28 lines
1.2 KiB
Python
28 lines
1.2 KiB
Python
|
"""Namespace guards must reject unsafe handoffs before any mount operation."""
|
||
|
|
import argparse
|
||
|
|
import unittest
|
||
|
|
from unittest.mock import patch
|
||
|
|
|
||
|
|
import linux_loader_smoke
|
||
|
|
|
||
|
|
|
||
|
|
class NamespaceGuardTests(unittest.TestCase):
|
||
|
|
def test_same_namespace_refuses_mount_before_runtime_access(self):
|
||
|
|
args = argparse.Namespace(outer_pid=123, outer_namespace=42)
|
||
|
|
with patch.object(linux_loader_smoke, "namespace", return_value=42), \
|
||
|
|
patch.object(linux_loader_smoke.subprocess, "run") as run:
|
||
|
|
with self.assertRaisesRegex(RuntimeError, "Private mount namespace"):
|
||
|
|
linux_loader_smoke.isolated_check(args, {"mount": "mount"})
|
||
|
|
run.assert_not_called()
|
||
|
|
|
||
|
|
def test_changed_outer_namespace_refuses_mount(self):
|
||
|
|
args = argparse.Namespace(outer_pid=123, outer_namespace=42)
|
||
|
|
with patch.object(linux_loader_smoke, "namespace", return_value=43), \
|
||
|
|
patch.object(linux_loader_smoke.subprocess, "run") as run:
|
||
|
|
with self.assertRaisesRegex(RuntimeError, "Private mount namespace"):
|
||
|
|
linux_loader_smoke.isolated_check(args, {"mount": "mount"})
|
||
|
|
run.assert_not_called()
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
unittest.main()
|