From 3e4fa1e2022970dee003bea0932ea0c10f8744ba Mon Sep 17 00:00:00 2001 From: Andrei Zeliankou Date: Thu, 25 May 2023 14:26:12 +0100 Subject: Tests: removed unused variables. --- test/test_python_isolation.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'test/test_python_isolation.py') diff --git a/test/test_python_isolation.py b/test/test_python_isolation.py index c524aea0..35ca4a56 100644 --- a/test/test_python_isolation.py +++ b/test/test_python_isolation.py @@ -125,7 +125,7 @@ class TestPythonIsolation(TestApplicationPython): self.getjson(url='/?path=/proc/self')['body']['FileExists'] == True ), '/proc/self' - def test_python_isolation_cgroup(self, is_su, temp_dir): + def test_python_isolation_cgroup(self, is_su): if not is_su: pytest.skip('requires root') @@ -148,7 +148,7 @@ class TestPythonIsolation(TestApplicationPython): assert len(cgroup_rel.parts) >= len(cgroup_abs.parts) - def test_python_isolation_cgroup_two(self, is_su, temp_dir): + def test_python_isolation_cgroup_two(self, is_su): if not is_su: pytest.skip('requires root') -- cgit From b034bf67034c4f0e966ebd207ba2f407f6f15fa8 Mon Sep 17 00:00:00 2001 From: Andrei Zeliankou Date: Thu, 25 May 2023 16:56:14 +0100 Subject: Tests: assertion related fixes. --- test/test_python_isolation.py | 28 +++++++++++++--------------- 1 file changed, 13 insertions(+), 15 deletions(-) (limited to 'test/test_python_isolation.py') diff --git a/test/test_python_isolation.py b/test/test_python_isolation.py index 35ca4a56..506d20b7 100644 --- a/test/test_python_isolation.py +++ b/test/test_python_isolation.py @@ -58,27 +58,25 @@ class TestPythonIsolation(TestApplicationPython): self.load('ns_inspect', isolation=isolation) - assert ( + assert not ( self.getjson(url=f'/?path={temp_dir}')['body']['FileExists'] - == False ), 'temp_dir does not exists in rootfs' - assert ( - self.getjson(url='/?path=/proc/self')['body']['FileExists'] == True - ), 'no /proc/self' + assert self.getjson(url='/?path=/proc/self')['body'][ + 'FileExists' + ], 'no /proc/self' - assert ( - self.getjson(url='/?path=/dev/pts')['body']['FileExists'] == False + assert not ( + self.getjson(url='/?path=/dev/pts')['body']['FileExists'] ), 'no /dev/pts' - assert ( + assert not ( self.getjson(url='/?path=/sys/kernel')['body']['FileExists'] - == False ), 'no /sys/kernel' ret = self.getjson(url='/?path=/app/python/ns_inspect') - assert ret['body']['FileExists'] == True, 'application exists in rootfs' + assert ret['body']['FileExists'], 'application exists in rootfs' def test_python_isolation_rootfs_no_language_deps(self, is_su, temp_dir): if not is_su: @@ -113,17 +111,17 @@ class TestPythonIsolation(TestApplicationPython): self.load('ns_inspect', isolation=isolation) - assert ( - self.getjson(url='/?path=/proc/self')['body']['FileExists'] == False + assert not ( + self.getjson(url='/?path=/proc/self')['body']['FileExists'] ), 'no /proc/self' isolation['automount']['procfs'] = True self.load('ns_inspect', isolation=isolation) - assert ( - self.getjson(url='/?path=/proc/self')['body']['FileExists'] == True - ), '/proc/self' + assert self.getjson(url='/?path=/proc/self')['body'][ + 'FileExists' + ], '/proc/self' def test_python_isolation_cgroup(self, is_su): if not is_su: -- cgit From ce2405ec3dd97e8bdf8f63312e3c6ce59ef562d4 Mon Sep 17 00:00:00 2001 From: Andrei Zeliankou Date: Mon, 12 Jun 2023 14:16:59 +0100 Subject: Tests: prerequisites checking reworked. Prerequisites check moved to the module level to simplify class structure. Discovery and prerequisites checks functions moved to the separate files. Introduced "require" fixture to provide per-test requirements check. --- test/test_python_isolation.py | 74 +++++++++++++++++++------------------------ 1 file changed, 32 insertions(+), 