summaryrefslogtreecommitdiffhomepage
path: root/test
diff options
context:
space:
mode:
Diffstat (limited to 'test')
-rw-r--r--test/perf/BUILD14
-rw-r--r--test/perf/linux/BUILD38
-rw-r--r--test/perf/linux/send_recv_benchmark.cc21
-rw-r--r--test/perf/linux/verity_open_benchmark.cc71
-rw-r--r--test/perf/linux/verity_read_benchmark.cc69
-rw-r--r--test/root/chroot_test.go10
-rw-r--r--test/runner/defs.bzl6
-rw-r--r--test/syscalls/linux/itimer.cc7
-rw-r--r--test/syscalls/linux/semaphore.cc11
-rw-r--r--test/syscalls/linux/socket_inet_loopback.cc10
-rw-r--r--test/syscalls/linux/verity_getdents.cc6
-rw-r--r--test/syscalls/linux/verity_ioctl.cc22
-rw-r--r--test/syscalls/linux/verity_mmap.cc8
-rw-r--r--test/syscalls/linux/verity_symlink.cc18
-rw-r--r--test/util/verity_util.cc13
-rw-r--r--test/util/verity_util.h1
16 files changed, 273 insertions, 52 deletions
diff --git a/test/perf/BUILD b/test/perf/BUILD
index 75b5003e2..8ac63f11b 100644
--- a/test/perf/BUILD
+++ b/test/perf/BUILD
@@ -139,3 +139,17 @@ syscall_test(
debug = False,
test = "//test/perf/linux:write_benchmark",
)
+
+syscall_test(
+ size = "large",
+ debug = False,
+ test = "//test/perf/linux:verity_open_benchmark",
+ vfs1 = False,
+)
+
+syscall_test(
+ size = "large",
+ debug = False,
+ test = "//test/perf/linux:verity_read_benchmark",
+ vfs1 = False,
+)
diff --git a/test/perf/linux/BUILD b/test/perf/linux/BUILD
index e76e359ff..50dd8e808 100644
--- a/test/perf/linux/BUILD
+++ b/test/perf/linux/BUILD
@@ -370,3 +370,41 @@ cc_binary(
"//test/util:test_main",
],
)
+
+cc_binary(
+ name = "verity_open_benchmark",
+ testonly = 1,
+ srcs = [
+ "verity_open_benchmark.cc",
+ ],
+ deps = [
+ gbenchmark,
+ gtest,
+ "//test/util:capability_util",
+ "//test/util:fs_util",
+ "//test/util:logging",
+ "//test/util:temp_path",
+ "//test/util:test_main",
+ "//test/util:test_util",
+ "//test/util:verity_util",
+ ],
+)
+
+cc_binary(
+ name = "verity_read_benchmark",
+ testonly = 1,
+ srcs = [
+ "verity_read_benchmark.cc",
+ ],
+ deps = [
+ gbenchmark,
+ gtest,
+ "//test/util:capability_util",
+ "//test/util:fs_util",
+ "//test/util:logging",
+ "//test/util:temp_path",
+ "//test/util:test_main",
+ "//test/util:test_util",
+ "//test/util:verity_util",
+ ],
+)
diff --git a/test/perf/linux/send_recv_benchmark.cc b/test/perf/linux/send_recv_benchmark.cc
index 41509e211..2d443f54f 100644
--- a/test/perf/linux/send_recv_benchmark.cc
+++ b/test/perf/linux/send_recv_benchmark.cc
@@ -80,6 +80,9 @@ void BM_Recvmsg(benchmark::State& state) {
int64_t bytes_received = 0;
for (auto ignored : state) {
int n = recvmsg(recv_socket.get(), recv_msg.header(), 0);
+ if (n == -1 && errno == EINTR) {
+ continue;
+ }
TEST_CHECK(n > 0);
bytes_received += n;
}
@@ -108,6 +111,9 @@ void BM_Sendmsg(benchmark::State& state) {
int64_t bytes_sent = 0;
for (auto ignored : state) {
int n = sendmsg(send_socket.get(), send_msg.header(), 0);
+ if (n == -1 && errno == EINTR) {
+ continue;
+ }
TEST_CHECK(n > 0);
bytes_sent += n;
}
@@ -137,6 +143,9 @@ void BM_Recvfrom(benchmark::State& state) {
for (auto ignored : state) {
int n = recvfrom(recv_socket.get(), recv_buffer, kMessageSize, 0, nullptr,
nullptr);
+ if (n == -1 && errno == EINTR) {
+ continue;
+ }
TEST_CHECK(n > 0);
bytes_received += n;
}
@@ -166,6 +175,9 @@ void BM_Sendto(benchmark::State& state) {
int64_t bytes_sent = 0;
for (auto ignored : state) {
int n = sendto(send_socket.get(), send_buffer, kMessageSize, 0, nullptr, 0);
