--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
tests/backend/test_landlock_sandbox.py dev (af76f09d) Text, 10.81 KB
T8b949e# SPDX-License-Identifier: 0BSD
Tff7b72import T7ee787os
Tff7b72import T7ee787sys
Tff7b72from T7ee787unittestT7ee787.T7ee787mock Tff7b72import Te6edf3patch
Tff7b72import T7ee787pytest
Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backend Tff7b72import Te6edf3landlock_sandbox Tff7b72as Te6edf3ll
Tff7b72def Td2a8fftest_parse_kernel_versionTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72assert Te6edf3llTff7b72.Td2a8ff_parse_kernel_versionTb4b4b4(Ta5d6ff"Ta5d6ff6.12.7-1-cachyos-hardenedTa5d6ff"Tb4b4b4) Tff7b72== Tb4b4b4(T79c0ff6Tb4b4b4, T79c0ff12Tb4b4b4, T79c0ff7Tb4b4b4)
Tff7b72assert Te6edf3llTff7b72.Td2a8ff_parse_kernel_versionTb4b4b4(Ta5d6ff"Ta5d6ff5.13.0Ta5d6ff"Tb4b4b4) Tff7b72== Tb4b4b4(T79c0ff5Tb4b4b4, T79c0ff13Tb4b4b4, T79c0ff0Tb4b4b4)
Tff7b72assert Te6edf3llTff7b72.Td2a8ff_parse_kernel_versionTb4b4b4(Ta5d6ff"Ta5d6ff5.12.19Ta5d6ff"Tb4b4b4) Tff7b72== Tb4b4b4(T79c0ff5Tb4b4b4, T79c0ff12Tb4b4b4, T79c0ff19Tb4b4b4)
Tff7b72def Td2a8fftest_kernel_version_meets_minimumTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72with Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(
Te6edf3llTff7b72.Td2a8ffosTb4b4b4,
Ta5d6ff"Ta5d6ffunameTa5d6ff"Tb4b4b4,
Te6edf3return_valueTff7b72=Tffa657typeTb4b4b4(Ta5d6ff"Ta5d6ffUTa5d6ff"Tb4b4b4, Tb4b4b4(Tb4b4b4)Tb4b4b4, Tb4b4b4{Ta5d6ff"Ta5d6ffreleaseTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ff6.12.7Ta5d6ff"Tb4b4b4}Tb4b4b4)Tb4b4b4(Tb4b4b4)Tb4b4b4,
Tb4b4b4)Tb4b4b4:
Tff7b72assert Te6edf3llTff7b72.Td2a8ff_kernel_version_meets_minimumTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72True
Tff7b72with Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(
Te6edf3llTff7b72.Td2a8ffosTb4b4b4,
Ta5d6ff"Ta5d6ffunameTa5d6ff"Tb4b4b4,
Te6edf3return_valueTff7b72=Tffa657typeTb4b4b4(Ta5d6ff"Ta5d6ffUTa5d6ff"Tb4b4b4, Tb4b4b4(Tb4b4b4)Tb4b4b4, Tb4b4b4{Ta5d6ff"Ta5d6ffreleaseTa5d6ff"Tb4b4b4: Ta5d6ff"Ta5d6ff5.12.99Ta5d6ff"Tb4b4b4}Tb4b4b4)Tb4b4b4(Tb4b4b4)Tb4b4b4,
Tb4b4b4)Tb4b4b4:
Tff7b72assert Te6edf3llTff7b72.Td2a8ff_kernel_version_meets_minimumTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False
Tff7b72def Td2a8fftest_landlock_requested_non_linuxTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72with Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3llTb4b4b4, Ta5d6ff"Ta5d6ffsysTa5d6ff"Tb4b4b4) Tff7b72as Te6edf3mock_sysTb4b4b4:
Te6edf3mock_sysTff7b72.Td2a8ffplatform Tff7b72= Ta5d6ff"Ta5d6ffdarwinTa5d6ff"
Tff7b72assert Te6edf3llTff7b72.Td2a8fflandlock_requestedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False
Tff7b72def Td2a8fftest_landlock_requested_respects_disable_envTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:
Te6edf3monkeypatchTff7b72.Td2a8ffsetenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_LANDLOCKTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff0Ta5d6ff"Tb4b4b4)
Tff7b72with Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3llTb4b4b4, Ta5d6ff"Ta5d6ffsysTa5d6ff"Tb4b4b4) Tff7b72as Te6edf3mock_sysTb4b4b4:
Te6edf3mock_sysTff7b72.Td2a8ffplatform Tff7b72= Ta5d6ff"Ta5d6fflinuxTa5d6ff"
