Node / ReticulumProjects / MeshChatX.git / files / tests / backend / test_seccomp_sandbox.py

Displaying Raw • Download

T8b949e# SPDX-License-Identifier: 0BSD

T8b949e"""Tests for optional seccomp-BPF sandbox."""

Tff7b72import T7ee787sys

Tff7b72from T7ee787unittestT7ee787.T7ee787mock Tff7b72import Te6edf3MagicMockTb4b4b4, Te6edf3patch

Tff7b72import T7ee787pytest

Tff7b72from T7ee787meshchatxT7ee787.T7ee787srcT7ee787.T7ee787backend Tff7b72import Te6edf3seccomp_sandbox Tff7b72as Te6edf3sc

Tf0883e@pytestTff7b72.Td2a8fffixtureTb4b4b4(Te6edf3autouseTff7b72=Tff7b72TrueTb4b4b4)

Tff7b72def Td2a8ff_reset_seccomp_cachesTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3scTff7b72.Td2a8ff_seccomp_support_cached Tff7b72= Tff7b72None

Te6edf3scTff7b72.Td2a8ff_seccomp_lib_cached Tff7b72= Tff7b72None

Te6edf3scTff7b72.Td2a8ff_seccomp_lib_failed Tff7b72= Tff7b72False

Tff7b72yield

Te6edf3scTff7b72.Td2a8ff_seccomp_support_cached Tff7b72= Tff7b72None

Te6edf3scTff7b72.Td2a8ff_seccomp_lib_cached Tff7b72= Tff7b72None

Te6edf3scTff7b72.Td2a8ff_seccomp_lib_failed Tff7b72= Tff7b72False

Tff7b72def Td2a8fftest_seccomp_requested_non_linuxTb4b4b4(Tb4b4b4)Tb4b4b4:

Tff7b72with Tb4b4b4(

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTff7b72.Td2a8ffsysTb4b4b4, Ta5d6ff"Ta5d6ffplatformTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ffdarwinTa5d6ff"Tb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ff_is_androidTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72FalseTb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3scTff7b72.Td2a8ffseccomp_requestedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False

Tff7b72def Td2a8fftest_seccomp_requested_respects_disable_envTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:

Te6edf3monkeypatchTff7b72.Td2a8ffsetenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_SECCOMPTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff0Ta5d6ff"Tb4b4b4)

Tff7b72with Tb4b4b4(

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTff7b72.Td2a8ffsysTb4b4b4, Ta5d6ff"Ta5d6ffplatformTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ff_is_androidTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72FalseTb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3scTff7b72.Td2a8ffseccomp_requestedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False

Tff7b72assert Te6edf3scTff7b72.Td2a8ffseccomp_disabled_by_envTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72True

Tff7b72def Td2a8fftest_seccomp_requested_force_enable_envTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:

Te6edf3monkeypatchTff7b72.Td2a8ffsetenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_SECCOMPTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff1Ta5d6ff"Tb4b4b4)

Tff7b72with Tb4b4b4(

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTff7b72.Td2a8ffsysTb4b4b4, Ta5d6ff"Ta5d6ffplatformTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ff_is_androidTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72FalseTb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3scTff7b72.Td2a8ffseccomp_requestedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72True

Tff7b72assert Te6edf3scTff7b72.Td2a8ffseccomp_auto_enabledTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False

Tff7b72def Td2a8fftest_seccomp_auto_when_supportedTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:

Te6edf3monkeypatchTff7b72.Td2a8ffdelenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_SECCOMPTa5d6ff"Tb4b4b4, Te6edf3raisingTff7b72=Tff7b72FalseTb4b4b4)

Tff7b72with Tb4b4b4(

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTff7b72.Td2a8ffsysTb4b4b4, Ta5d6ff"Ta5d6ffplatformTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ff_is_androidTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72FalseTb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ffseccomp_kernel_supportedTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72TrueTb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3scTff7b72.Td2a8ffseccomp_requestedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72True

Tff7b72assert Te6edf3scTff7b72.Td2a8ffseccomp_auto_enabledTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72True

Tff7b72def Td2a8fftest_seccomp_auto_off_when_unsupportedTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:

Te6edf3monkeypatchTff7b72.Td2a8ffdelenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_SECCOMPTa5d6ff"Tb4b4b4, Te6edf3raisingTff7b72=Tff7b72FalseTb4b4b4)

Tff7b72with Tb4b4b4(

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTff7b72.Td2a8ffsysTb4b4b4, Ta5d6ff"Ta5d6ffplatformTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ff_is_androidTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72FalseTb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ffseccomp_kernel_supportedTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72FalseTb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3scTff7b72.Td2a8ffseccomp_requestedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False

Tff7b72def Td2a8fftest_seccomp_kernel_supported_false_on_androidTb4b4b4(Tb4b4b4)Tb4b4b4:

Tff7b72with Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ff_is_androidTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72TrueTb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3scTff7b72.Td2a8ffseccomp_kernel_supportedTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False

Tff7b72def Td2a8fftest_apply_seccomp_falls_back_when_not_requestedTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:

Te6edf3monkeypatchTff7b72.Td2a8ffsetenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_SECCOMPTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff0Ta5d6ff"Tb4b4b4)