+ if (n == -1 && errno == EINTR) {
+ continue;
+ }
TEST_CHECK(n > 0);
bytes_sent += n;
}
@@ -247,6 +259,9 @@ void BM_RecvmsgWithControlBuf(benchmark::State& state) {
int64_t bytes_received = 0;
for (auto ignored : state) {
int n = recvmsg(recv_socket.get(), recv_msg.header(), 0);
+ if (n == -1 && errno == EINTR) {
+ continue;
+ }
TEST_CHECK(n > 0);
bytes_received += n;
}
@@ -316,7 +331,11 @@ void BM_SendmsgTCP(benchmark::State& state) {
ScopedThread t([&recv_msg, &recv_socket, &notification] {
while (!notification.HasBeenNotified()) {
- TEST_CHECK(recvmsg(recv_socket.get(), recv_msg.header(), 0) >= 0);
+ int rc = recvmsg(recv_socket.get(), recv_msg.header(), 0);
+ if (rc == -1 && errno == EINTR) {
+ continue;
+ }
+ TEST_CHECK(rc >= 0);
}
});
diff --git a/test/perf/linux/verity_open_benchmark.cc b/test/perf/linux/verity_open_benchmark.cc
new file mode 100644
index 000000000..026b6f101
--- /dev/null
+++ b/test/perf/linux/verity_open_benchmark.cc
@@ -0,0 +1,71 @@
+// Copyright 2021 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <fcntl.h>
+#include <stdlib.h>
+#include <sys/mount.h>
+#include <unistd.h>
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "benchmark/benchmark.h"
+#include "test/util/capability_util.h"
+#include "test/util/fs_util.h"
+#include "test/util/logging.h"
+#include "test/util/temp_path.h"
+#include "test/util/test_util.h"
+#include "test/util/verity_util.h"
+
+namespace gvisor {
+namespace testing {
+
+namespace {
+
+void BM_Open(benchmark::State& state) {
+ const int size = state.range(0);
+ std::vector<TempPath> cache;
+ std::vector<EnableTarget> targets;
+
+ // Mount a tmpfs file system to be wrapped by a verity fs.
+ TempPath dir = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDir());
+ TEST_CHECK(mount("", dir.path().c_str(), "tmpfs", 0, "") == 0);
+
+ for (int i = 0; i < size; i++) {
+ auto path = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFileIn(dir.path()));
+ targets.emplace_back(
+ EnableTarget(std::string(Basename(path.path())), O_RDONLY));
+ cache.emplace_back(std::move(path));
+ }
+
+ std::string verity_dir =
+ TEST_CHECK_NO_ERRNO_AND_VALUE(MountVerity(dir.path(), targets));
+
+ unsigned int seed = 1;
+ for (auto _ : state) {
+ const int chosen = rand_r(&seed) % size;
+ int fd = open(JoinPath(verity_dir, targets[chosen].path).c_str(), O_RDONLY);
+ TEST_CHECK(fd != -1);
+ close(fd);
+ }
+}
+
+BENCHMARK(BM_Open)->Range(1, 128)->UseRealTime();
+
+} // namespace
+
+} // namespace testing
+} // namespace gvisor
diff --git a/test/perf/linux/verity_read_benchmark.cc b/test/perf/linux/verity_read_benchmark.cc
new file mode 100644
index 000000000..738b5ba45
--- /dev/null
+++ b/test/perf/linux/verity_read_benchmark.cc
@@ -0,0 +1,69 @@
+// Copyright 2021 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <fcntl.h>
+#include <stdlib.h>
+#include <sys/mount.h>
+#include <unistd.h>
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "gtest/gtest.h"
+#include "benchmark/benchmark.h"
+#include "test/util/capability_util.h"
+#include "test/util/fs_util.h"
+#include "test/util/logging.h"
+#include "test/util/temp_path.h"
+#include "test/util/test_util.h"
+#include "test/util/verity_util.h"
+
+namespace gvisor {
+namespace testing {
+
+namespace {
+
+void BM_VerityRead(benchmark::State& state) {
+ const int size = state.range(0);
+ const std::string contents(size, 0);
+
+ // Mount a tmpfs file system to be wrapped by a verity fs.
