@@ -660,7 +660,8 @@ func TestAuthoritativeHostControlsAreFailClosed(t *testing.T) {
660660 }
661661 control := string (controlBytes )
662662 for _ , required := range []string {
663- `/sys/devices/system/cpu/smt/control off` ,
663+ `readonly SMT_CONTROL=/sys/devices/system/cpu/smt/control` ,
664+ `urnetwork_disable_smt "$SMT_CONTROL" 10 1` ,
664665 `write_root_file "$governor_path" performance` ,
665666 `write_root_file /sys/devices/system/cpu/intel_pstate/no_turbo 1` ,
666667 `sysctl -q -w vm.overcommit_memory=1` ,
@@ -686,7 +687,10 @@ func TestAuthoritativeHostControlsAreFailClosed(t *testing.T) {
686687 `ConditionFileIsExecutable=/usr/local/libexec/urnetwork/authoritative-host-controls` ,
687688 `ExecStart=/usr/local/libexec/urnetwork/authoritative-host-controls --apply` ,
688689 `RemainAfterExit=yes` ,
690+ `Restart=on-failure` ,
691+ `RestartSec=2` ,
689692 `TimeoutStartSec=60` ,
693+ `RequiredBy=containerd.service docker.service` ,
690694 } {
691695 if ! strings .Contains (controlUnit , required ) {
692696 t .Errorf ("host-control unit is missing %q" , required )
@@ -709,13 +713,42 @@ func TestAuthoritativeHostControlsAreFailClosed(t *testing.T) {
709713 `printf '%s\n' "$management_cpuset" | sudo -n tee "$affinity_path"` ,
710714 `[ "$configured" != "$management_cpuset" ]` ,
711715 `[ "${#failed_irqs[@]}" -eq 0 ]` ,
716+ `kind:"sim-latency-irq-placement-policy"` ,
717+ `irq_policy_sha256` ,
712718 `[ "$passed" = true ]` ,
713719 } {
714720 if ! strings .Contains (irq , required ) {
715721 t .Errorf ("authoritative IRQ control is missing %q" , required )
716722 }
717723 }
718724
725+ hostCheckBytes , err := os .ReadFile ("host-self-check.sh" )
726+ if err != nil {
727+ t .Fatal (err )
728+ }
729+ hostCheck := string (hostCheckBytes )
730+ for _ , required := range []string {
731+ `irq_report="$($IRQ_CONTROL --check` ,
732+ `[ "$irq_live_passed" = true ]` ,
733+ `[ "$irq_policy_sha256" = "$expected_irq_policy_sha" ]` ,
734+ } {
735+ if ! strings .Contains (hostCheck , required ) {
736+ t .Errorf ("host IRQ qualification is missing %q" , required )
737+ }
738+ }
739+ factsStart := strings .Index (hostCheck , `facts="$(jq -cnS` )
740+ factsEnd := strings .Index (hostCheck , `qualification_sha256="$(printf` )
741+ if factsStart == - 1 || factsEnd <= factsStart {
742+ t .Fatal ("host qualification facts block is unavailable" )
743+ }
744+ facts := hostCheck [factsStart :factsEnd ]
745+ if ! strings .Contains (facts , `irq_policy_sha256` ) {
746+ t .Fatal ("host qualification does not bind the stable IRQ policy" )
747+ }
748+ if strings .Contains (facts , `irq_affinity_sha256` ) {
749+ t .Fatal ("host qualification still binds reboot-unstable IRQ numbers" )
750+ }
751+
719752 irqUnitBytes , err := os .ReadFile ("authoritative-host-irqs.service.example" )
720753 if err != nil {
721754 t .Fatal (err )
@@ -727,6 +760,8 @@ func TestAuthoritativeHostControlsAreFailClosed(t *testing.T) {
727760 `Requires=urnetwork-authoritative-host-controls.service` ,
728761 `ConditionFileIsExecutable=/usr/local/libexec/urnetwork/authoritative-host-irqs` ,
729762 `ExecStart=/usr/local/libexec/urnetwork/authoritative-host-irqs --apply` ,
763+ `Restart=on-failure` ,
764+ `RequiredBy=containerd.service docker.service` ,
730765 } {
731766 if ! strings .Contains (irqUnit , required ) {
732767 t .Errorf ("IRQ unit is missing %q" , required )
@@ -740,11 +775,12 @@ func TestAuthoritativeHostControlsAreFailClosed(t *testing.T) {
740775 installer := string (installerBytes )
741776 for _ , required := range []string {
742777 `install -D -o root -g root -m 0555 "$CONTROL_SOURCE" "$CONTROL_TARGET"` ,
778+ `install -D -o root -g root -m 0444 "$CONTROL_LIBRARY_SOURCE" "$CONTROL_LIBRARY_TARGET"` ,
743779 `install -D -o root -g root -m 0555 "$BOUNDARY_SOURCE" "$BOUNDARY_TARGET"` ,
744780 `install -D -o root -g root -m 0555 "$IRQ_SOURCE" "$IRQ_TARGET"` ,
745781 `install -D -o root -g root -m 0444 "$UNIT_SOURCE" "$UNIT_TARGET"` ,
746782 `install -D -o root -g root -m 0444 "$IRQ_UNIT_SOURCE" "$IRQ_UNIT_TARGET"` ,
747- `systemctl enable "$UNIT_NAME" "$IRQ_UNIT_NAME"` ,
783+ `systemctl reenable "$UNIT_NAME" "$IRQ_UNIT_NAME"` ,
748784 `sudo -n "$CONTROL_TARGET" --check` ,
749785 `sudo -n "$IRQ_TARGET" --check` ,
750786 } {
@@ -754,6 +790,35 @@ func TestAuthoritativeHostControlsAreFailClosed(t *testing.T) {
754790 }
755791}
756792
793+ func TestAuthoritativeHostSMTNormalization (t * testing.T ) {
794+ command := exec .Command ("bash" , "./test-authoritative-host-controls-lib.sh" )
795+ output , err := command .CombinedOutput ()
796+ if err != nil {
797+ t .Fatalf ("SMT normalization regression test failed: %v\n %s" , err , output )
798+ }
799+ }
800+
801+ func TestContainerSmokeHashesRemappedLocalSourcesAsRoot (t * testing.T ) {
802+ scriptBytes , err := os .ReadFile ("container/smoke-test.sh" )
803+ if err != nil {
804+ t .Fatal (err )
805+ }
806+ script := string (scriptBytes )
807+ for _ , required := range []string {
808+ `sudo -n chown -R "$container_host_uid:$container_host_gid" "$smoke_root/local-source"` ,
809+ `config_local_sha256="$(sudo -n "$HASH_LOCAL_MOUNT" "$config_local_directory")"` ,
810+ `vault_local_sha256="$(sudo -n "$HASH_LOCAL_MOUNT" "$vault_local_directory")"` ,
811+ } {
812+ if ! strings .Contains (script , required ) {
813+ t .Errorf ("remapped local-source smoke boundary is missing %q" , required )
814+ }
815+ }
816+ if strings .Contains (script , `config_local_sha256="$($HASH_LOCAL_MOUNT` ) ||
817+ strings .Contains (script , `vault_local_sha256="$($HASH_LOCAL_MOUNT` ) {
818+ t .Fatal ("smoke hashes a remapped local source as the unprivileged caller" )
819+ }
820+ }
821+
757822// Build output is attacker-controlled and must be drained without allowing a
758823// noisy package initializer to consume the host-memory reserve.
759824func TestEvaluatorBoundsCandidateBuildLogWhileDrainingIt (t * testing.T ) {
0 commit comments