d5b321b557
New privileged helper at /usr/local/libexec/left4me/left4me-overlay (Python, system /usr/bin/python3, stdlib only) takes only the instance name, parses instance.env for L4D2_LOWERDIRS, validates each lowerdir against an allowlist (installation/, overlays/, global_overlay_cache/, workshop_cache/), refuses upperdirs tainted with user.fuseoverlayfs.* xattrs from the prior fuse era, and execs `nsenter --mount=/proc/1/ns/mnt -- mount -t overlay ...` so the resulting mount lives in the host namespace. Mirrors the existing left4me-systemctl / left4me-journalctl pattern; sudoers entry is verb-constrained. KernelOverlayFSMounter implements the existing OverlayMounter ABC, deriving the instance name from the merged path. No call sites use it yet — that's the next commit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
76 lines
2.4 KiB
Python
76 lines
2.4 KiB
Python
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
|
|
HELPER_PATH = "/usr/local/libexec/left4me/left4me-overlay"
|
|
|
|
|
|
def test_mount_invokes_helper_with_name_only(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
from l4d2host.fs.kernel_overlayfs import KernelOverlayFSMounter
|
|
|
|
calls: list[list[str]] = []
|
|
|
|
def fake_run_command(cmd, **kwargs):
|
|
del kwargs
|
|
calls.append(list(cmd))
|
|
|
|
monkeypatch.setattr("l4d2host.fs.kernel_overlayfs.run_command", fake_run_command)
|
|
|
|
KernelOverlayFSMounter().mount(
|
|
lowerdirs="/var/lib/left4me/installation",
|
|
upperdir=Path("/var/lib/left4me/runtime/alpha/upper"),
|
|
workdir=Path("/var/lib/left4me/runtime/alpha/work"),
|
|
merged=Path("/var/lib/left4me/runtime/alpha/merged"),
|
|
)
|
|
|
|
assert calls == [["sudo", "-n", HELPER_PATH, "mount", "alpha"]]
|
|
|
|
|
|
def test_unmount_invokes_helper_with_umount_verb(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
from l4d2host.fs.kernel_overlayfs import KernelOverlayFSMounter
|
|
|
|
calls: list[list[str]] = []
|
|
|
|
def fake_run_command(cmd, **kwargs):
|
|
del kwargs
|
|
calls.append(list(cmd))
|
|
|
|
monkeypatch.setattr("l4d2host.fs.kernel_overlayfs.run_command", fake_run_command)
|
|
|
|
KernelOverlayFSMounter().unmount(merged=Path("/var/lib/left4me/runtime/alpha/merged"))
|
|
|
|
assert calls == [["sudo", "-n", HELPER_PATH, "umount", "alpha"]]
|
|
|
|
|
|
def test_mount_propagates_run_command_kwargs(monkeypatch: pytest.MonkeyPatch) -> None:
|
|
from l4d2host.fs.kernel_overlayfs import KernelOverlayFSMounter
|
|
|
|
captured: dict = {}
|
|
|
|
def fake_run_command(cmd, **kwargs):
|
|
captured["cmd"] = list(cmd)
|
|
captured["kwargs"] = kwargs
|
|
|
|
monkeypatch.setattr("l4d2host.fs.kernel_overlayfs.run_command", fake_run_command)
|
|
|
|
out: list[str] = []
|
|
err: list[str] = []
|
|
KernelOverlayFSMounter().mount(
|
|
lowerdirs="/var/lib/left4me/installation",
|
|
upperdir=Path("/var/lib/left4me/runtime/alpha/upper"),
|
|
workdir=Path("/var/lib/left4me/runtime/alpha/work"),
|
|
merged=Path("/var/lib/left4me/runtime/alpha/merged"),
|
|
on_stdout=out.append,
|
|
on_stderr=err.append,
|
|
passthrough=False,
|
|
should_cancel=lambda: False,
|
|
)
|
|
|
|
assert captured["cmd"][0:3] == ["sudo", "-n", HELPER_PATH]
|
|
captured["kwargs"]["on_stdout"]("hi")
|
|
captured["kwargs"]["on_stderr"]("oops")
|
|
assert out == ["hi"]
|
|
assert err == ["oops"]
|
|
assert captured["kwargs"]["passthrough"] is False
|
|
assert callable(captured["kwargs"]["should_cancel"])
|