Tff7b72assert Te6edf3llTff7b72.Td2a8fflandlock_requestedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False
Tff7b72assert Te6edf3llTff7b72.Td2a8fflandlock_disabled_by_envTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72True
Tff7b72def Td2a8fftest_landlock_requested_force_enable_envTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:
Te6edf3monkeypatchTff7b72.Td2a8ffsetenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_LANDLOCKTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff1Ta5d6ff"Tb4b4b4)
Tff7b72with Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3llTb4b4b4, Ta5d6ff"Ta5d6ffsysTa5d6ff"Tb4b4b4) Tff7b72as Te6edf3mock_sysTb4b4b4:
Te6edf3mock_sysTff7b72.Td2a8ffplatform Tff7b72= Ta5d6ff"Ta5d6fflinuxTa5d6ff"
Tff7b72assert Te6edf3llTff7b72.Td2a8fflandlock_requestedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72True
Tff7b72assert Te6edf3llTff7b72.Td2a8fflandlock_auto_enabledTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False
Tff7b72def Td2a8fftest_landlock_auto_when_supportedTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:
Te6edf3monkeypatchTff7b72.Td2a8ffdelenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_LANDLOCKTa5d6ff"Tb4b4b4, Te6edf3raisingTff7b72=Tff7b72FalseTb4b4b4)
Te6edf3llTff7b72.Td2a8ff_landlock_support_cached Tff7b72= Tff7b72None
Tff7b72with Tb4b4b4(
Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3llTb4b4b4, Ta5d6ff"Ta5d6ffsysTa5d6ff"Tb4b4b4) Tff7b72as Te6edf3mock_sysTb4b4b4,
Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3llTb4b4b4, Ta5d6ff"Ta5d6fflandlock_kernel_supportedTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72TrueTb4b4b4)Tb4b4b4,
Tb4b4b4)Tb4b4b4:
Te6edf3mock_sysTff7b72.Td2a8ffplatform Tff7b72= Ta5d6ff"Ta5d6fflinuxTa5d6ff"
Tff7b72assert Te6edf3llTff7b72.Td2a8fflandlock_requestedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72True
Tff7b72assert Te6edf3llTff7b72.Td2a8fflandlock_auto_enabledTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72True
Tff7b72def Td2a8fftest_landlock_auto_off_when_kernel_unsupportedTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:
Te6edf3monkeypatchTff7b72.Td2a8ffdelenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_LANDLOCKTa5d6ff"Tb4b4b4, Te6edf3raisingTff7b72=Tff7b72FalseTb4b4b4)
Tff7b72with Tb4b4b4(
Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3llTb4b4b4, Ta5d6ff"Ta5d6ffsysTa5d6ff"Tb4b4b4) Tff7b72as Te6edf3mock_sysTb4b4b4,
Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3llTb4b4b4, Ta5d6ff"Ta5d6fflandlock_kernel_supportedTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72FalseTb4b4b4)Tb4b4b4,
Tb4b4b4)Tb4b4b4:
Te6edf3mock_sysTff7b72.Td2a8ffplatform Tff7b72= Ta5d6ff"Ta5d6fflinuxTa5d6ff"
Tff7b72assert Te6edf3llTff7b72.Td2a8fflandlock_requestedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False
Tff7b72assert Te6edf3llTff7b72.Td2a8fflandlock_auto_enabledTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False
Tff7b72def Td2a8fftest_landlock_kernel_supported_false_on_androidTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:
T8b949e"""Android seccomp blocks Landlock syscalls with SIGSYS."""