42 deletions(-) (limited to 'test/test_python_isolation.py') diff --git a/test/test_python_isolation.py b/test/test_python_isolation.py index 506d20b7..a9ed2900 100644 --- a/test/test_python_isolation.py +++ b/test/test_python_isolation.py @@ -10,10 +10,10 @@ from unit.utils import findmnt from unit.utils import waitformount from unit.utils import waitforunmount +prerequisites = {'modules': {'python': 'any'}, 'features': {'isolation': True}} -class TestPythonIsolation(TestApplicationPython): - prerequisites = {'modules': {'python': 'any'}, 'features': ['isolation']} +class TestPythonIsolation(TestApplicationPython): def get_cgroup(self, app_name): output = subprocess.check_output( ['ps', 'ax', '-o', 'pid', '-o', 'cmd'] @@ -31,25 +31,23 @@ class TestPythonIsolation(TestApplicationPython): with open(cgroup, 'r') as f: return f.read().rstrip() - def test_python_isolation_rootfs(self, is_su, temp_dir): - isolation_features = option.available['features']['isolation'].keys() - - if not is_su: - if not 'unprivileged_userns_clone' in isolation_features: - pytest.skip('requires unprivileged userns or root') - - if 'user' not in isolation_features: - pytest.skip('user namespace is not supported') - - if 'mnt' not in isolation_features: - pytest.skip('mnt namespace is not supported') - - if 'pid' not in isolation_features: - pytest.skip('pid namespace is not supported') - + def test_python_isolation_rootfs(self, is_su, require, temp_dir): isolation = {'rootfs': temp_dir} if not is_su: + require( + { + 'features': { + 'isolation': [ + 'unprivileged_userns_clone', + 'user', + 'mnt', + 'pid', + ] + } + } + ) + isolation['namespaces'] = { 'mount': True, 'credential': True, @@ -78,9 +76,8 @@ class TestPythonIsolation(TestApplicationPython): assert ret['body']['FileExists'], 'application exists in rootfs' - def test_python_isolation_rootfs_no_language_deps(self, is_su, temp_dir): - if not is_su: - pytest.skip('requires root') + def test_python_isolation_rootfs_no_language_deps(self, require, temp_dir): + require({'privileged_user': True}) isolation = {'rootfs': temp_dir, 'automount': {'language_deps': False}} self.load('empty', isolation=isolation) @@ -103,9 +100,8 @@ class TestPythonIsolation(TestApplicationPython): assert waitforunmount(python_path), 'language_deps unmount' - def test_python_isolation_procfs(self, is_su, temp_dir): - if not is_su: - pytest.skip('requires root') + def test_python_isolation_procfs(self, require, temp_dir): + require({'privileged_user': True}) isolation = {'rootfs': temp_dir, 'automount': {'procfs': False}} @@ -123,12 +119,10 @@ class TestPythonIsolation(TestApplicationPython): 'FileExists' ], '/proc/self' - def test_python_isolation_cgroup(self, is_su): - if not is_su: - pytest.skip('requires root') - - if not 'cgroup' in option.available['features']['isolation']: - pytest.skip('cgroup is not supported') + def test_python_isolation_cgroup(self, require): + require( + {'privileged_user': True, 'features': {'isolation': ['cgroup']}} + ) def set_cgroup_path(path): isolation = {'cgroup': {'path': path}} @@ -146,12 +140,10 @@ class TestPythonIsolation(TestApplicationPython): assert len(cgroup_rel.parts) >= len(cgroup_abs.parts) - def test_python_isolation_cgroup_two(self, is_su): - if not is_su: - pytest.skip('requires root') - - if not 'cgroup' in option.available['features']['isolation']: - pytest.skip('cgroup is not supported') + def test_python_isolation_cgroup_two(self, require): + require( + {'privileged_user': True, 'features': {'isolation': ['cgroup']}} + ) def set_two_cgroup_path(path, path2): script_path = f'{option.test_dir}/python/empty' @@ -193,12 +185,10 @@ class TestPythonIsolation(TestApplicationPython): set_two_cgroup_path('/scope/python', '/scope2/python') assert