rpm-ostree/tests/ex-container-tests/test-bash.sh

#!/usr/bin/bash
set -xeuo pipefail

cd ${test_tmpdir}

dn=$(cd $(dirname $0) && pwd)
. ${dn}/../common/libtest-core.sh

cat >bash.conf <<EOF
[tree]
ref=bash
packages=coreutils;bash;
selinux=false
repos=fedora;
releasever=29
EOF

rpm-ostree ex container assemble bash.conf
ostree --repo=repo fsck -q
ostree --repo=repo ls bash /usr/etc/shadow > shadowls.txt
assert_file_has_content shadowls.txt '^-00400 .*/usr/etc/shadow'
ostree --repo=repo ls bash /usr/share/doc/bash/README >/dev/null

cat >bash-nodocs.conf <<EOF
[tree]
ref=bash-nodocs
packages=coreutils;bash;
selinux=false
repos=fedora;
releasever=29
documentation=false;
EOF

rpm-ostree ex container assemble bash-nodocs.conf
ostree --repo=repo ls bash-nodocs /usr/share/doc/bash >docs.txt
assert_not_file_has_content docs.txt README
Add test infra for `ex container`, and one test for bash We have some unit-style tests that run `ex container`, but they aren't "real"; they don't use scripts for example. Let's add tests for this similar to `tests/compose`. We use a 26 base, but the target repos need to be 27 to pick up the fix for: https://bugzilla.redhat.com/show_bug.cgi?id=1478172 Add some bits to share infra between `tests/compose` and `tests/ex-container`; basically handling the rpmmd repos. I tweaked things to be more streamlined there between the `.papr.yml` and the test script. Right now this is just one test for `bash`, but lays some of the infrastructure for doing more. One thing that we need to do to improve more here is to better cache RPMs, a bit like the compose tests do. Closes: #1024 Approved by: jlebon 2017-09-29 17:01:18 +03:00			`#!/usr/bin/bash`
			`set -xeuo pipefail`

			`cd ${test_tmpdir}`

ex-container: Make /usr/etc/{,g}shadow user-readable For the `ex container` case, there's no security issues here; one shouldn't be doing user management in these roots at all. This is for work on exporting `ex container` roots to OCI as non-root. Without this fix, libostree just tries to `openat()` the object for export to tar, and fails. See also https://github.com/projectatomic/rpm-ostree/issues/1045 Closes: #1046 Approved by: jlebon 2017-10-10 18:10:48 +03:00			`dn=$(cd $(dirname $0) && pwd)`
			`. ${dn}/../common/libtest-core.sh`

Add test infra for `ex container`, and one test for bash We have some unit-style tests that run `ex container`, but they aren't "real"; they don't use scripts for example. Let's add tests for this similar to `tests/compose`. We use a 26 base, but the target repos need to be 27 to pick up the fix for: https://bugzilla.redhat.com/show_bug.cgi?id=1478172 Add some bits to share infra between `tests/compose` and `tests/ex-container`; basically handling the rpmmd repos. I tweaked things to be more streamlined there between the `.papr.yml` and the test script. Right now this is just one test for `bash`, but lays some of the infrastructure for doing more. One thing that we need to do to improve more here is to better cache RPMs, a bit like the compose tests do. Closes: #1024 Approved by: jlebon 2017-09-29 17:01:18 +03:00			`cat >bash.conf <<EOF`
			`[tree]`
			`ref=bash`
			`packages=coreutils;bash;`
Lower initial SELinux policy load from compose to core Add a `selinux` verb to treespec, and bind it from treefile. If set, use it in the core to load an initial policy before import, if we didn't already set a policy. In practice right now this is only used from the compose path since the SysrootUpgrader uses the policy from the merge deployment. Unset the policy if rojig mode is enabled. Now, non-SELinux use cases are required to set `selinux: false` in the treespec. For `ex container` I just set it in our example specs. Probably that should forcibly disable it in the treespec but eh, it's experimental. The other case I can think of is client-side layering; before we would create a policy using the target root, but it wasn't a hard requirement, i.e. we didn't error out if `policy_get_name() == NULL`. Let's preserve that semantic by hooking off of whether `_new_system()` was used. Prep for sharing code with `compose rojig`. Closes: #1630 Approved by: jlebon 2018-10-15 19:10:16 +03:00			`selinux=false`
Add test infra for `ex container`, and one test for bash We have some unit-style tests that run `ex container`, but they aren't "real"; they don't use scripts for example. Let's add tests for this similar to `tests/compose`. We use a 26 base, but the target repos need to be 27 to pick up the fix for: https://bugzilla.redhat.com/show_bug.cgi?id=1478172 Add some bits to share infra between `tests/compose` and `tests/ex-container`; basically handling the rpmmd repos. I tweaked things to be more streamlined there between the `.papr.yml` and the test script. Right now this is just one test for `bash`, but lays some of the infrastructure for doing more. One thing that we need to do to improve more here is to better cache RPMs, a bit like the compose tests do. Closes: #1024 Approved by: jlebon 2017-09-29 17:01:18 +03:00			`repos=fedora;`
ci: Bump to f29 Better late than never! Closes: #1787 Approved by: cgwalters 2019-03-15 17:00:52 +03:00			`releasever=29`
Add test infra for `ex container`, and one test for bash We have some unit-style tests that run `ex container`, but they aren't "real"; they don't use scripts for example. Let's add tests for this similar to `tests/compose`. We use a 26 base, but the target repos need to be 27 to pick up the fix for: https://bugzilla.redhat.com/show_bug.cgi?id=1478172 Add some bits to share infra between `tests/compose` and `tests/ex-container`; basically handling the rpmmd repos. I tweaked things to be more streamlined there between the `.papr.yml` and the test script. Right now this is just one test for `bash`, but lays some of the infrastructure for doing more. One thing that we need to do to improve more here is to better cache RPMs, a bit like the compose tests do. Closes: #1024 Approved by: jlebon 2017-09-29 17:01:18 +03:00			`EOF`