Te6edf3monkeypatchTff7b72.Td2a8ffdelenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_LANDLOCKTa5d6ff"Tb4b4b4, Te6edf3raisingTff7b72=Tff7b72FalseTb4b4b4)
Te6edf3llTff7b72.Td2a8ff_landlock_support_cached Tff7b72= Tff7b72None
Tff7b72with Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3llTb4b4b4, Ta5d6ff"Ta5d6ffsysTa5d6ff"Tb4b4b4) Tff7b72as Te6edf3mock_sysTb4b4b4:
Te6edf3mock_sysTff7b72.Td2a8ffplatform Tff7b72= Ta5d6ff"Ta5d6fflinuxTa5d6ff"
Te6edf3mock_sysTff7b72.Td2a8ffgetandroidapilevel Tff7b72= Tff7b72lambdaTb4b4b4: T79c0ff34
Tff7b72assert Te6edf3llTff7b72.Td2a8fflandlock_kernel_supportedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffskipifTb4b4b4(Te6edf3sysTff7b72.Td2a8ffplatform Tff7b72!= Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4, Te6edf3reasonTff7b72=Ta5d6ff"Ta5d6ffLandlock probe requires LinuxTa5d6ff"Tb4b4b4)
Tff7b72def Td2a8fftest_landlock_kernel_supported_on_linuxTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3llTff7b72.Td2a8ff_landlock_support_cached Tff7b72= Tff7b72None
Te6edf3supported Tff7b72= Te6edf3llTff7b72.Td2a8fflandlock_kernel_supportedTb4b4b4(Tb4b4b4)
Tff7b72assert Tffa657isinstanceTb4b4b4(Te6edf3supportedTb4b4b4, Tffa657boolTb4b4b4)
Tff7b72def Td2a8fftest_collect_read_roots_includes_proc_for_psutilTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3roots Tff7b72= Te6edf3llTff7b72.Td2a8ff_collect_read_rootsTb4b4b4(Tb4b4b4)
Tff7b72assert Ta5d6ff"Ta5d6ff/procTa5d6ff" Tff7b72in Te6edf3roots
Tff7b72def Td2a8fftest_collect_read_roots_includes_user_local_cli_when_presentTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3home Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffexpanduserTb4b4b4(Ta5d6ff"Ta5d6ff~Ta5d6ff"Tb4b4b4)
Te6edf3local_bin Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffjoinTb4b4b4(Te6edf3homeTb4b4b4, Ta5d6ff"Ta5d6ff.localTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffbinTa5d6ff"Tb4b4b4)
Te6edf3roots Tff7b72= Te6edf3llTff7b72.Td2a8ff_collect_read_rootsTb4b4b4(Tb4b4b4)
Tff7b72if Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffisdirTb4b4b4(Te6edf3local_binTb4b4b4)Tb4b4b4:
Tff7b72assert Tffa657anyTb4b4b4(
Te6edf3local_bin Tff7b72== Te6edf3root Tff7b72or Te6edf3local_binTff7b72.Td2a8ffstartswithTb4b4b4(Te6edf3rootTff7b72.Td2a8ffrstripTb4b4b4(Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4) Tff7b72+ Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)
Tff7b72for Te6edf3root Tff7b72in Te6edf3roots
Tb4b4b4)Tb4b4b4, Ta5d6fffTa5d6ff"Tffd700{Te6edf3local_binTffd700!r}Ta5d6ff not covered by landlock read rootsTa5d6ff"
Tff7b72def Td2a8fftest_collect_read_roots_includes_meshchatx_package_dirTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3roots Tff7b72= Te6edf3llTff7b72.Td2a8ff_collect_read_rootsTb4b4b4(Tb4b4b4)
Tff7b72import T7ee787meshchatx Tff7b72as T7ee787pkg
Te6edf3init_file Tff7b72= Tffa657getattrTb4b4b4(Te6edf3pkgTb4b4b4, Ta5d6ff"Ta5d6ff__file__Ta5d6ff"Tb4b4b4, Tff7b72NoneTb4b4b4)
Tff7b72assert Te6edf3init_file
Te6edf3pkg_dir Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffrealpathTb4b4b4(Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffdirnameTb4b4b4(Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffabspathTb4b4b4(Te6edf3init_fileTb4b4b4)Tb4b4b4)Tb4b4b4)
