sandboxing/src/landlock_tests.rs
95 lines
use super::*;use pretty_assertions::assert_eq;#[test]fn legacy_landlock_flag_is_included_when_requested() { let command = vec!["/bin/true".to_string()]; let command_cwd = Path::new("/tmp/link"); let cwd = Path::new("/tmp"); let default_bwrap = create_linux_sandbox_command_args( command.clone(), command_cwd, cwd, /*use_legacy_landlock*/ false, /*allow_network_for_proxy*/ false, ); assert_eq!( default_bwrap.contains(&"--use-legacy-landlock".to_string()), false ); let legacy_landlock = create_linux_sandbox_command_args( command, command_cwd, cwd, /*use_legacy_landlock*/ true, /*allow_network_for_proxy*/ false, ); assert_eq!( legacy_landlock.contains(&"--use-legacy-landlock".to_string()), true );}#[test]fn proxy_flag_takes_precedence_over_legacy_landlock() { let command = vec!["/bin/true".to_string()]; let command_cwd = Path::new("/tmp/link"); let cwd = Path::new("/tmp"); let permission_profile = PermissionProfile::read_only(); let args = create_linux_sandbox_command_args_for_permission_profile( command, command_cwd, &permission_profile, cwd, /*use_legacy_landlock*/ true, /*allow_network_for_proxy*/ true, ); assert_eq!( args.contains(&"--allow-network-for-proxy".to_string()), true ); assert_eq!(args.contains(&"--use-legacy-landlock".to_string()), false);}#[test]fn permission_profile_flag_is_included() { let command = vec!["/bin/true".to_string()]; let command_cwd = Path::new("/tmp/link"); let cwd = Path::new("/tmp"); let permission_profile = PermissionProfile::read_only(); let args = create_linux_sandbox_command_args_for_permission_profile( command, command_cwd, &permission_profile, cwd, /*use_legacy_landlock*/ true, /*allow_network_for_proxy*/ false, ); assert_eq!( args.windows(2) .any(|window| { window[0] == "--permission-profile" && !window[1].is_empty() }), true ); assert_eq!( args.windows(2) .any(|window| window[0] == "--command-cwd" && window[1] == "/tmp/link"), true );}#[test]fn proxy_network_requires_managed_requirements() { assert_eq!( allow_network_for_proxy(/*enforce_managed_network*/ false), false ); assert_eq!( allow_network_for_proxy(/*enforce_managed_network*/ true), true );}