S_IROTH | stat.S_IXOTH
+DIR_STATS = stat.S_IFDIR | REG_PERMS
+FILE_STATS = stat.S_IFREG | REG_PERMS
+# These are the stats of the devices created by tha jailer.
+CHAR_STATS = stat.S_IFCHR | stat.S_IRUSR | stat.S_IWUSR
+
+
+def check_stats(filepath, stats, uid, gid):
+ """Assert on uid, gid and expected stats for the given path."""
+ st = os.stat(filepath)
+
+ assert st.st_gid == gid
+ assert st.st_uid == uid
+ assert st.st_mode ^ stats == 0
def test_default_chroot(test_microvm_with_ssh):
@@ -36,3 +55,27 @@ def test_empty_jailer_id(test_microvm_with_ssh):
expected_err = "Jailer error: Invalid instance ID: invalid len (0);" \
" the length must be between 1 and 64"
assert expected_err in str(err)
+
+
+def test_default_chroot_hierarchy(test_microvm_with_initrd):
+ """Test the folder hierarchy created by default by the jailer."""
+ test_microvm = test_microvm_with_initrd
+
+ test_microvm.spawn()
+
+ # We do checks for all the things inside the chroot that the jailer crates
+ # by default.
+ check_stats(test_microvm.jailer.chroot_path(), DIR_STATS,
+ test_microvm.jailer.uid, test_microvm.jailer.gid)
+ check_stats(os.path.join(test_microvm.jailer.chroot_path(), "dev"),
+ DIR_STATS, test_microvm.jailer.uid, test_microvm.jailer.gid)
+ check_stats(os.path.join(test_microvm.jailer.chroot_path(), "dev/net"),
+ DIR_STATS, test_microvm.jailer.uid, test_microvm.jailer.gid)
+ check_stats(os.path.join(test_microvm.jailer.chroot_path(), "run"),
+ DIR_STATS, test_microvm.jailer.uid, test_microvm.jailer.gid)
+ check_stats(os.path.join(test_microvm.jailer.chroot_path(), "dev/net/tun"),
+ CHAR_STATS, test_microvm.jailer.uid, test_microvm.jailer.gid)
+ check_stats(os.path.join(test_microvm.jailer.chroot_path(), "dev/kvm"),
+ CHAR_STATS, test_microvm.jailer.uid, test_microvm.jailer.gid)
+ check_stats(os.path.join(test_microvm.jailer.chroot_path(),
+ "firecracker"), FILE_STATS, 0, 0)