Tff7b72assert Tffa657anyTb4b4b4(
Te6edf3pkg_dir Tff7b72== Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffrealpathTb4b4b4(Te6edf3rootTb4b4b4)
Tff7b72or Te6edf3pkg_dirTff7b72.Td2a8ffstartswithTb4b4b4(Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffrealpathTb4b4b4(Te6edf3rootTb4b4b4)Tff7b72.Td2a8ffrstripTb4b4b4(Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4) Tff7b72+ Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)
Tff7b72for Te6edf3root Tff7b72in Te6edf3roots
Tb4b4b4)Tb4b4b4, Ta5d6fffTa5d6ff"Ta5d6ffmeshchatx package dir Tffd700{Te6edf3pkg_dirTffd700!r}Ta5d6ff not covered by read rootsTa5d6ff"
Tff7b72def Td2a8fftest_collect_read_roots_includes_interpreter_prefixTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3roots Tff7b72= Te6edf3llTff7b72.Td2a8ff_collect_read_rootsTb4b4b4(Tb4b4b4)
Te6edf3exe Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffrealpathTb4b4b4(Te6edf3sysTff7b72.Td2a8ffexecutableTb4b4b4)
Te6edf3prefix Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffrealpathTb4b4b4(Tffa657getattrTb4b4b4(Te6edf3sysTb4b4b4, Ta5d6ff"Ta5d6ffbase_prefixTa5d6ff"Tb4b4b4, Tff7b72NoneTb4b4b4) Tff7b72or Te6edf3sysTff7b72.Td2a8ffprefixTb4b4b4)
Tff7b72assert Tffa657anyTb4b4b4(
Te6edf3exe Tff7b72== Te6edf3root Tff7b72or Te6edf3exeTff7b72.Td2a8ffstartswithTb4b4b4(Te6edf3rootTff7b72.Td2a8ffrstripTb4b4b4(Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4) Tff7b72+ Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4) Tff7b72for Te6edf3root Tff7b72in Te6edf3roots
Tb4b4b4)Tb4b4b4, Ta5d6fffTa5d6ff"Ta5d6ffexecutable Tffd700{Te6edf3exeTffd700!r}Ta5d6ff not covered by Tffd700{Te6edf3rootsTffd700!r}Ta5d6ff"
Tff7b72assert Tffa657anyTb4b4b4(
Te6edf3prefix Tff7b72== Te6edf3root Tff7b72or Te6edf3prefixTff7b72.Td2a8ffstartswithTb4b4b4(Te6edf3rootTff7b72.Td2a8ffrstripTb4b4b4(Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4) Tff7b72+ Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4) Tff7b72for Te6edf3root Tff7b72in Te6edf3roots
Tb4b4b4)Tb4b4b4, Ta5d6fffTa5d6ff"Ta5d6ffprefix Tffd700{Te6edf3prefixTffd700!r}Ta5d6ff not covered by Tffd700{Te6edf3rootsTffd700!r}Ta5d6ff"
T8b949e# Active venv root (sys.prefix) must be allowed even when base_prefix differs,
T8b949e# otherwise child Python cannot read pyvenv.cfg (Docker /opt/venv + rnsh).
Te6edf3venv_prefix Tff7b72= Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffrealpathTb4b4b4(Te6edf3sysTff7b72.Td2a8ffprefixTb4b4b4)
Tff7b72assert Tffa657anyTb4b4b4(
Te6edf3venv_prefix Tff7b72== Te6edf3root Tff7b72or Te6edf3venv_prefixTff7b72.Td2a8ffstartswithTb4b4b4(Te6edf3rootTff7b72.Td2a8ffrstripTb4b4b4(Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4) Tff7b72+ Ta5d6ff"Ta5d6ff/Ta5d6ff"Tb4b4b4)
Tff7b72for Te6edf3root Tff7b72in Te6edf3roots
Tb4b4b4)Tb4b4b4, Ta5d6fffTa5d6ff"Ta5d6ffsys.prefix Tffd700{Te6edf3venv_prefixTffd700!r}Ta5d6ff not covered by Tffd700{Te6edf3rootsTffd700!r}Ta5d6ff"
Tff7b72def Td2a8fftest_collect_read_roots_includes_venv_root_for_pyvenv_cfgTb4b4b4(Te6edf3tmp_pathTb4b4b4, Te6edf3monkeypatchTb4b4b4)Tb4b4b4:
T8b949e"""Landlock must allow the venv root, not only …/bin (pyvenv.cfg sibling)."""