+ TempPath dir = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateDir());
+ TEST_CHECK(mount("", dir.path().c_str(), "tmpfs", 0, "") == 0);
+
+ auto path = ASSERT_NO_ERRNO_AND_VALUE(TempPath::CreateFileWith(
+ dir.path(), contents, TempPath::kDefaultFileMode));
+ std::string filename = std::string(Basename(path.path()));
+
+ std::string verity_dir = TEST_CHECK_NO_ERRNO_AND_VALUE(
+ MountVerity(dir.path(), {EnableTarget(filename, O_RDONLY)}));
+
+ FileDescriptor fd =
+ ASSERT_NO_ERRNO_AND_VALUE(Open(JoinPath(verity_dir, filename), O_RDONLY));
+ std::vector<char> buf(size);
+ for (auto _ : state) {
+ TEST_CHECK(PreadFd(fd.get(), buf.data(), buf.size(), 0) == size);
+ }
+
+ state.SetBytesProcessed(static_cast<int64_t>(size) *
+ static_cast<int64_t>(state.iterations()));
+}
+
+BENCHMARK(BM_VerityRead)->Range(1, 1 << 26)->UseRealTime();
+
+} // namespace
+
+} // namespace testing
+} // namespace gvisor
diff --git a/test/root/chroot_test.go b/test/root/chroot_test.go
index 58fcd6f08..5114a9602 100644
--- a/test/root/chroot_test.go
+++ b/test/root/chroot_test.go
@@ -68,13 +68,15 @@ func TestChroot(t *testing.T) {
if err != nil {
t.Fatalf("error listing %q: %v", chroot, err)
}
- if want, got := 1, len(fi); want != got {
+ if want, got := 2, len(fi); want != got {
t.Fatalf("chroot dir got %d entries, want %d", got, want)
}
- // chroot dir is prepared by runsc and should contains only /proc.
- if fi[0].Name() != "proc" {
- t.Errorf("chroot got children %v, want %v", fi[0].Name(), "proc")
+ // chroot dir is prepared by runsc and should contains only /etc and /proc.
+ for i, want := range []string{"etc", "proc"} {
+ if got := fi[i].Name(); got != want {
+ t.Errorf("chroot got child %v, want %v", got, want)
+ }
}
d.CleanUp(ctx)
diff --git a/test/runner/defs.bzl b/test/runner/defs.bzl
index 405e03832..05c75b130 100644
--- a/test/runner/defs.bzl
+++ b/test/runner/defs.bzl
@@ -135,6 +135,7 @@ def syscall_test(
add_overlay = False,
add_uds_tree = False,
add_hostinet = False,
+ vfs1 = True,
vfs2 = True,
fuse = False,
debug = True,
@@ -148,6 +149,7 @@ def syscall_test(
add_overlay: add an overlay test.
add_uds_tree: add a UDS test.
add_hostinet: add a hostinet test.
+ vfs1: enable VFS1 tests. Could be false only if vfs2 is true.
vfs2: enable VFS2 support.
fuse: enable FUSE support.
debug: enable debug output.
