nordisk/holger

scripts/heimdall-kernel-tests.sh

#!/bin/sh
# SPDX-License-Identifier: AGPL-3.0-only
# Holger's jobs under Heimdall's protected runner on a real kernel (lane HOL-HEIMDALL-02):
# the #[ignore]d tests of server/scan-worker/tests/jobs_under_heimdall.rs.
#
# They need user namespaces, Landlock, seccomp and cgroup v2 with memory, pids and cpu
# delegated. Like heimdall's scripts/container-tests.sh, this runs them in a privileged
# rootless podman container, moves itself out of the container's root cgroup so the
# controllers can be enabled for the job cgroups, builds the shim from crates.io
# (nordisk-heimdall-container 0.2.1 --features youki, libseccomp-dev) and the static worker
# (musl), then runs the tests.
#
# Usage, from the repository root on a Linux host with podman:
#   scripts/heimdall-kernel-tests.sh
# Environment:
#   HOLGER_HEIMDALL_TEST_IMAGE  toolchain image with libseccomp-dev and the musl target
#                               (default localhost/nordisk-cargo-toolchain:heim-m0)
#   CARGO_TARGET_DIR            host target dir to mount (default ./target)
#   CARGO_REGISTRY              host cargo registry to mount (optional)
#   HOLGER_HEIMDALL_TEST_ARGS   extra arguments after `--`
#   HOLGER_HEIMDALL_STRACE      a host file: the shim's and the jobs' syscalls (strace -f) go there
#   HOLGER_HEIMDALL_TEST_SKIP   tests to leave out (`--skip <name>`); none by default
#   HOLGER_HEIMDALL_SHIM        a host file: this shim instead of one built here (the medium's
#                               static one, scripts/heimdall-shim-static.sh)
set -eu
cd "$(dirname "$0")/.."

if [ "${HOLGER_HEIMDALL_INNER:-}" != 1 ]; then
  img=${HOLGER_HEIMDALL_TEST_IMAGE:-localhost/nordisk-cargo-toolchain:heim-m0}
  tgt=${CARGO_TARGET_DIR:-$PWD/target}
  mkdir -p "$tgt"
  extra=""
  if [ -n "${CARGO_REGISTRY:-}" ]; then extra="-v $CARGO_REGISTRY:/usr/local/cargo/registry"; fi
  if [ -n "${HOLGER_HEIMDALL_STRACE:-}" ]; then
    touch "$HOLGER_HEIMDALL_STRACE"
    extra="$extra -v $HOLGER_HEIMDALL_STRACE:/strace.out -e HOLGER_HEIMDALL_STRACE=/strace.out"
  fi
  if [ -n "${HOLGER_HEIMDALL_SHIM:-}" ]; then
    extra="$extra -v $HOLGER_HEIMDALL_SHIM:/given-shim:ro -e HOLGER_HEIMDALL_SHIM=/given-shim"
  fi
  # shellcheck disable=SC2086
  exec podman run --rm --privileged --cgroupns=private \
    -v "$PWD":/src -v "$tgt":/tgt -e CARGO_TARGET_DIR=/tgt $extra \
    -e HOLGER_HEIMDALL_INNER=1 -e HOLGER_HEIMDALL_TEST_ARGS="${HOLGER_HEIMDALL_TEST_ARGS:-}" \
    -e HOLGER_HEIMDALL_TEST_SKIP="${HOLGER_HEIMDALL_TEST_SKIP:-}" \
    -e CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-16}" \
    -w /src "$img" scripts/heimdall-kernel-tests.sh
fi

cg=/sys/fs/cgroup
if [ ! -w "$cg/cgroup.subtree_control" ]; then
  echo "cgroup v2 is not writable here (need --privileged and cgroup v2)" >&2
  exit 2
fi
mkdir -p "$cg/init"
for p in $(cat "$cg/cgroup.procs"); do echo "$p" > "$cg/init/cgroup.procs" 2>/dev/null || true; done
for c in cpu memory pids; do
  grep -qw "$c" "$cg/cgroup.controllers" || { echo "controller $c is not delegated here" >&2; exit 2; }
  echo "+$c" > "$cg/cgroup.subtree_control"
done
grep -qw io "$cg/cgroup.controllers" && echo "+io" > "$cg/cgroup.subtree_control"
echo "controllers enabled: $(cat "$cg/cgroup.subtree_control")"

shim_root=$CARGO_TARGET_DIR/heimdall-shim
if [ -n "${HOLGER_HEIMDALL_SHIM:-}" ]; then
  mkdir -p "$shim_root/bin" && cp "$HOLGER_HEIMDALL_SHIM" "$shim_root/bin/heimdall-container-shim"
else
  cargo install --locked --quiet --root "$shim_root" nordisk-heimdall-container --version =0.2.1 \
    --features youki --bin heimdall-container-shim
fi
cargo build --release --locked -p holger-scan-worker --target x86_64-unknown-linux-musl
shim=$shim_root/bin/heimdall-container-shim
if [ -n "${HOLGER_HEIMDALL_STRACE:-}" ]; then
  command -v strace >/dev/null || { apt-get update -qq && apt-get install -y -qq strace >/dev/null; }
  printf '#!/bin/sh\nexec strace -f -qq -o %s.$$ %s "$@"\n' "$HOLGER_HEIMDALL_STRACE" "$shim_root/bin/heimdall-container-shim" > "$shim_root/bin/shim-traced"
  chmod +x "$shim_root/bin/shim-traced"
  shim=$shim_root/bin/shim-traced
fi
# shellcheck disable=SC2086
HEIMDALL_CONTAINER_SHIM=$shim \
HOLGER_SCAN_WORKER_STATIC=$CARGO_TARGET_DIR/x86_64-unknown-linux-musl/release/holger-scan-worker \
  cargo test --locked -p holger-scan-worker --test jobs_under_heimdall -- --ignored --test-threads=2 \
    ${HOLGER_HEIMDALL_TEST_SKIP:-} ${HOLGER_HEIMDALL_TEST_ARGS:-}
if [ -n "${HOLGER_HEIMDALL_STRACE:-}" ]; then
  cat "$HOLGER_HEIMDALL_STRACE".* > "$HOLGER_HEIMDALL_STRACE" 2>/dev/null || true
fi