Te6edf3venv Tff7b72= Te6edf3tmp_path Tff7b72/ Ta5d6ff"Ta5d6ffoptTa5d6ff" Tff7b72/ Ta5d6ff"Ta5d6ffvenvTa5d6ff"
Te6edf3bindir Tff7b72= Te6edf3venv Tff7b72/ Ta5d6ff"Ta5d6ffbinTa5d6ff"
Te6edf3bindirTff7b72.Td2a8ffmkdirTb4b4b4(Te6edf3parentsTff7b72=Tff7b72TrueTb4b4b4)
Tb4b4b4(Te6edf3venv Tff7b72/ Ta5d6ff"Ta5d6ffpyvenv.cfgTa5d6ff"Tb4b4b4)Tff7b72.Td2a8ffwrite_textTb4b4b4(Ta5d6ff"Ta5d6ffhome = /usrTffea00\nTa5d6ff"Tb4b4b4, Te6edf3encodingTff7b72=Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)
Te6edf3fake_python Tff7b72= Te6edf3bindir Tff7b72/ Ta5d6ff"Ta5d6ffpythonTa5d6ff"
Te6edf3fake_pythonTff7b72.Td2a8ffwrite_textTb4b4b4(Ta5d6ff"Ta5d6ff#!/bin/shTffea00\nTa5d6ff"Tb4b4b4, Te6edf3encodingTff7b72=Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Tb4b4b4)
Tff7b72class T56d364_FakeSysTb4b4b4:
Te6edf3platform Tff7b72= Te6edf3sysTff7b72.Td2a8ffplatform
Te6edf3executable Tff7b72= Tffa657strTb4b4b4(Te6edf3fake_pythonTb4b4b4)
Te6edf3prefix Tff7b72= Tffa657strTb4b4b4(Te6edf3venvTb4b4b4)
Te6edf3base_prefix Tff7b72= Ta5d6ff"Ta5d6ff/usrTa5d6ff"
Te6edf3path Tff7b72= Tffa657listTb4b4b4(Te6edf3sysTff7b72.Td2a8ffpathTb4b4b4)
Te6edf3monkeypatchTff7b72.Td2a8ffsetattrTb4b4b4(Te6edf3llTb4b4b4, Ta5d6ff"Ta5d6ffsysTa5d6ff"Tb4b4b4, Te6edf3_FakeSysTb4b4b4)
Te6edf3monkeypatchTff7b72.Td2a8ffsetattrTb4b4b4(Te6edf3llTff7b72.Td2a8ffsiteTb4b4b4, Ta5d6ff"Ta5d6ffgetsitepackagesTa5d6ff"Tb4b4b4, Tff7b72lambdaTb4b4b4: Tb4b4b4[Tb4b4b4]Tb4b4b4)
Te6edf3monkeypatchTff7b72.Td2a8ffsetattrTb4b4b4(Te6edf3llTff7b72.Td2a8ffsiteTb4b4b4, Ta5d6ff"Ta5d6ffgetusersitepackagesTa5d6ff"Tb4b4b4, Tff7b72lambdaTb4b4b4: Ta5d6ff"Ta5d6ff"Tb4b4b4)
Te6edf3monkeypatchTff7b72.Td2a8ffsetenvTb4b4b4(Ta5d6ff"Ta5d6ffVIRTUAL_ENVTa5d6ff"Tb4b4b4, Tffa657strTb4b4b4(Te6edf3venvTb4b4b4)Tb4b4b4)
Te6edf3roots Tff7b72= Tb4b4b4{Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffrealpathTb4b4b4(Te6edf3rTb4b4b4) Tff7b72for Te6edf3r Tff7b72in Te6edf3llTff7b72.Td2a8ff_collect_read_rootsTb4b4b4(Tb4b4b4)Tb4b4b4}
Tff7b72assert Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffrealpathTb4b4b4(Tffa657strTb4b4b4(Te6edf3venvTb4b4b4)Tb4b4b4) Tff7b72in Te6edf3roots
Tff7b72assert Te6edf3osTff7b72.Td2a8ffpathTff7b72.Td2a8ffrealpathTb4b4b4(Tffa657strTb4b4b4(Te6edf3bindirTb4b4b4)Tb4b4b4) Tff7b72in Te6edf3roots
Tff7b72def Td2a8fftest_handled_access_fs_for_abi_gates_new_rightsTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3abi1 Tff7b72= Te6edf3llTff7b72.Td2a8ff_handled_access_fs_for_abiTb4b4b4(T79c0ff1Tb4b4b4)
Tff7b72assert Te6edf3abi1 Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_REFER Tff7b72== T79c0ff0