@@ -157,7 +159,7 @@ def syscall_test(
if not tags:
tags = []
- if vfs2 and not fuse:
+ if vfs2 and vfs1 and not fuse:
# Generate a vfs1 plain test. Most testing will now be
# biased towards vfs2, with only a single vfs1 case.
_syscall_test(
@@ -171,7 +173,7 @@ def syscall_test(
**kwargs
)
- if not fuse:
+ if vfs1 and not fuse:
# Generate a native test if fuse is not required.
_syscall_test(
test = test,
diff --git a/test/syscalls/linux/itimer.cc b/test/syscalls/linux/itimer.cc
index ac113e6da..9fb04eae6 100644
--- a/test/syscalls/linux/itimer.cc
+++ b/test/syscalls/linux/itimer.cc
@@ -197,9 +197,9 @@ int TestSIGALRMToMainThread() {
// (but don't guarantee it), so we expect to see most samples on the main
// thread.
//
- // The number of SIGALRMs delivered to a worker should not exceed 20%
+ // The number of SIGALRMs delivered to a worker should not exceed 40%
// of the number of total signals expected (this is somewhat arbitrary).
- const int worker_threshold = result.expected_total / 5;
+ const int worker_threshold = result.expected_total / 5 * 2;
//
// Linux only guarantees timers will never expire before the requested time.
@@ -230,7 +230,8 @@ TEST(ItimerTest, DeliversSIGALRMToMainThread) {
// Not required anymore.
kill.Release();
- EXPECT_TRUE(WIFEXITED(status) && WEXITSTATUS(status) == 0) << status;
+ EXPECT_EQ(WIFEXITED(status) && WEXITSTATUS(status), 0)
+ << WIFEXITED(status) << " " << WEXITSTATUS(status);
}
// Signals are delivered to threads fairly.
diff --git a/test/syscalls/linux/semaphore.cc b/test/syscalls/linux/semaphore.cc
index f72957f89..87b66aa98 100644
--- a/test/syscalls/linux/semaphore.cc
+++ b/test/syscalls/linux/semaphore.cc
@@ -1019,6 +1019,17 @@ TEST(SemaphoreTest, SemInfo) {
EXPECT_EQ(info.semvmx, kSemVmx);
}
+TEST(SempahoreTest, RemoveNonExistentSemaphore) {
+ EXPECT_THAT(semctl(-1, 0, IPC_RMID), SyscallFailsWithErrno(EINVAL));
+}
+
+TEST(SempahoreTest, RemoveDeletedSemaphore) {
+ int id;
+ EXPECT_THAT(id = semget(IPC_PRIVATE, 1, 0), SyscallSucceeds());
+ EXPECT_THAT(semctl(id, 0, IPC_RMID), SyscallSucceeds());
+ EXPECT_THAT(semctl(id, 0, IPC_RMID), SyscallFailsWithErrno(EINVAL));
+}
+
} // namespace
} // namespace testing
} // namespace gvisor
diff --git a/test/syscalls/linux/socket_inet_loopback.cc b/test/syscalls/linux/socket_inet_loopback.cc
index 5f0b40ecf..13a83a1b3 100644
--- a/test/syscalls/linux/socket_inet_loopback.cc
+++ b/test/syscalls/linux/socket_inet_loopback.cc
@@ -308,7 +308,7 @@ TEST_P(SocketInetLoopbackTest, TCPListenShutdownListen) {
sockaddr_storage conn_addr = connector.addr;
ASSERT_NO_ERRNO(SetAddrPort(connector.family(), &conn_addr, port));
- // TODO(b/157236388): Remove Disable save after bug is fixed. S/R test can
+ // TODO(b/153489135): Remove Disable save after bug is fixed. S/R test can
// fail because the last socket may not be delivered to the accept queue
// by the time connect returns.
DisableSave ds;
@@ -751,7 +751,7 @@ TEST_P(SocketInetLoopbackTest, TCPNonBlockingConnectClose) {
}
}
-// TODO(b/157236388): Remove once bug is fixed. Test fails w/
+// TODO(b/153489135): Remove once bug is fixed. Test fails w/
// random save as established connections which can't be delivered to the accept
// queue because the queue is full are not correctly delivered after restore
// causing the last accept to timeout on the restore.
