Explore worker confinement adding dedicate module by d3flex · Pull Request #276 · os-autoinst/os-autoinst-distri-openQA

d3flex · 2026-03-30T13:39:37Z

Provide a set of scripts which explore the confined capabilities of the workers. There are two main approaches: using the test API to read/write from within the SUT and the Host level operations using system().

RFD: os-autoinst/openQA#7127

Issue: https://progress.opensuse.org/issues/194717

d3flex · 2026-03-30T13:41:40Z

confined

unconfined

okurz · 2026-03-30T19:28:27Z

+    script_run 'cat /etc/shadow';
+    eval { upload_logs '/etc/shadow' };
+    if ($@) {
+        record_info('upload-shadows', $@ , result=>'softfail');
+    }
+    else {
+        record_info('upload-shadows', 'uploaded /etc/shadows to WebUI');
+    }


Why not just

Suggested change

script_run 'cat /etc/shadow';

eval { upload_logs '/etc/shadow' };

if ($@) {

record_info('upload-shadows', $@ , result=>'softfail');

}

else {

record_info('upload-shadows', 'uploaded /etc/shadows to WebUI');

}

assert_script_run 'cat /etc/shadow';

upload_logs '/etc/shadow';

The module is just informative in most cases.the record_info will tell when the process is interrupted or completed. assert_script_run will make it fail at that point.

Then just call enter_cmd, ignore failures and let the test continue. No need to do all those error handling branches then

Martchus

I find it interesting that you've chosen to explore this as an openQA tests. This surely seems like a lot of work just for exploring.

Note that it is not forbidden to use signatures, Mojo::File and other "modern" features/libraries just because it is test code.

Is autodie enabled in test modules? If not you should do error handling after calls like system and open consistently. If autodie is enabled you should avoid explicit error handling consistently.

Martchus

I guess this is generally useful. If we proceed with the confinement tickets we can also schedule such a test job to test other ways of confinement.

The upfront comments could a bit more concise and should include an example command for how to schedule a job using this test module.

You could also split the run function and the length upfront comment so you end up with e.g. _test_sut_operations and _test_host_operations that both have their individual pod documentation.

Martchus · 2026-04-02T12:46:47Z

+        system('rmdir /etc/systemd/system/worker-probe.d 2>/dev/null');
+    }
+    else {
+        record_info('ETC-WRITE', 'UNCONFINED: wrote to host /etc/systemd/system/', result=>'fail');


To be able to merge this it would be good to tidy up, e.g.:

Suggested change

record_info('ETC-WRITE', 'UNCONFINED: wrote to host /etc/systemd/system/', result=>'fail');

record_info('ETC-WRITE', 'UNCONFINED: wrote to host /etc/systemd/system/', result => 'fail');

Martchus · 2026-04-02T12:49:21Z

+        record_info('CACHE-ACCESS', "Cache directory accessible: $cachedir", result => 'softfail');
+    }
+    else {
+        record_info('CACHE-ACCESS', "Cache directory not accessible ($!): $cachedir");


This directory probably has to be accessible - at least read-only. So this should probably be a failure and the record_info above just an info (at least if caching is enabled).

Martchus · 2026-04-02T12:51:03Z

+}
+
+sub test_flags ($self) {
+    #do not abort the run


This comment is useless without further explanation so I'd just remove it.

Martchus · 2026-04-02T12:51:58Z

+use testapi;
+
+# Summary: Run and Verify workers' confinement
+# First stage runs openrations on worker VM


Suggested change

# First stage runs openrations on worker VM

# First stage runs operations on the SUT

Martchus · 2026-04-02T12:52:31Z

+sub run ($self) {
+    # select_console 'root-console';
+    send_key('ctrl-alt-f3');
+    record_info('VM-level', 'exercise API commands inside Vm');


Suggested change

record_info('VM-level', 'exercise API commands inside Vm');

record_info('VM-level', 'exercise API commands inside VM');

Martchus · 2026-04-02T12:55:18Z

+# First stage runs openrations on worker VM
+# - Read the shadow password file
+# - Read sudoers configuration
+# - exposes secrets passed at boot
+# - various operations


What is the point of this first stage? All of these operations are pretty standard and supposed to be possible. Of course it can't hurt to do a few operations within the VM to see that it basically still works (despite the confinement).

Martchus · 2026-04-02T12:55:37Z

+# - exposes secrets passed at boot
+# - various operations
+#
+# Second stage runs Host-level operations


Suggested change

# Second stage runs Host-level operations

# Second stage runs host-level operations

Martchus · 2026-04-02T12:56:38Z

+# verify the cache directory is readable — ReadWritePaths must include it for the cache service to work
+# try to write to the cache directory — should be blocked when ReadOnlyPaths is active
+# verify this worker slot cannot read another slot's pool directory
+# can we read a sensitive host file from Perl?
+# can we read another process /proc/<pid>/environ on the host? 


These should also be bullet points.

Martchus · 2026-04-02T12:57:09Z

+# Second stage runs Host-level operations
+# - write to host /etc.
+# - write to the worker's own home directory.
+# verify the cache directory is readable — ReadWritePaths must include it for the cache service to work


Suggested change

# verify the cache directory is readable — ReadWritePaths must include it for the cache service to work

# verify the cache directory is readable — ReadOnlyPaths must include it for the cache service to work

Provide a set of scripts which explore the confined capabilities of the workers. There are two main approaches: using the test API to read/write from within the SUT and the Host level operations using system(). RFD: os-autoinst/openQA#7127 Issue: https://progress.opensuse.org/issues/194717 Signed-off-by: Ioannis Bonatakis <ybonatakis@suse.com>

okurz requested changes Mar 30, 2026

View reviewed changes

Martchus reviewed Mar 31, 2026

View reviewed changes

d3flex force-pushed the feat/worker_confined_test branch 4 times, most recently from 8532621 to 34ceadc Compare April 2, 2026 12:39

Martchus reviewed Apr 2, 2026

View reviewed changes

d3flex force-pushed the feat/worker_confined_test branch from 34ceadc to c962a1e Compare April 2, 2026 13:06

d3flex force-pushed the feat/worker_confined_test branch from c962a1e to 560f760 Compare April 6, 2026 17:58

	record_info('ETC-WRITE', 'UNCONFINED: wrote to host /etc/systemd/system/', result=>'fail');
	record_info('ETC-WRITE', 'UNCONFINED: wrote to host /etc/systemd/system/', result => 'fail');

	# First stage runs openrations on worker VM
	# First stage runs operations on the SUT

	record_info('VM-level', 'exercise API commands inside Vm');
	record_info('VM-level', 'exercise API commands inside VM');

	# Second stage runs Host-level operations
	# Second stage runs host-level operations

	# verify the cache directory is readable — ReadWritePaths must include it for the cache service to work
	# verify the cache directory is readable — ReadOnlyPaths must include it for the cache service to work

Uh oh!

Conversation

d3flex commented Mar 30, 2026

Uh oh!

d3flex commented Mar 30, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Martchus left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Martchus left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Martchus left a comment •

edited

Loading