self.get_cgroup('one') != self.get_cgroup('two') - def test_python_isolation_cgroup_invalid(self, is_su): - if not is_su: - pytest.skip('requires root') - - if not 'cgroup' in option.available['features']['isolation']: - pytest.skip('cgroup is not supported') + def test_python_isolation_cgroup_invalid(self, require): + require( + {'privileged_user': True, 'features': {'isolation': ['cgroup']}} + ) def check_invalid(path): script_path = f'{option.test_dir}/python/empty' -- cgit From c183bd8749a19477390f8cb77efe5f6d223f0905 Mon Sep 17 00:00:00 2001 From: Andrei Zeliankou Date: Wed, 14 Jun 2023 18:20:09 +0100 Subject: Tests: get rid of classes in test files. Class usage came from the unittest framework and it was always redundant after migration to the pytest. This commit removes classes from files containing tests to make them more readable and understandable. --- test/test_python_isolation.py | 307 +++++++++++++++++++++--------------------- 1 file changed, 153 insertions(+), 154 deletions(-) (limited to 'test/test_python_isolation.py') diff --git a/test/test_python_isolation.py b/test/test_python_isolation.py index a9ed2900..260a87a2 100644 --- a/test/test_python_isolation.py +++ b/test/test_python_isolation.py @@ -4,7 +4,7 @@ import subprocess from pathlib import Path import pytest -from unit.applications.lang.python import TestApplicationPython +from unit.applications.lang.python import ApplicationPython from unit.option import option from unit.utils import findmnt from unit.utils import waitformount @@ -12,204 +12,203 @@ from unit.utils import waitforunmount prerequisites = {'modules': {'python': 'any'}, 'features': {'isolation': True}} +client = ApplicationPython() -class TestPythonIsolation(TestApplicationPython): - def get_cgroup(self, app_name): - output = subprocess.check_output( - ['ps', 'ax', '-o', 'pid', '-o', 'cmd'] - ).decode() - pid = re.search( - fr'(\d+)\s*unit: "{app_name}" application', output - ).group(1) +def get_cgroup(app_name): + output = subprocess.check_output( + ['ps', 'ax', '-o', 'pid', '-o', 'cmd'] + ).decode() - cgroup = f'/proc/{pid}/cgroup' + pid = re.search(fr'(\d+)\s*unit: "{app_name}" application', output).group(1) - if not os.path.isfile(cgroup): - pytest.skip(f'no cgroup at {cgroup}') + cgroup = f'/proc/{pid}/cgroup' - with open(cgroup, 'r') as f: - return f.read().rstrip() + if not os.path.isfile(cgroup): + pytest.skip(f'no cgroup at {cgroup}') - def test_python_isolation_rootfs(self, is_su, require, temp_dir): - isolation = {'rootfs': temp_dir} + with open(cgroup, 'r') as f: + return f.read().rstrip() - if not is_su: - require( - { - 'features': { - 'isolation': [ - 'unprivileged_userns_clone', - 'user', - 'mnt', - 'pid', - ] - } - } - ) - isolation['namespaces'] = { - 'mount': True, - 'credential': True, - 'pid': True, +def test_python_isolation_rootfs(is_su, require, temp_dir): + isolation = {'rootfs': temp_dir} + + if not is_su: + require( + { + 'features': { + 'isolation': [ + 'unprivileged_userns_clone', + 'user', + 'mnt', + 'pid', + ] + } } + ) - self.load('ns_inspect', isolation=isolation) + isolation['namespaces'] = { + 'mount': True, + 'credential': True, + 'pid': True, + } - assert not ( - self.getjson(url=f'/?path={temp_dir}')['body']['FileExists'] - ), 'temp_dir does not exists in rootfs' + client.load('ns_inspect', isolation=isolation) - assert self.getjson(url='/?path=/proc/self')['body'][ - 'FileExists' - ], 'no /proc/self' + assert not ( + client.getjson(url=f'/?path={temp_dir}')['body']['FileExists'] + ), 'temp_dir does not exists in rootfs' - assert not ( - self.getjson(url='/?path=/dev/pts')['body']['FileExists'] - ), 'no /dev/pts' + assert client.getjson(url='/?path=/proc/self')['body'][ + 'FileExists' + ], 'no /proc/self' - assert