Tff7b72assert Te6edf3abi1 Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_TRUNCATE Tff7b72== T79c0ff0
Tff7b72assert Te6edf3abi1 Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_IOCTL_DEV Tff7b72== T79c0ff0
Tff7b72assert Te6edf3abi1 Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_WRITE_FILE
Te6edf3abi2 Tff7b72= Te6edf3llTff7b72.Td2a8ff_handled_access_fs_for_abiTb4b4b4(T79c0ff2Tb4b4b4)
Tff7b72assert Te6edf3abi2 Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_REFER
Tff7b72assert Te6edf3abi2 Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_TRUNCATE Tff7b72== T79c0ff0
Te6edf3abi3 Tff7b72= Te6edf3llTff7b72.Td2a8ff_handled_access_fs_for_abiTb4b4b4(T79c0ff3Tb4b4b4)
Tff7b72assert Te6edf3abi3 Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_REFER
Tff7b72assert Te6edf3abi3 Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_TRUNCATE
Tff7b72assert Te6edf3abi3 Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_IOCTL_DEV Tff7b72== T79c0ff0
Te6edf3abi5 Tff7b72= Te6edf3llTff7b72.Td2a8ff_handled_access_fs_for_abiTb4b4b4(T79c0ff5Tb4b4b4)
Tff7b72assert Te6edf3abi5 Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_IOCTL_DEV
T8b949e# Network and UNIX-resolve rights stay unhandled on purpose.
Tff7b72assert Te6edf3abi5 Tff7b72== Te6edf3llTff7b72.Td2a8ff_handled_access_fs_for_abiTb4b4b4(T79c0ff10Tb4b4b4)
Tff7b72def Td2a8fftest_rw_access_grants_new_rights_when_handledTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3handled Tff7b72= Te6edf3llTff7b72.Td2a8ff_handled_access_fs_for_abiTb4b4b4(T79c0ff5Tb4b4b4)
Te6edf3read_access Tff7b72= Te6edf3llTff7b72.Td2a8ff_read_access_for_handledTb4b4b4(Te6edf3handledTb4b4b4)
Te6edf3rw_access Tff7b72= Te6edf3llTff7b72.Td2a8ff_rw_access_for_handledTb4b4b4(Te6edf3handledTb4b4b4)
Tff7b72assert Te6edf3read_access Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_TRUNCATE Tff7b72== T79c0ff0
Tff7b72assert Te6edf3read_access Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_IOCTL_DEV Tff7b72== T79c0ff0
Tff7b72assert Te6edf3read_access Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_REFER Tff7b72== T79c0ff0
Tff7b72assert Te6edf3rw_access Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_TRUNCATE
Tff7b72assert Te6edf3rw_access Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_IOCTL_DEV
Tff7b72assert Te6edf3rw_access Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_REFER
Tff7b72def Td2a8fftest_ruleset_attr_size_matches_abiTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72assert Te6edf3llTff7b72.Td2a8ff_ruleset_attr_sizeTb4b4b4(T79c0ff1Tb4b4b4) Tff7b72== T79c0ff8