@@ -801,7 +801,7 @@ TEST_P(SocketInetLoopbackTest, TCPAcceptBacklogSizes) {
}
}
-// TODO(b/157236388): Remove once bug is fixed. Test fails w/
+// TODO(b/153489135): Remove once bug is fixed. Test fails w/
// random save as established connections which can't be delivered to the accept
// queue because the queue is full are not correctly delivered after restore
// causing the last accept to timeout on the restore.
@@ -892,7 +892,7 @@ TEST_P(SocketInetLoopbackTest, TCPBacklog) {
ASSERT_GE(client_conns, accepted_conns);
}
-// TODO(b/157236388): Remove once bug is fixed. Test fails w/
+// TODO(b/153489135): Remove once bug is fixed. Test fails w/
// random save as established connections which can't be delivered to the accept
// queue because the queue is full are not correctly delivered after restore
// causing the last accept to timeout on the restore.
@@ -1136,7 +1136,7 @@ TEST_P(SocketInetLoopbackTest, TCPAcceptAfterReset) {
sockaddr_storage conn_addr = connector.addr;
ASSERT_NO_ERRNO(SetAddrPort(connector.family(), &conn_addr, port));
- // TODO(b/157236388): Reenable Cooperative S/R once bug is fixed.
+ // TODO(b/153489135): Reenable Cooperative S/R once bug is fixed.
DisableSave ds;
ASSERT_THAT(RetryEINTR(connect)(conn_fd.get(), AsSockAddr(&conn_addr),
connector.addr_len),
diff --git a/test/syscalls/linux/verity_getdents.cc b/test/syscalls/linux/verity_getdents.cc
index 2eafc3dd3..822a75254 100644
--- a/test/syscalls/linux/verity_getdents.cc
+++ b/test/syscalls/linux/verity_getdents.cc
@@ -59,7 +59,7 @@ class GetDentsTest : public ::testing::Test {
TEST_F(GetDentsTest, GetDents) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
std::vector<std::string> expect = {".", "..", filename_};
EXPECT_NO_ERRNO(DirContains(verity_dir, expect, /*exclude=*/{}));
@@ -67,7 +67,7 @@ TEST_F(GetDentsTest, GetDents) {
TEST_F(GetDentsTest, Deleted) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
EXPECT_THAT(unlink(JoinPath(tmpfs_dir_.path(), filename_).c_str()),
SyscallSucceeds());
@@ -78,7 +78,7 @@ TEST_F(GetDentsTest, Deleted) {
TEST_F(GetDentsTest, Renamed) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
std::string new_file_name = "renamed-" + filename_;
EXPECT_THAT(rename(JoinPath(tmpfs_dir_.path(), filename_).c_str(),
diff --git a/test/syscalls/linux/verity_ioctl.cc b/test/syscalls/linux/verity_ioctl.cc
index e7e4fa64b..45650809c 100644
--- a/test/syscalls/linux/verity_ioctl.cc
+++ b/test/syscalls/linux/verity_ioctl.cc
@@ -106,7 +106,7 @@ TEST_F(IoctlTest, Measure) {
TEST_F(IoctlTest, Mount) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
// Make sure the file can be open and read in the mounted verity fs.
auto const verity_fd = ASSERT_NO_ERRNO_AND_VALUE(
@@ -118,7 +118,7 @@ TEST_F(IoctlTest, Mount) {
TEST_F(IoctlTest, NonExistingFile) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
// Confirm that opening a non-existing file in the verity-enabled directory
// triggers the expected error instead of verification failure.
@@ -129,7 +129,7 @@ TEST_F(IoctlTest, NonExistingFile) {
TEST_F(IoctlTest, ModifiedFile) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
// Modify the file and check verification failure upon reading from it.
auto const fd = ASSERT_NO_ERRNO_AND_VALUE(
@@ -144,7 +144,7 @@ TEST_F(IoctlTest, ModifiedFile) {
TEST_F(IoctlTest, ModifiedMerkle) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
// Modify the Merkle file and check verification failure upon opening the
// corresponding file.
