70 lines
4.2 KiB
JavaScript
70 lines
4.2 KiB
JavaScript
// A delay in finish(), after timing2's end stamp, must fail independently of
|
|
// the inner timer. One fixed process tree runs at a time, without host setup,
|
|
// fake sudo, or a parent-side elapsed-time assertion.
|
|
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
|
|
import { tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
import { spawnSync } from 'node:child_process';
|
|
import { fileURLToPath } from 'node:url';
|
|
import { instrumentCleanupTimer, removeInnerObservers, readProbeSeconds } from './case-inner-timing-fixture.mjs';
|
|
|
|
const scripts=['case1-accept.sh','case2-unit.sh'];
|
|
const read=name=>readFileSync(new URL(`../../../scripts/${name}`,import.meta.url),'utf8');
|
|
// The namespace fixes /proc inventory size; it does not replace clean_session.
|
|
// See org-cleanup-time-build.md for the standalone and loaded calibration. The
|
|
// bound must reject 1s/2s delays and leave most of the 2s production headroom.
|
|
// Constant delays below 0.5s can pass; this is not a bound on host-wide scan
|
|
// cost. In particular, per-entry work needs a shipped scan-cost follow-up.
|
|
const CLEANUP_LIMIT_SECONDS=0.5;
|
|
const probe=fileURLToPath(new URL('./case-cleanup-time-fixture.mjs',import.meta.url));
|
|
|
|
for(const name of scripts)test(`cleanup timing ${name}: observers preserve bytes and reject exit-anchor drift`,()=>{
|
|
const source=read(name),clock="/unused/clock '$;literal";
|
|
const copy=instrumentCleanupTimer(source,clock);
|
|
assert.equal(removeInnerObservers(copy,clock),source);
|
|
for(const marker of ['SO_PEERCRED','MOSAIC_TESTER_SOCKET_V1','MOSAIC_LEGACY_STATUS'])
|
|
assert.equal(copy.split(marker).length,source.split(marker).length,marker);
|
|
const exit=' exit "$rc"\n';
|
|
assert.throws(()=>instrumentCleanupTimer(source.replace(exit,''),clock),/anchor/);
|
|
assert.throws(()=>instrumentCleanupTimer(source.replace(exit,exit+exit),clock),/anchor/);
|
|
});
|
|
|
|
// Both shipped copies are executed: Case1 shares this supervisor across legacy
|
|
// calls, queries and P10; Case2 uses its copy for config queries.
|
|
for(const name of scripts)test(`cleanup timing ${name}: inner timeout kills descendants within the cleanup budget`,t=>{
|
|
const dir=mkdtempSync(join(tmpdir(),'cl-'));
|
|
t.after(()=>rmSync(dir,{recursive:true,force:true}));
|
|
// No skip/fallback: this Linux test requires unprivileged user/PID/mount
|
|
// namespaces. --kill-child also removes our namespace if the probe times out.
|
|
const outer=spawnSync('/usr/bin/unshare',[
|
|
'--user','--map-root-user','--pid','--fork','--kill-child=KILL','--mount-proc',
|
|
process.execPath,probe,fileURLToPath(new URL(`../../../scripts/${name}`,import.meta.url)),dir,
|
|
],{
|
|
encoding:'utf8',timeout:15000,killSignal:'SIGKILL',
|
|
});
|
|
const prerequisite='requires /usr/bin/unshare and unprivileged user/PID/mount namespaces (check kernel/AppArmor/container seccomp)';
|
|
assert.equal(outer.error,undefined,`${prerequisite}: ${outer.error?.message}`);
|
|
assert.equal(outer.status,0,`${prerequisite}; probe output:\n${outer.stdout}${outer.stderr}`);
|
|
assert.equal(outer.stderr,'');
|
|
const result=JSON.parse(outer.stdout);
|
|
assert.equal(result.error,undefined,result.error);
|
|
assert.equal(result.signal,null,result.stderr);
|
|
assert.equal(result.status,81,result.stderr);
|
|
assert.equal(result.stdout,'');
|
|
assert.equal(result.stderr,'');
|
|
const pairs=result.pairs;
|
|
assert.equal(pairs.length,2,'the command and its live descendant both started');
|
|
assert.notEqual(pairs[0][0],pairs[0][1],'the trusted parent leads the command session');
|
|
assert.notEqual(pairs[1][0],pairs[0][0]);
|
|
assert.equal(pairs[1][1],pairs[0][1],'the descendant belongs to the supervised session');
|
|
assert.deepEqual(result.live,[],'cleanup must kill the whole process tree before namespace teardown');
|
|
// A positive centisecond pair relies on clean_session's current mandatory
|
|
// 0.01s retry sleep. Revisit this measurement if shipped cleanup removes it;
|
|
// keep the shared inner-timer parser strict in the meantime.
|
|
const seconds=readProbeSeconds(result.clock);
|
|
t.diagnostic(`${name}: cleanup ${seconds}s; limit ${CLEANUP_LIMIT_SECONDS}s`);
|
|
assert.ok(seconds<CLEANUP_LIMIT_SECONDS,`${name}: cleanup ${seconds}s must be < ${CLEANUP_LIMIT_SECONDS}s`);
|
|
});
|