reiabreu opened a new pull request, #9014:
URL: https://github.com/apache/storm/pull/9014

   Follow-up to #9008 and #9010, adding the test coverage noted on those PRs.
   
   The OCI enforcement points these tests cover live in `main.c`, which isn't 
linked into the test binary, so they weren't exercised. This extracts the 
launch-command username match into `oci_launch_cmd_matches_user` (in 
`oci_launch_cmd.c`, which the test binary does link) and adds two tests:
   
   - `test_oci_launch_cmd_matches_user` — the username match (match, mismatch, 
missing username, null command).
   - `test_oci_parse_launch_cmd_mounts` — parses a launch command that is valid 
except for its bind-mount source and asserts `parse_oci_launch_cmd` rejects a 
source outside the configured directories while accepting one under them. 
Earlier tests reached only `is_valid_mount_source`; this exercises the 
`is_valid_mount` enforcement through the real parse path (confirmed it fails if 
the mount check is removed).
   
   Not covered: the `setup_permissions` fd/dev-ino branch, whose privileged 
walk runs under `seteuid(0)` and needs root, which CI's `make check` does not 
run as.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to