Tff7b72assert Te6edf3llTff7b72.Td2a8ff_ruleset_attr_sizeTb4b4b4(T79c0ff3Tb4b4b4) Tff7b72== T79c0ff8
Tff7b72assert Te6edf3llTff7b72.Td2a8ff_ruleset_attr_sizeTb4b4b4(T79c0ff4Tb4b4b4) Tff7b72== T79c0ff16
Tff7b72assert Te6edf3llTff7b72.Td2a8ff_ruleset_attr_sizeTb4b4b4(T79c0ff5Tb4b4b4) Tff7b72== T79c0ff16
Tff7b72assert Te6edf3llTff7b72.Td2a8ff_ruleset_attr_sizeTb4b4b4(T79c0ff6Tb4b4b4) Tff7b72== T79c0ff24
Tff7b72def Td2a8fftest_file_access_includes_truncate_with_writeTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3handled Tff7b72= Te6edf3llTff7b72.Td2a8ff_handled_access_fs_for_abiTb4b4b4(T79c0ff5Tb4b4b4)
Te6edf3rw Tff7b72= Te6edf3llTff7b72.Td2a8ff_rw_access_for_handledTb4b4b4(Te6edf3handledTb4b4b4)
Te6edf3file_access Tff7b72= Te6edf3llTff7b72.Td2a8ff_file_access_from_dir_accessTb4b4b4(Te6edf3rwTb4b4b4, Te6edf3handledTb4b4b4)
Tff7b72assert Te6edf3file_access Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_WRITE_FILE
Tff7b72assert Te6edf3file_access Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_TRUNCATE
Tff7b72assert Te6edf3file_access Tff7b72& Te6edf3llTff7b72.Td2a8ff_LANDLOCK_ACCESS_FS_IOCTL_DEV
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffskipifTb4b4b4(Te6edf3sysTff7b72.Td2a8ffplatform Tff7b72!= Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4, Te6edf3reasonTff7b72=Ta5d6ff"Ta5d6ffLandlock probe requires LinuxTa5d6ff"Tb4b4b4)
Tff7b72def Td2a8fftest_landlock_abi_version_on_linuxTb4b4b4(Tb4b4b4)Tb4b4b4:
Te6edf3llTff7b72.Td2a8ff_landlock_abi_cached Tff7b72= Tff7b72None
Te6edf3llTff7b72.Td2a8ff_landlock_support_cached Tff7b72= Tff7b72None
Te6edf3abi Tff7b72= Te6edf3llTff7b72.Td2a8fflandlock_abi_versionTb4b4b4(Tb4b4b4)
Tff7b72assert Tffa657isinstanceTb4b4b4(Te6edf3abiTb4b4b4, Tffa657intTb4b4b4)
Tff7b72assert Te6edf3abi Tff7b72>Tff7b72= T79c0ff0
Tff7b72if Te6edf3llTff7b72.Td2a8fflandlock_kernel_supportedTb4b4b4(Tb4b4b4)Tb4b4b4:
Tff7b72assert Te6edf3abi Tff7b72>Tff7b72= T79c0ff1
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffskipifTb4b4b4(
Te6edf3sysTff7b72.Td2a8ffplatform Tff7b72!= Ta5d6ff"Ta5d6fflinuxTa5d6ff" Tff7b72or Tff7b72not Te6edf3llTff7b72.Td2a8fflandlock_kernel_supportedTb4b4b4(Tb4b4b4)Tb4b4b4,
Te6edf3reasonTff7b72=Ta5d6ff"Ta5d6ffLandlock apply requires a supported Linux kernelTa5d6ff"Tb4b4b4,
Tb4b4b4)
Tff7b72def Td2a8fftest_apply_landlock_preserves_storage_write_and_truncateTb4b4b4(Te6edf3tmp_pathTb4b4b4)Tb4b4b4:
T8b949e"""Apply sandbox in a subprocess and confirm RW + truncate still work."""
