FDS/OS 1.0

tests/integration/rootfs-emulation.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python3
+"""Validate private ARM execution and prove the host binfmt registry is unchanged."""
+from pathlib import Path
+import subprocess
+
+project = Path(__file__).resolve().parents[2]
+registry = Path('/proc/sys/fs/binfmt_misc')
+def snapshot():
+    return {path.name: path.read_bytes() for path in registry.iterdir() if path.name != 'register'}
+before = snapshot()
+command = [str(project/'tools/in-rootfs'), str(project/'out/rootfs-aarch64'), '/bin/bash', '-euc']
+result = subprocess.run([*command, 'test -f /tmp/fds-binfmt/fds-aarch64; grep -qx ID=fds /usr/lib/os-release; printf "nested ARM execution\\n" | gzip | gzip -d; grep CapEff /proc/self/status'], check=True, capture_output=True, text=True)
+assert 'nested ARM execution\n' in result.stdout
+assert '0000000080000000' in result.stdout, 'Setup capabilities were not dropped'
+failure = subprocess.run([*command, 'exit 73'])
+assert failure.returncode == 73, 'Target failure exit code was not preserved'
+assert snapshot() == before, 'Host binfmt registry changed'
+print('PASS: private ARM child execution, restricted build capabilities, exit status and unchanged host registry')