Denozordec
57b7652d4d
quality / changes (push) Successful in 6s
quality / commitlint (push) Skipped
quality / openapi (push) Successful in 28s
quality / web (push) Successful in 57s
quality / api (push) Successful in 1m35s
quality / linux-agent-smoke (push) Successful in 24s
quality / docker-check (push) Failing after 3m20s
CD / quality (push) Failing after 6m56s
CD / publish (push) Skipped
47 lines
2.3 KiB
Bash
47 lines
2.3 KiB
Bash
#!/usr/bin/env sh
|
|
# Exercise the wrapper without a Docker daemon or any firewall operation.
|
|
set -eu
|
|
wrapper="$(pwd)/scripts/ci/linux-agent-container-smoke.sh"
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
|
|
mkdir "$tmp/bin"
|
|
cat >"$tmp/bin/docker" <<'DOCKER'
|
|
#!/usr/bin/env sh
|
|
set -eu
|
|
printf '%s\n' "$*" >>"$FAKE_LOG"
|
|
case "$1" in
|
|
info)
|
|
case "$*" in
|
|
*SecurityOptions*) if [ "$FAKE_APPARMOR" = true ]; then printf '["name=apparmor","name=seccomp,profile=default"]\n'; else printf '["name=seccomp,profile=default"]\n'; fi ;;
|
|
*) printf 'linux\n' ;;
|
|
esac ;;
|
|
build)
|
|
while [ "$#" -gt 0 ]; do
|
|
if [ "$1" = --iidfile ]; then shift; printf 'sha256:%064d\n' 0 >"$1"; break; fi
|
|
shift
|
|
done ;;
|
|
run) exit "$FAKE_RUN_EXIT" ;;
|
|
rm|image) exit 0 ;;
|
|
*) exit 98 ;;
|
|
esac
|
|
DOCKER
|
|
chmod +x "$tmp/bin/docker"
|
|
for expected in 0 23; do
|
|
log="$tmp/docker-$expected.log"
|
|
apparmor=false; [ "$expected" = 0 ] || apparmor=true
|
|
if PATH="$tmp/bin:$PATH" FAKE_LOG="$log" FAKE_APPARMOR="$apparmor" FAKE_RUN_EXIT="$expected" sh "$wrapper"; then actual=0; else actual=$?; fi
|
|
[ "$actual" = "$expected" ] || { echo 'Wrapper did not preserve the container exit code' >&2; exit 1; }
|
|
grep -F 'build --file scripts/ci/linux-agent-smoke.Dockerfile --iidfile ' "$log" >/dev/null
|
|
grep -F ' --network none --cap-drop ALL --cap-add SYS_ADMIN --cap-add NET_ADMIN --cap-add NET_RAW ' "$log" >/dev/null
|
|
capabilities="$(grep '^run ' "$log" | awk '{ for (i=1; i<=NF; i++) if ($i == "--cap-add") print $(i+1) }' | sort | tr '\n' ' ')"
|
|
[ "$capabilities" = 'NET_ADMIN NET_RAW SYS_ADMIN ' ] || { echo 'Unexpected helper capability set' >&2; exit 1; }
|
|
grep -F ' --security-opt no-new-privileges:true --read-only --tmpfs /tmp:' "$log" >/dev/null
|
|
grep -F 'image rm sha256:' "$log" >/dev/null
|
|
grep -E '^rm -f evofw-linux-smoke-' "$log" >/dev/null
|
|
if grep -E -- '(--privileged|--network host|--pid host|--mount|--volume|docker.sock|seccomp=)' "$log" >/dev/null; then echo 'Unsafe helper isolation flags' >&2; exit 1; fi
|
|
if [ "$apparmor" = true ]; then grep -F ' --security-opt apparmor=unconfined ' "$log" >/dev/null
|
|
elif grep -F 'apparmor=unconfined' "$log" >/dev/null; then echo 'Unneeded AppArmor exception' >&2; exit 1
|
|
fi
|
|
done
|
|
echo 'Helper wrapper regression passed (flags, remote context, exit status, cleanup)'
|