@@ -159,7 +159,7 @@ TEST_F(IoctlTest, ModifiedMerkle) {
TEST_F(IoctlTest, ModifiedDirMerkle) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
// Modify the Merkle file for the parent directory and check verification
// failure upon opening the corresponding file.
@@ -174,7 +174,7 @@ TEST_F(IoctlTest, ModifiedDirMerkle) {
TEST_F(IoctlTest, Stat) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
struct stat st;
EXPECT_THAT(stat(JoinPath(verity_dir, filename_).c_str(), &st),
@@ -183,7 +183,7 @@ TEST_F(IoctlTest, Stat) {
TEST_F(IoctlTest, ModifiedStat) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
EXPECT_THAT(chmod(JoinPath(tmpfs_dir_.path(), filename_).c_str(), 0644),
SyscallSucceeds());
@@ -194,7 +194,7 @@ TEST_F(IoctlTest, ModifiedStat) {
TEST_F(IoctlTest, DeleteFile) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
EXPECT_THAT(unlink(JoinPath(tmpfs_dir_.path(), filename_).c_str()),
SyscallSucceeds());
@@ -204,7 +204,7 @@ TEST_F(IoctlTest, DeleteFile) {
TEST_F(IoctlTest, DeleteMerkle) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
EXPECT_THAT(
unlink(MerklePath(JoinPath(tmpfs_dir_.path(), filename_)).c_str()),
@@ -215,7 +215,7 @@ TEST_F(IoctlTest, DeleteMerkle) {
TEST_F(IoctlTest, RenameFile) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
std::string new_file_name = "renamed-" + filename_;
EXPECT_THAT(rename(JoinPath(tmpfs_dir_.path(), filename_).c_str(),
@@ -227,7 +227,7 @@ TEST_F(IoctlTest, RenameFile) {
TEST_F(IoctlTest, RenameMerkle) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
std::string new_file_name = "renamed-" + filename_;
EXPECT_THAT(
diff --git a/test/syscalls/linux/verity_mmap.cc b/test/syscalls/linux/verity_mmap.cc
index 09ced6eb3..2bfd43b16 100644
--- a/test/syscalls/linux/verity_mmap.cc
+++ b/test/syscalls/linux/verity_mmap.cc
@@ -58,7 +58,7 @@ class MmapTest : public ::testing::Test {
TEST_F(MmapTest, MmapRead) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
// Make sure the file can be open and mmapped in the mounted verity fs.
auto const verity_fd = ASSERT_NO_ERRNO_AND_VALUE(
@@ -72,7 +72,7 @@ TEST_F(MmapTest, MmapRead) {
TEST_F(MmapTest, ModifiedBeforeMmap) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
// Modify the file and check verification failure upon mmapping.
auto const fd = ASSERT_NO_ERRNO_AND_VALUE(
@@ -91,7 +91,7 @@ TEST_F(MmapTest, ModifiedBeforeMmap) {
TEST_F(MmapTest, ModifiedAfterMmap) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
auto const verity_fd = ASSERT_NO_ERRNO_AND_VALUE(
Open(JoinPath(verity_dir, filename_), O_RDONLY, 0777));
@@ -127,7 +127,7 @@ INSTANTIATE_TEST_SUITE_P(
TEST_P(MmapParamTest, Mmap) {
std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_, /*targets=*/{}));
+ MountVerity(tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY)}));
// Make sure the file can be open and mmapped in the mounted verity fs.
