|
| 1 | +load helpers |
| 2 | + |
| 3 | +function setup() { |
| 4 | + stacker_setup |
| 5 | +} |
| 6 | + |
| 7 | +function teardown() { |
| 8 | + cleanup |
| 9 | +} |
| 10 | + |
| 11 | +function verity_checkusedloops() { |
| 12 | + # search for loopdevices which have backing files with the current |
| 13 | + # BATS_TEST_DIRNAME value and complain if they're present. |
| 14 | + local usedloops="" found="" x="" |
| 15 | + for ((x=0; x<5; x++)); do |
| 16 | + usedloops=$(losetup -a | grep $BATS_TEST_DIRNAME || echo) |
| 17 | + if [ -n "$usedloops" ]; then |
| 18 | + found=1 |
| 19 | + udevadm settle |
| 20 | + else |
| 21 | + return 0 |
| 22 | + fi |
| 23 | + done |
| 24 | + echo "found used loops in testdir=$BATS_TEST_DIRNAME :$usedloops" >&3 |
| 25 | + [ $found = 1 ] |
| 26 | +} |
| 27 | + |
| 28 | +function basic_test() { |
| 29 | + require_privilege priv |
| 30 | + local verity_arg=$1 |
| 31 | + |
| 32 | + cat > stacker.yaml <<"EOF" |
| 33 | +test: |
| 34 | + from: |
| 35 | + type: oci |
| 36 | + url: ${{BUSYBOX_OCI}} |
| 37 | + run: | |
| 38 | + touch /hello |
| 39 | +EOF |
| 40 | + stacker build --layer-type=erofs $verity_arg --substitute BUSYBOX_OCI=${BUSYBOX_OCI} |
| 41 | + mkdir mountpoint |
| 42 | + stacker internal-go atomfs mount test-erofs mountpoint |
| 43 | + |
| 44 | + [ -f mountpoint/hello ] |
| 45 | + stacker internal-go atomfs umount mountpoint |
| 46 | +} |
| 47 | + |
| 48 | +@test "--no-verity works" { |
| 49 | + basic_test --no-verity |
| 50 | + verity_checkusedloops |
| 51 | +} |
| 52 | + |
| 53 | +@test "mount + umount works" { |
| 54 | + basic_test |
| 55 | + |
| 56 | + # last layer shouldn't exist any more, since it is unique |
| 57 | + manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:) |
| 58 | + last_layer_num=$(($(cat oci/blobs/sha256/$manifest | jq -r '.layers | length')-1)) |
| 59 | + last_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[$last_layer].digest | cut -f2 -d:) |
| 60 | + [ ! -b "/dev/mapper/$last_layer_hash-verity" ] |
| 61 | + verity_checkusedloops |
| 62 | +} |
| 63 | + |
| 64 | +@test "mount + umount + mount a tree of images works" { |
| 65 | + require_privilege priv |
| 66 | + cat > stacker.yaml <<"EOF" |
| 67 | +base: |
| 68 | + from: |
| 69 | + type: oci |
| 70 | + url: ${{BUSYBOX_OCI}} |
| 71 | + run: touch /base |
| 72 | +a: |
| 73 | + from: |
| 74 | + type: built |
| 75 | + tag: base |
| 76 | + run: touch /a |
| 77 | +b: |
| 78 | + from: |
| 79 | + type: built |
| 80 | + tag: base |
| 81 | + run: touch /b |
| 82 | +c: |
| 83 | + from: |
| 84 | + type: built |
| 85 | + tag: base |
| 86 | + run: touch /c |
| 87 | +EOF |
| 88 | + stacker build --layer-type=erofs --substitute BUSYBOX_OCI=${BUSYBOX_OCI} |
| 89 | + |
| 90 | + mkdir a |
| 91 | + stacker internal-go atomfs mount a-erofs a |
| 92 | + [ -f a/a ] |
| 93 | + |
| 94 | + mkdir b |
| 95 | + stacker internal-go atomfs mount b-erofs b |
| 96 | + [ -f b/b ] |
| 97 | + |
| 98 | + cat /proc/self/mountinfo |
| 99 | + echo "mountinfo after b^" |
| 100 | + |
| 101 | + stacker internal-go atomfs umount b |
| 102 | + |
| 103 | + # first layer should still exist since a is still mounted |
| 104 | + manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:) |
| 105 | + first_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[0].digest | cut -f2 -d:) |
| 106 | + [ ! -b "/dev/mapper/$last_layer_hash-verity" ] |
| 107 | + |
| 108 | + mkdir c |
| 109 | + stacker internal-go atomfs mount c-erofs c |
| 110 | + [ -f c/c ] |
| 111 | + |
| 112 | + cat /proc/self/mountinfo |
| 113 | + echo "mountinfo after c^" |
| 114 | + |
| 115 | + stacker internal-go atomfs umount a |
| 116 | + |
| 117 | + cat /proc/self/mountinfo |
| 118 | + echo "mountinfo after umount a^" |
| 119 | + |
| 120 | + # first layer should still exist since c is still mounted |
| 121 | + manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:) |
| 122 | + first_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[0].digest | cut -f2 -d:) |
| 123 | + [ ! -b "/dev/mapper/$last_layer_hash-verity" ] |
| 124 | + |
| 125 | + # c should still be ok |
| 126 | + [ -f c/c ] |
| 127 | + [ -f c/bin/sh ] |
| 128 | + stacker internal-go atomfs umount c |
| 129 | + |
| 130 | + # c's last layer shouldn't exist any more, since it is unique |
| 131 | + manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:) |
| 132 | + last_layer_num=$(($(cat oci/blobs/sha256/$manifest | jq -r '.layers | length')-1)) |
| 133 | + last_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[$last_layer].digest | cut -f2 -d:) |
| 134 | + [ ! -b "/dev/mapper/$last_layer_hash-verity" ] |
| 135 | + verity_checkusedloops |
| 136 | +} |
| 137 | + |
| 138 | +@test "bad existing verity device is rejected" { |
| 139 | + require_privilege priv |
| 140 | + cat > stacker.yaml <<"EOF" |
| 141 | +test: |
| 142 | + from: |
| 143 | + type: oci |
| 144 | + url: ${{BUSYBOX_OCI}} |
| 145 | + run: | |
| 146 | + touch /hello |
| 147 | +EOF |
| 148 | + stacker build --layer-type=erofs --substitute BUSYBOX_OCI=${BUSYBOX_OCI} |
| 149 | + |
| 150 | + manifest=$(cat oci/index.json | jq -r .manifests[0].digest | cut -f2 -d:) |
| 151 | + first_layer_hash=$(cat oci/blobs/sha256/$manifest | jq -r .layers[0].digest | cut -f2 -d:) |
| 152 | + devname="$first_layer_hash-verity" |
| 153 | + |
| 154 | + # make an evil device and fake it as an existing verity device |
| 155 | + dd if=/dev/random of=mydev bs=50K count=1 |
| 156 | + root_hash=$(veritysetup format mydev mydev.hash | grep "Root hash:" | awk '{print $NF}') |
| 157 | + echo "root hash $root_hash" |
| 158 | + veritysetup open mydev "$devname" mydev.hash "$root_hash" |
| 159 | + |
| 160 | + mkdir mountpoint |
| 161 | + bad_stacker internal-go atomfs mount test-erofs mountpoint | grep "invalid root hash" |
| 162 | + veritysetup close "$devname" |
| 163 | + verity_checkusedloops |
| 164 | +} |
0 commit comments