Publish curated Unraid-AppOps-Gateway source from b619192999975e4ac44b14e43df48ae75bd745b2

backend/tests/test_runner_fleet_specialize.py

@@ -285,8 +285,12 @@ def test_source_image_archive_is_verified_and_same_fd_pinned_before_any_load(
             replacement.chmod(0o600)
             replacement.replace(archive)
         elif fault == "changed_fd":
+            before = archive.stat()
             with archive.open("r+b") as writer:
                 writer.write(b"X")
+            # This case tests metadata drift. Two fast writes can share the
+            # filesystem's timestamp tick, so make that injected drift explicit.
+            os.utime(archive, ns=(before.st_atime_ns, before.st_mtime_ns + 1_000_000_000))
         return SimpleNamespace(returncode=0)
 
     verified = []
@@ -389,6 +393,8 @@ def _build_probe_inspect(specialize, record, *, container_id=None, changes=None)
             "CapAdd": [],
             "CapDrop": [],
             "SecurityOpt": ["seccomp=unconfined", "systempaths=unconfined"],
+            "MaskedPaths": [],
+            "ReadonlyPaths": [],
             "Devices": [{
                 "PathOnHost": "/dev/net/tun",
                 "PathInContainer": "/dev/net/tun",
@@ -2995,7 +3001,7 @@ def test_build_probe_container_inspect_accepts_only_fixed_private_build_job(spec
             {"PathOnHost": "/dev/sda", "PathInContainer": "/dev/sda", "CgroupPermissions": "rwm"},
         ]}),
         ("HostConfig", {"Mounts": [{"Type": "bind", "Source": "/host", "Target": "/host"}]}),
-        ("HostConfig", {"SecurityOpt": ["seccomp=unconfined"]}),
+        ("HostConfig", {"SecurityOpt": ["seccomp=unconfined"], "MaskedPaths": ["/proc/kcore"]}),
         ("Config", {"Env": [*environment, "DOCKER_HOST=tcp://shared-dind:2375"]}),
         ("Config", {"Image": "localhost/itworx-ci-build:latest"}),
     ):
@@ -3020,6 +3026,29 @@ def test_build_probe_rejects_foreign_or_shared_data_mount(specialize, field, val
     assert not specialize._validate_build_probe_container(item, record, image_environment=environment)
 
 
+@pytest.mark.parametrize("security_options", [
+    ["seccomp=unconfined"],
+    ["seccomp=unconfined", "systempaths=unconfined"],
+])
+def test_build_probe_accepts_only_verified_effective_unconfined_system_paths(specialize, security_options):
+    record = _build_probe_record(specialize, container_id="e" * 64, status="created")
+    item, environment = _build_probe_inspect(specialize, record)
+    item["HostConfig"]["SecurityOpt"] = security_options
+    assert specialize._validate_build_probe_container(item, record, image_environment=environment)
+    for field in ("MaskedPaths", "ReadonlyPaths"):
+        for value in (None, ["/proc/kcore"], "", {}):
+            changed = copy.deepcopy(item)
+            changed["HostConfig"][field] = value
+            assert not specialize._validate_build_probe_container(changed, record, image_environment=environment)
+        missing = copy.deepcopy(item)
+        del missing["HostConfig"][field]
+        assert not specialize._validate_build_probe_container(missing, record, image_environment=environment)
+    for options in (None, [], ["systempaths=unconfined"], ["seccomp=unconfined", "apparmor=unconfined"]):
+        changed = copy.deepcopy(item)
+        changed["HostConfig"]["SecurityOpt"] = options
+        assert not specialize._validate_build_probe_container(changed, record, image_environment=environment)
+
+
 def test_build_probe_volume_identity_detects_same_name_recreation(specialize, monkeypatch):
     name = "9" * 64
     volume = {