			`rpm-ostree ex container assemble bash.conf`
ex-container: Make /etc/shadow 0400 on import, not post-checkout Switching to the `_CONSUME` flag revealed an "oh god how did I write that" bug in the previous patch in https://github.com/projectatomic/rpm-ostree/pull/1046 AKA commit: 334f0b89be271cbe2b9973ebc7eab50f955517e8 The way that actually fixed the bug before was because we were using hardlink checkouts, and we were operating outside an `rofiles-fuse` context, we simply directly changed the on-disk object mode. But with the `_CONSUME` flag we started deleting the files as we write, meaning that stopped working. I initially wrote a patch to do the same split "prepare/processing/commit" flow that treecompose and package layering do, but that can't really fix this bug - we need to do it on import. So do the chmod on import and drop the postprocessing bits. Closes: #1067 Approved by: jlebon 2017-10-17 23:28:12 +03:00			`ostree --repo=repo fsck -q`
ex-container: Make /usr/etc/{,g}shadow user-readable For the `ex container` case, there's no security issues here; one shouldn't be doing user management in these roots at all. This is for work on exporting `ex container` roots to OCI as non-root. Without this fix, libostree just tries to `openat()` the object for export to tar, and fails. See also https://github.com/projectatomic/rpm-ostree/issues/1045 Closes: #1046 Approved by: jlebon 2017-10-10 18:10:48 +03:00			`ostree --repo=repo ls bash /usr/etc/shadow > shadowls.txt`
			`assert_file_has_content shadowls.txt '^-00400 .*/usr/etc/shadow'`
unpacker,core: Honor nodocs flag More work for unified core; this was one of the biggest parts of the `ostree diff` when comparing a unified core treecompose of Fedora Atomic Host versus the libdnf path. This is also the first case where we're teaching the pkgcache to redownload based on state. Closes: #1105 Approved by: jlebon 2017-11-15 21:41:03 +03:00			`ostree --repo=repo ls bash /usr/share/doc/bash/README >/dev/null`

			`cat >bash-nodocs.conf <<EOF`
			`[tree]`
			`ref=bash-nodocs`
			`packages=coreutils;bash;`
Lower initial SELinux policy load from compose to core Add a `selinux` verb to treespec, and bind it from treefile. If set, use it in the core to load an initial policy before import, if we didn't already set a policy. In practice right now this is only used from the compose path since the SysrootUpgrader uses the policy from the merge deployment. Unset the policy if rojig mode is enabled. Now, non-SELinux use cases are required to set `selinux: false` in the treespec. For `ex container` I just set it in our example specs. Probably that should forcibly disable it in the treespec but eh, it's experimental. The other case I can think of is client-side layering; before we would create a policy using the target root, but it wasn't a hard requirement, i.e. we didn't error out if `policy_get_name() == NULL`. Let's preserve that semantic by hooking off of whether `_new_system()` was used. Prep for sharing code with `compose rojig`. Closes: #1630 Approved by: jlebon 2018-10-15 19:10:16 +03:00			`selinux=false`
unpacker,core: Honor nodocs flag More work for unified core; this was one of the biggest parts of the `ostree diff` when comparing a unified core treecompose of Fedora Atomic Host versus the libdnf path. This is also the first case where we're teaching the pkgcache to redownload based on state. Closes: #1105 Approved by: jlebon 2017-11-15 21:41:03 +03:00			`repos=fedora;`
ci: Bump to f29 Better late than never! Closes: #1787 Approved by: cgwalters 2019-03-15 17:00:52 +03:00			`releasever=29`
unpacker,core: Honor nodocs flag More work for unified core; this was one of the biggest parts of the `ostree diff` when comparing a unified core treecompose of Fedora Atomic Host versus the libdnf path. This is also the first case where we're teaching the pkgcache to redownload based on state. Closes: #1105 Approved by: jlebon 2017-11-15 21:41:03 +03:00			`documentation=false;`
			`EOF`

			`rpm-ostree ex container assemble bash-nodocs.conf`
			`ostree --repo=repo ls bash-nodocs /usr/share/doc/bash >docs.txt`
			`assert_not_file_has_content docs.txt README`