Tff7b72assert Te6edf3scTff7b72.Td2a8ffapply_seccomp_sandboxTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False

Tff7b72def Td2a8fftest_apply_seccomp_falls_back_without_libseccompTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:

Te6edf3monkeypatchTff7b72.Td2a8ffsetenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_SECCOMPTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff1Ta5d6ff"Tb4b4b4)

Tff7b72with Tb4b4b4(

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTff7b72.Td2a8ffsysTb4b4b4, Ta5d6ff"Ta5d6ffplatformTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ff_is_androidTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72FalseTb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ff_load_libseccompTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72NoneTb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3scTff7b72.Td2a8ffapply_seccomp_sandboxTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72False

Tff7b72def Td2a8fftest_apply_seccomp_loads_denylistTb4b4b4(Te6edf3monkeypatchTb4b4b4)Tb4b4b4:

Te6edf3monkeypatchTff7b72.Td2a8ffsetenvTb4b4b4(Ta5d6ff"Ta5d6ffMESHCHAT_SECCOMPTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6ff1Ta5d6ff"Tb4b4b4)

Te6edf3lib Tff7b72= Te6edf3MagicMockTb4b4b4(Tb4b4b4)

Te6edf3ctx Tff7b72= Tffa657objectTb4b4b4(Tb4b4b4)

Te6edf3libTff7b72.Td2a8ffseccomp_initTff7b72.Td2a8ffreturn_value Tff7b72= Te6edf3ctx

Te6edf3libTff7b72.Td2a8ffseccomp_syscall_resolve_nameTff7b72.Td2a8ffside_effect Tff7b72= Tff7b72lambda Te6edf3nameTb4b4b4: Tb4b4b4{

Ta5d6ffbTa5d6ff"Ta5d6ffmountTa5d6ff"Tb4b4b4: T79c0ff165Tb4b4b4,

Ta5d6ffbTa5d6ff"Ta5d6ffptraceTa5d6ff"Tb4b4b4: T79c0ff101Tb4b4b4,

Ta5d6ffbTa5d6ff"Ta5d6ffbpfTa5d6ff"Tb4b4b4: T79c0ff321Tb4b4b4,

Tb4b4b4}Tff7b72.Td2a8ffgetTb4b4b4(Te6edf3nameTb4b4b4, Tff7b72-T79c0ff1Tb4b4b4)

Te6edf3libTff7b72.Td2a8ffseccomp_rule_addTff7b72.Td2a8ffreturn_value Tff7b72= T79c0ff0

Te6edf3libTff7b72.Td2a8ffseccomp_loadTff7b72.Td2a8ffreturn_value Tff7b72= T79c0ff0

Tff7b72with Tb4b4b4(

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTff7b72.Td2a8ffsysTb4b4b4, Ta5d6ff"Ta5d6ffplatformTa5d6ff"Tb4b4b4, Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ff_is_androidTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Tff7b72FalseTb4b4b4)Tb4b4b4,

Te6edf3patchTff7b72.Td2a8ffobjectTb4b4b4(Te6edf3scTb4b4b4, Ta5d6ff"Ta5d6ff_load_libseccompTa5d6ff"Tb4b4b4, Te6edf3return_valueTff7b72=Te6edf3libTb4b4b4)Tb4b4b4,

Tb4b4b4)Tb4b4b4:

Tff7b72assert Te6edf3scTff7b72.Td2a8ffapply_seccomp_sandboxTb4b4b4(Tb4b4b4) Tff7b72is Tff7b72True

Te6edf3libTff7b72.Td2a8ffseccomp_initTff7b72.Td2a8ffassert_called_once_withTb4b4b4(Te6edf3scTff7b72.Td2a8ff_SCMP_ACT_ALLOWTb4b4b4)

Tff7b72assert Te6edf3libTff7b72.Td2a8ffseccomp_rule_addTff7b72.Td2a8ffcall_count Tff7b72>Tff7b72= T79c0ff3

Te6edf3libTff7b72.Td2a8ffseccomp_loadTff7b72.Td2a8ffassert_called_once_withTb4b4b4(Te6edf3ctxTb4b4b4)

Te6edf3libTff7b72.Td2a8ffseccomp_releaseTff7b72.Td2a8ffassert_called_once_withTb4b4b4(Te6edf3ctxTb4b4b4)

Tf0883e@pytestTff7b72.Td2a8ffmarkTff7b72.Td2a8ffskipifTb4b4b4(Te6edf3sysTff7b72.Td2a8ffplatform Tff7b72!= Ta5d6ff"Ta5d6fflinuxTa5d6ff"Tb4b4b4, Te6edf3reasonTff7b72=Ta5d6ff"Ta5d6ffseccomp probe requires LinuxTa5d6ff"Tb4b4b4)

Tff7b72def Td2a8fftest_seccomp_kernel_supported_on_linuxTb4b4b4(Tb4b4b4)Tb4b4b4:

Te6edf3supported Tff7b72= Te6edf3scTff7b72.Td2a8ffseccomp_kernel_supportedTb4b4b4(Tb4b4b4)

Tff7b72assert Tffa657isinstanceTb4b4b4(Te6edf3supportedTb4b4b4, Tffa657boolTb4b4b4)