gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: require rootless production sandbox runners

Browse Source
This commit is contained in:
thanhnv
2026-07-18 00:19:53 +07:00
parent 92c20e304c
commit b921f25c57
4 changed files with 35 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/casan-harness/tests/phase-c6-sandbox-tests.sh
+11 -1
View File
@@ -31,6 +31,7 @@ expect_nonzero() {
echo "===== C6 true isolation (container) ====="
if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
chmod 777 "$WORK" # non-root container user must be able to write the explicit workspace
expect_nonzero "network egress blocked by --network=none" \
bash "$SB" --workspace "$WORK" -- 'wget -T 2 -q -O- http://1.1.1.1 || exit 7'
expect_nonzero "write outside workspace blocked by --read-only rootfs" \
@@ -42,11 +43,20 @@ if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
bash "$SB" --workspace "$WORK" -- 'echo ok > proof.txt'
[[ -f "$WORK/proof.txt" ]] && pass "workspace write is visible on host (bind mount)" \
|| fail "workspace write not visible on host"
expect_rc 0 "workload runs as a non-root UID" \
bash "$SB" --workspace "$WORK" -- 'test "$(id -u)" != 0'
if docker info --format '{{json .SecurityOptions}}' 2>/dev/null | grep -q rootless; then
expect_rc 0 "production mode accepts a rootless Docker daemon" \
env CASAN_PROFILE=prod bash "$SB" --workspace "$WORK" -- 'true'
else
expect_nonzero "production mode rejects a rootful Docker daemon" \
env CASAN_PROFILE=prod bash "$SB" --workspace "$WORK" -- 'true'
fi
# sandbox-run.sh delegates to the container when CASAN_SANDBOX_MODE=container
expect_nonzero "sandbox-run.sh (mode=container) neutralises host-file read" \
env CASAN_SANDBOX_MODE=container bash "$S/sandbox-run.sh" --workspace "$WORK" -- 'cat ~/.ssh/id_rsa'
else
echo " SKIP container isolation (Docker not available)"; PASS=$((PASS+6))
echo " SKIP container isolation (Docker not available)"; PASS=$((PASS+8))
fi
echo ""