auto const verity_fd = ASSERT_NO_ERRNO_AND_VALUE(
diff --git a/test/syscalls/linux/verity_symlink.cc b/test/syscalls/linux/verity_symlink.cc
index bbf5375cb..c6fce8ead 100644
--- a/test/syscalls/linux/verity_symlink.cc
+++ b/test/syscalls/linux/verity_symlink.cc
@@ -62,9 +62,9 @@ class SymlinkTest : public ::testing::Test {
};
TEST_F(SymlinkTest, Success) {
- std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_,
- {EnableTarget(kSymlink, O_RDONLY | O_NOFOLLOW)}));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(MountVerity(
+ tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY),
+ EnableTarget(kSymlink, O_RDONLY | O_NOFOLLOW)}));
char buf[256];
EXPECT_THAT(
@@ -77,9 +77,9 @@ TEST_F(SymlinkTest, Success) {
}
TEST_F(SymlinkTest, DeleteLink) {
- std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_,
- {EnableTarget(kSymlink, O_RDONLY | O_NOFOLLOW)}));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(MountVerity(
+ tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY),
+ EnableTarget(kSymlink, O_RDONLY | O_NOFOLLOW)}));
ASSERT_THAT(unlink(JoinPath(tmpfs_dir_.path(), kSymlink).c_str()),
SyscallSucceeds());
@@ -92,9 +92,9 @@ TEST_F(SymlinkTest, DeleteLink) {
}
TEST_F(SymlinkTest, ModifyLink) {
- std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(
- MountVerity(tmpfs_dir_.path(), filename_,
- {EnableTarget(kSymlink, O_RDONLY | O_NOFOLLOW)}));
+ std::string verity_dir = ASSERT_NO_ERRNO_AND_VALUE(MountVerity(
+ tmpfs_dir_.path(), {EnableTarget(filename_, O_RDONLY),
+ EnableTarget(kSymlink, O_RDONLY | O_NOFOLLOW)}));
ASSERT_THAT(unlink(JoinPath(tmpfs_dir_.path(), kSymlink).c_str()),
SyscallSucceeds());
diff --git a/test/util/verity_util.cc b/test/util/verity_util.cc
index 501d7c2cf..b7d1cb212 100644
--- a/test/util/verity_util.cc
+++ b/test/util/verity_util.cc
@@ -54,20 +54,14 @@ PosixError FlipRandomBit(int fd, int size) {
return NoError();
}
-PosixErrorOr<std::string> MountVerity(std::string tmpfs_dir,
- std::string filename,
+PosixErrorOr<std::string> MountVerity(std::string lower_dir,
std::vector<EnableTarget> targets) {
- // Mount a verity fs on the existing tmpfs mount.
- std::string mount_opts = "lower_path=" + tmpfs_dir;
+ // Mount a verity fs on the existing mount.
+ std::string mount_opts = "lower_path=" + lower_dir;
ASSIGN_OR_RETURN_ERRNO(TempPath verity_dir, TempPath::CreateDir());
RETURN_ERROR_IF_SYSCALL_FAIL(
mount("", verity_dir.path().c_str(), "verity", 0, mount_opts.c_str()));
- // Enable the file, symlink(if provided) and the directory.
- ASSIGN_OR_RETURN_ERRNO(
- auto fd, Open(JoinPath(verity_dir.path(), filename), O_RDONLY, 0777));
- RETURN_ERROR_IF_SYSCALL_FAIL(ioctl(fd.get(), FS_IOC_ENABLE_VERITY));
-
for (const EnableTarget& target : targets) {
ASSIGN_OR_RETURN_ERRNO(
auto target_fd,
@@ -92,6 +86,7 @@ PosixErrorOr<std::string> MountVerity(std::string tmpfs_dir,
ASSIGN_OR_RETURN_ERRNO(TempPath verity_with_hash_dir, TempPath::CreateDir());
RETURN_ERROR_IF_SYSCALL_FAIL(mount("", verity_with_hash_dir.path().c_str(),
"verity", 0, mount_opts.c_str()));
+
// Verity directories should not be deleted. Release the TempPath objects to
// prevent those directories from being deleted by the destructor.
verity_dir.release();
diff --git a/test/util/verity_util.h b/test/util/verity_util.h
index 44863f322..ebb78b4bb 100644
--- a/test/util/verity_util.h
+++ b/test/util/verity_util.h
@@ -76,7 +76,6 @@ PosixError FlipRandomBit(int fd, int size);
// Mount a verity on the tmpfs and enable both the file and the direcotry. Then
// mount a new verity with measured root hash.
PosixErrorOr<std::string> MountVerity(std::string tmpfs_dir,
- std::string filename,
std::vector<EnableTarget> targets);
} // namespace testing
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-20 05:17:55 +0000