19 lines
1.1 KiB
Python
19 lines
1.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Validate private ARM execution and prove the host binfmt registry is unchanged."""
|
|
from pathlib import Path
|
|
import subprocess
|
|
|
|
project = Path(__file__).resolve().parents[2]
|
|
registry = Path('/proc/sys/fs/binfmt_misc')
|
|
def snapshot():
|
|
return {path.name: path.read_bytes() for path in registry.iterdir() if path.name != 'register'}
|
|
before = snapshot()
|
|
command = [str(project/'tools/in-rootfs'), str(project/'out/rootfs-aarch64'), '/bin/bash', '-euc']
|
|
result = subprocess.run([*command, 'test -f /tmp/fds-binfmt/fds-aarch64; grep -qx ID=fds /usr/lib/os-release; printf "nested ARM execution\\n" | gzip | gzip -d; grep CapEff /proc/self/status'], check=True, capture_output=True, text=True)
|
|
assert 'nested ARM execution\n' in result.stdout
|
|
assert '0000000080000000' in result.stdout, 'Setup capabilities were not dropped'
|
|
failure = subprocess.run([*command, 'exit 73'])
|
|
assert failure.returncode == 73, 'Target failure exit code was not preserved'
|
|
assert snapshot() == before, 'Host binfmt registry changed'
|
|
print('PASS: private ARM child execution, restricted build capabilities, exit status and unchanged host registry')
|