@@ -83,24 +83,99 @@ ARGS="--share=ipc" run_sh readlink /proc/self/ns/ipc > shared_ipc_ns
83
83
assert_not_streq ` cat unshared_ipc_ns` ` readlink /proc/self/ns/ipc`
84
84
assert_streq ` cat shared_ipc_ns` ` readlink /proc/self/ns/ipc`
85
85
86
- if run_sh cat " ${test_builddir} /package_version.txt" & > /dev/null; then
87
- assert_not_reached " Unexpectedly allowed to access file"
86
+ # We try the filesystem namespace tests several times with different
87
+ # shared-or-not directories, because:
88
+ # - --filesystem=/foo doesn't work if /foo is read-only in the container
89
+ # (notably, --filesystem=/usr/... won't work)
90
+ # - --filesystem=host doesn't expose either /usr or /var/... or /var/tmp
91
+ # from the host because they're on the list of things we expect to be
92
+ # supplied by the container
93
+
94
+ test_filesystem_binding () {
95
+ local dir=" $1 "
96
+
97
+ if run_sh cat " $dir /package_version.txt" & > /dev/null; then
98
+ assert_not_reached " Unexpectedly allowed to access file"
99
+ fi
100
+
101
+ case " $dir " in
102
+ (/home/* |/opt/* |/var/tmp/* )
103
+ if ! ARGS=" --filesystem=$dir " run_sh cat " $dir /package_version.txt" > /dev/null; then
104
+ assert_not_reached " Failed to share --filesystem=$dir "
105
+ fi
106
+ ;;
107
+ (* )
108
+ echo " Not testing --filesystem=$dir , it won't necessarily work" >&2
109
+ ;;
110
+ esac
111
+
112
+ case " $dir " in
113
+ (/home/* |/opt/* )
114
+ if ! ARGS=" --filesystem=host" run_sh cat " $dir /package_version.txt" > /dev/null; then
115
+ assert_not_reached " Failed to share $dir as part of host filesystem"
116
+ fi
117
+ ;;
118
+ (* )
119
+ echo " Not testing --filesystem=host with $dir , it won't necessarily work" >&2
120
+ ;;
121
+ esac
122
+ }
123
+
124
+ test_filesystem_binding " ${test_builddir} "
125
+
126
+ mkdir " ${TEST_DATA_DIR} /shareable"
127
+ cp " ${test_builddir} /package_version.txt" " ${TEST_DATA_DIR} /shareable/"
128
+ test_filesystem_binding " ${TEST_DATA_DIR} /shareable"
129
+
130
+ # We don't want to pollute the home directory unprompted, but the user
131
+ # can opt-in by creating this directory.
132
+ if [ -e " ${HOME} /.flatpak-tests" ]; then
133
+ cp " ${test_builddir} /package_version.txt" " ${HOME} /.flatpak-tests/"
134
+ test_filesystem_binding " ${HOME} /.flatpak-tests"
135
+ else
136
+ echo " not testing \$ HOME binding, \$ HOME/.flatpak-tests/ does not exist" >&2
88
137
fi
89
138
90
- ARGS=" --filesystem=${test_builddir} " run_sh cat " ${test_builddir} /package_version.txt" > /dev/null
91
- ARGS=" --filesystem=host" run_sh cat " ${test_builddir} /package_version.txt" > /dev/null
92
-
93
139
echo " ok namespaces"
94
140
95
- $FLATPAK override ${U} --filesystem=host org.test.Hello
96
- run_sh cat " ${test_builddir} /package_version.txt" & > /dev/null
97
- if ARGS=" --nofilesystem=host" run_sh cat " ${test_builddir} /package_version.txt" & > /dev/null; then
98
- assert_not_reached " Unexpectedly allowed to access --nofilesystem=host file"
99
- fi
100
- $FLATPAK override ${U} --nofilesystem=host org.test.Hello
141
+ test_overrides () {
142
+ local dir=" $1 "
143
+
144
+ if run_sh cat " $dir /package_version.txt" & > /dev/null; then
145
+ assert_not_reached " Unexpectedly allowed to access file"
146
+ fi
147
+
148
+ $FLATPAK override ${U} --filesystem=host org.test.Hello
149
+
150
+ case " $dir " in
151
+ (/home/* |/opt/* )
152
+ if ! run_sh cat " $dir /package_version.txt" > /dev/null; then
153
+ assert_not_reached " Failed to share $dir as part of host filesystem"
154
+ fi
155
+ ;;
156
+ (* )
157
+ echo " Not testing --filesystem=host with $dir , it won't necessarily work" >&2
158
+ ;;
159
+ esac
160
+
161
+ if ARGS=" --nofilesystem=host" run_sh cat " ${dir} /package_version.txt" & > /dev/null; then
162
+ assert_not_reached " Unexpectedly allowed to access --nofilesystem=host file"
163
+ fi
164
+
165
+ $FLATPAK override ${U} --nofilesystem=host org.test.Hello
166
+
167
+ if run_sh cat " ${dir} /package_version.txt" & > /dev/null; then
168
+ assert_not_reached " Unexpectedly allowed to access file"
169
+ fi
170
+ }
171
+
172
+ test_overrides " ${test_builddir} "
101
173
102
- if run_sh cat " ${test_builddir} /package_version.txt" & > /dev/null; then
103
- assert_not_reached " Unexpectedly allowed to access file"
174
+ if [ -e " ${HOME} /.flatpak-tests" ]; then
175
+ cp " ${test_builddir} /package_version.txt" " ${HOME} /.flatpak-tests/"
176
+ test_overrides " ${HOME} /.flatpak-tests"
177
+ else
178
+ echo " not testing \$ HOME binding overrides, \$ HOME/.flatpak-tests/ does not exist" >&2
104
179
fi
105
180
106
181
echo " ok overrides"
0 commit comments