not ( - self.getjson(url='/?path=/sys/kernel')['body']['FileExists'] - ), 'no /sys/kernel' + assert not ( + client.getjson(url='/?path=/dev/pts')['body']['FileExists'] + ), 'no /dev/pts' - ret = self.getjson(url='/?path=/app/python/ns_inspect') + assert not ( + client.getjson(url='/?path=/sys/kernel')['body']['FileExists'] + ), 'no /sys/kernel' - assert ret['body']['FileExists'], 'application exists in rootfs' + ret = client.getjson(url='/?path=/app/python/ns_inspect') - def test_python_isolation_rootfs_no_language_deps(self, require, temp_dir): - require({'privileged_user': True}) + assert ret['body']['FileExists'], 'application exists in rootfs' - isolation = {'rootfs': temp_dir, 'automount': {'language_deps': False}} - self.load('empty', isolation=isolation) - python_path = f'{temp_dir}/usr' +def test_python_isolation_rootfs_no_language_deps(require, temp_dir): + require({'privileged_user': True}) - assert findmnt().find(python_path) == -1 - assert self.get()['status'] != 200, 'disabled language_deps' - assert findmnt().find(python_path) == -1 + isolation = {'rootfs': temp_dir, 'automount': {'language_deps': False}} + client.load('empty', isolation=isolation) - isolation['automount']['language_deps'] = True + python_path = f'{temp_dir}/usr' - self.load('empty', isolation=isolation) + assert findmnt().find(python_path) == -1 + assert client.get()['status'] != 200, 'disabled language_deps' + assert findmnt().find(python_path) == -1 - assert findmnt().find(python_path) == -1 - assert self.get()['status'] == 200, 'enabled language_deps' - assert waitformount(python_path), 'language_deps mount' + isolation['automount']['language_deps'] = True - self.conf({"listeners": {}, "applications": {}}) + client.load('empty', isolation=isolation) - assert waitforunmount(python_path), 'language_deps unmount' + assert findmnt().find(python_path) == -1 + assert client.get()['status'] == 200, 'enabled language_deps' + assert waitformount(python_path), 'language_deps mount' - def test_python_isolation_procfs(self, require, temp_dir): - require({'privileged_user': True}) + client.conf({"listeners": {}, "applications": {}}) - isolation = {'rootfs': temp_dir, 'automount': {'procfs': False}} + assert waitforunmount(python_path), 'language_deps unmount' - self.load('ns_inspect', isolation=isolation) - assert not ( - self.getjson(url='/?path=/proc/self')['body']['FileExists'] - ), 'no /proc/self' +def test_python_isolation_procfs(require, temp_dir): + require({'privileged_user': True}) - isolation['automount']['procfs'] = True + isolation = {'rootfs': temp_dir, 'automount': {'procfs': False}} - self.load('ns_inspect', isolation=isolation) + client.load('ns_inspect', isolation=isolation) - assert self.getjson(url='/?path=/proc/self')['body'][ - 'FileExists' - ], '/proc/self' + assert not ( + client.getjson(url='/?path=/proc/self')['body']['FileExists'] + ), 'no /proc/self' - def test_python_isolation_cgroup(self, require): - require( - {'privileged_user': True, 'features': {'isolation': ['cgroup']}} - ) + isolation['automount']['procfs'] = True - def set_cgroup_path(path): - isolation = {'cgroup': {'path': path}} - self.load('empty', processes=1, isolation=isolation) + client.load('ns_inspect', isolation=isolation) - set_cgroup_path('scope/python') + assert client.getjson(url='/?path=/proc/self')['body'][ + 'FileExists' + ], '/proc/self' - cgroup_rel = Path(self.get_cgroup('empty')) - assert cgroup_rel.parts[-2:] == ('scope', 'python'), 'cgroup rel' - set_cgroup_path('/scope2/python') +def test_python_isolation_cgroup(require): + require({'privileged_user': True, 'features': {'isolation': ['cgroup']}}) - cgroup_abs = Path(self.get_cgroup('empty')) - assert cgroup_abs.parts[-2:] == ('scope2', 'python'), 