Tff7b72from T7ee787testsT7ee787.T7ee787backendT7ee787.T7ee787landlock_integration_support Tff7b72import Tb4b4b4(
Te6edf3assert_probe_okTb4b4b4,
Te6edf3run_python_under_landlockTb4b4b4,
Tb4b4b4)
Te6edf3storage Tff7b72= Te6edf3tmp_path Tff7b72/ Ta5d6ff"Ta5d6ffstorageTa5d6ff"
Te6edf3storageTff7b72.Td2a8ffmkdirTb4b4b4(Tb4b4b4)
Te6edf3result Tff7b72= Te6edf3run_python_under_landlockTb4b4b4(
Ta5d6fffTa5d6ff"""
Ta5d6ff import os
Ta5d6ff import sys
Ta5d6ff storage = Tffd700{Tffa657strTb4b4b4(Te6edf3storageTb4b4b4)Tffd700!r}
Ta5d6ff path = os.path.join(storage, Ta5d6ff"Ta5d6fflandlock-abi-check.txtTa5d6ff"Ta5d6ff)
Ta5d6ff with open(path, Ta5d6ff"Ta5d6ffwTa5d6ff"Ta5d6ff, encoding=Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Ta5d6ff) as handle:
Ta5d6ff handle.write(Ta5d6ff"Ta5d6ffhelloTa5d6ff"Ta5d6ff)
Ta5d6ff with open(path, Ta5d6ff"Ta5d6ffwTa5d6ff"Ta5d6ff, encoding=Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Ta5d6ff) as handle:
Ta5d6ff handle.write(Ta5d6ff"Ta5d6fftruncatedTa5d6ff"Ta5d6ff)
Ta5d6ff with open(path, encoding=Ta5d6ff"Ta5d6ffutf-8Ta5d6ff"Ta5d6ff) as handle:
Ta5d6ff data = handle.read()
Ta5d6ff if data != Ta5d6ff"Ta5d6fftruncatedTa5d6ff"Ta5d6ff:
Ta5d6ff print(Ta5d6ff"Ta5d6ffTRUNCATE_FAILEDTa5d6ff"Ta5d6ff, repr(data))
Ta5d6ff sys.exit(3)
Ta5d6ff print(Ta5d6ff"Ta5d6ffOKTa5d6ff"Ta5d6ff)
Ta5d6ff sys.exit(0)
Ta5d6ff Ta5d6ff"""Tb4b4b4,
Te6edf3storageTff7b72=Te6edf3storageTb4b4b4,
Tb4b4b4)
Te6edf3assert_probe_okTb4b4b4(Te6edf3resultTb4b4b4)
Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffskipifTb4b4b4(
Te6edf3sysTff7b72.Td2a8ffplatform Tff7b72!= Ta5d6ff"Ta5d6fflinuxTa5d6ff" Tff7b72or Tff7b72not Te6edf3llTff7b72.Td2a8fflandlock_kernel_supportedTb4b4b4(Tb4b4b4)Tb4b4b4,
Te6edf3reasonTff7b72=Ta5d6ff"Ta5d6ffLandlock apply requires a supported Linux kernelTa5d6ff"Tb4b4b4,
Tb4b4b4)
Tff7b72def Td2a8fftest_apply_landlock_allows_user_local_argospm_listTb4b4b4(Te6edf3tmp_pathTb4b4b4)Tb4b4b4:
T8b949e"""Pipx Argos under ~/.local must remain usable for translator language lists."""
Tff7b72import T7ee787shutil
Tff7b72from T7ee787testsT7ee787.T7ee787backendT7ee787.T7ee787landlock_integration_support Tff7b72import Tb4b4b4(
Te6edf3assert_probe_okTb4b4b4,
Te6edf3run_python_under_landlockTb4b4b4,
Tb4b4b4)
Tff7b72if Tff7b72not Te6edf3shutilTff7b72.Td2a8ffwhichTb4b4b4(Ta5d6ff"Ta5d6ffargospmTa5d6ff"Tb4b4b4)Tb4b4b4:
Te6edf3pytestTff7b72.Td2a8ffskipTb4b4b4(Ta5d6ff"Ta5d6ffargospm not on PATHTa5d6ff"Tb4b4b4)
Te6edf3storage Tff7b72= Te6edf3tmp_path Tff7b72/ Ta5d6ff"Ta5d6ffstorageTa5d6ff"
Te6edf3storageTff7b72.Td2a8ffmkdirTb4b4b4(Tb4b4b4)
Te6edf3result Tff7b72= Te6edf3run_python_under_landlockTb4b4b4(
T8b949e"""
import subprocess
import sys
proc = subprocess.run(
["argospm", "list"],
capture_output=True,
text=True,
timeout=30,
check=False,
)
if proc.returncode != 0:
print("ARGOSPM_FAILED", proc.stderr or proc.stdout)
sys.exit(3)
if not (proc.stdout or "").strip():
print("ARGOSPM_EMPTY")
sys.exit(4)
print("OK")
sys.exit(0)
"""Tb4b4b4,
Te6edf3storageTff7b72=Te6edf3storageTb4b4b4,
Tb4b4b4)
Te6edf3assert_probe_okTb4b4b4(Te6edf3resultTb4b4b4)
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────