'cgroup abs' + def set_cgroup_path(path): + isolation = {'cgroup': {'path': path}} + client.load('empty', processes=1, isolation=isolation) - assert len(cgroup_rel.parts) >= len(cgroup_abs.parts) + set_cgroup_path('scope/python') - def test_python_isolation_cgroup_two(self, require): - require( - {'privileged_user': True, 'features': {'isolation': ['cgroup']}} - ) + cgroup_rel = Path(get_cgroup('empty')) + assert cgroup_rel.parts[-2:] == ('scope', 'python'), 'cgroup rel' - def set_two_cgroup_path(path, path2): - script_path = f'{option.test_dir}/python/empty' + set_cgroup_path('/scope2/python') - assert 'success' in self.conf( - { - "listeners": { - "*:7080": {"pass": "applications/one"}, - "*:7081": {"pass": "applications/two"}, - }, - "applications": { - "one": { - "type": "python", - "processes": 1, - "path": script_path, - "working_directory": script_path, - "module": "wsgi", - "isolation": { - 'cgroup': {'path': path}, - }, - }, - "two": { - "type": "python", - "processes": 1, - "path": script_path, - "working_directory": script_path, - "module": "wsgi", - "isolation": { - 'cgroup': {'path': path2}, - }, - }, - }, - } - ) + cgroup_abs = Path(get_cgroup('empty')) + assert cgroup_abs.parts[-2:] == ('scope2', 'python'), 'cgroup abs' - set_two_cgroup_path('/scope/python', '/scope/python') - assert self.get_cgroup('one') == self.get_cgroup('two') + assert len(cgroup_rel.parts) >= len(cgroup_abs.parts) - set_two_cgroup_path('/scope/python', '/scope2/python') - assert self.get_cgroup('one') != self.get_cgroup('two') - def test_python_isolation_cgroup_invalid(self, require): - require( - {'privileged_user': True, 'features': {'isolation': ['cgroup']}} - ) +def test_python_isolation_cgroup_two(require): + require({'privileged_user': True, 'features': {'isolation': ['cgroup']}}) - def check_invalid(path): - script_path = f'{option.test_dir}/python/empty' - assert 'error' in self.conf( - { - "listeners": {"*:7080": {"pass": "applications/empty"}}, - "applications": { - "empty": { - "type": "python", - "processes": {"spare": 0}, - "path": script_path, - "working_directory": script_path, - "module": "wsgi", - "isolation": { - 'cgroup': {'path': path}, - }, - } + def set_two_cgroup_path(path, path2): + script_path = f'{option.test_dir}/python/empty' + + assert 'success' in client.conf( + { + "listeners": { + "*:7080": {"pass": "applications/one"}, + "*:7081": {"pass": "applications/two"}, + }, + "applications": { + "one": { + "type": "python", + "processes": 1, + "path": script_path, + "working_directory": script_path, + "module": "wsgi", + "isolation": { + 'cgroup': {'path': path}, + }, }, - } - ) + "two": { + "type": "python", + "processes": 1, + "path": script_path, + "working_directory": script_path, + "module": "wsgi", + "isolation": { + 'cgroup': {'path': path2}, + }, + }, + }, + } + ) + + set_two_cgroup_path('/scope/python', '/scope/python') + assert get_cgroup('one') == get_cgroup('two') + + set_two_cgroup_path('/scope/python', '/scope2/python') + assert get_cgroup('one') != get_cgroup('two') + + +def test_python_isolation_cgroup_invalid(require): + require({'privileged_user': True, 'features': {'isolation': ['cgroup']}}) + + def check_invalid(path): + script_path = f'{option.test_dir}/python/empty' + assert 'error' in client.conf( + { + "listeners": {"*:7080": {"pass": "applications/empty"}}, + "applications": { + "empty": { + "type": "python", + "processes": {"spare": 0}, + "path": script_path, + "working_directory": script_path, + "module": "wsgi", + "isolation": { + 'cgroup': {'path': path}, + }, + } + }, + } + ) - check_invalid('') - check_invalid('../scope') - check_invalid('scope/../python') + check_invalid('') + check_invalid('../scope') + check_invalid('scope/../python') -- cgit