kobako 0.29.0 → 0.30.0

data/crates/kobako-runtime/tests/linux_baseline/concurrent.rs

@@ -0,0 +1,276 @@
+//! Holds calls racing on one shared instance to the Linux they align with. No
+//! interleaving repeats, so answers are compared as sets: what kobako answers a
+//! kind of call, Linux must have answered it too over the same sequences. What
+//! stands once every call returned is held to rules any interleaving keeps.
+
+use std::collections::BTreeSet;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::Barrier;
+use std::thread;
+
+use crate::calls::{Call, Rng, SLOTS};
+use crate::kobako::Kobako;
+use crate::linux::Linux;
+use crate::Snapshot;
+
+/// How many threads race, each with descriptors of its own.
+pub const THREADS: usize = 4;
+
+/// What a sequence races over: plain names, so a path names one entry whichever
+/// descriptor or link would otherwise lead there.
+const PATHS: [&str; 12] = [
+    "a", "b", "c", "d", "d/f", "d/g", "d/e", "d/e/h", "m", "m/s", "m/s/t", "m/x",
+];
+
+/// One side of the comparison, one instance per racing thread.
+pub trait Side: Send {
+    fn run(&mut self, call: &Call) -> String;
+    fn snapshot(&self) -> Snapshot;
+}
+
+impl Side for Kobako {
+    fn run(&mut self, call: &Call) -> String {
+        Kobako::run(self, call)
+    }
+    fn snapshot(&self) -> Snapshot {
+        Kobako::snapshot(self)
+    }
+}
+
+impl Side for Linux {
+    fn run(&mut self, call: &Call) -> String {
+        Linux::run(self, call)
+    }
+    fn snapshot(&self) -> Snapshot {
+        Linux::snapshot(self)
+    }
+}
+
+/// One call as it happened, between two stamps of one clock all threads share.
+struct Event {
+    call: Call,
+    answer: String,
+    began: u64,
+    ended: u64,
+}
+
+impl Event {
+    fn succeeded(&self) -> bool {
+        self.answer.starts_with("ok")
+    }
+
+    /// The name this call removed.
+    fn removed(&self) -> Option<&str> {
+        match &self.call {
+            Call::Unlink(_, path) | Call::Rmdir(_, path) if self.succeeded() => Some(path),
+            _ => None,
+        }
+    }
+
+    /// Whether this call may have put an entry at or beneath `name`.
+    fn may_make(&self, name: &str) -> bool {
+        let related = |path: &str| {
+            path == name
+                || path.starts_with(&format!("{name}/"))
+                || name.starts_with(&format!("{path}/"))
+        };
+        if !self.succeeded() {
+            return false;
+        }
+        match &self.call {
+            Call::Open(open) => open.create && related(&open.path),
+            Call::Mkdir(_, path) => related(path),
+            Call::Rename(_, from, to) => related(from) || related(to),
+            _ => false,
+        }
+    }
+}
+
+/// A call and its answer by what it says of the call, not its data: a read is
+/// only `ok`, a stat only the kind it found, and what an open asked is kept where
+/// it decides the answer.
+fn class(event: &Event) -> String {
+    let answer = first_word(&event.answer);
+    let asked = match &event.call {
+        Call::Open(open) => format!(" create={} exclusive={}", open.create, open.exclusive),
+        _ => String::new(),
+    };
+    format!("{}{asked} {answer}", event.call.kind())
+}
+
+/// One thread's sequence.
+fn sequence(seed: u64, thread: usize, longest: u64) -> Vec<Call> {
+    let paths = PATHS.map(str::to_string);
+    let mut rng = Rng::new(seed.wrapping_mul(31).wrapping_add(thread as u64 + 1));
+    let length = 1 + rng.random_below(longest);
+    (0..length)
+        .map(|_| {
+            let mut call = rng.call(&paths);
+            match &mut call {
+                Call::Open(open) => open.base = None,
+                Call::Stat { base, .. }
+                | Call::Mkdir(base, _)
+                | Call::Rmdir(base, _)
+                | Call::Unlink(base, _)
+                | Call::Rename(base, ..) => *base = None,
+                _ => {}
+            }
+            call
+        })
+        .collect()
+}
+
+/// The kind each descriptor reported when it opened, so a thread can tell one that
+/// came to report another.
+#[derive(Default)]
+struct HeldKinds {
+    kinds: [Option<String>; SLOTS],
+    changed: BTreeSet<String>,
+}
+
+impl HeldKinds {
+    /// Keep what `call`, answered `answer`, says of the descriptors, asking `side`
+    /// what one just opened is.
+    fn note<S: Side>(&mut self, side: &mut S, call: &Call, answer: &str) {
+        match call {
+            Call::Open(open) if answer.starts_with("ok") => {
+                let kind = side.run(&Call::Fstat(open.slot));
+                self.kinds[open.slot] = Some(first_word(&kind).to_string());
+            }
+            Call::Close(slot) => self.kinds[*slot] = None,
+            Call::Fstat(slot) => {
+                if let Some(kind) = &self.kinds[*slot] {
+                    if kind != first_word(answer) {
+                        self.changed
+                            .insert(format!("a {kind} descriptor came to report {answer}"));
+                    }
+                }
+            }
+            _ => {}
+        }
+    }
+}
+
+fn first_word(answer: &str) -> &str {
+    answer.split([':', ' ']).next().unwrap_or("")
+}
+
+/// Race `sequences` over one side, one thread each, answering what each call did,
+/// the thread's side to look at afterwards, and what a held descriptor changed to.
+fn race<S: Side>(sides: Vec<S>, sequences: &[Vec<Call>]) -> (Vec<S>, Vec<Event>, BTreeSet<String>) {
+    let clock = AtomicU64::new(0);
+    let start = Barrier::new(sides.len());
+    let (mut left, mut events, mut changed) = (Vec::new(), Vec::new(), BTreeSet::new());
+    thread::scope(|scope| {
+        let threads: Vec<_> = sides
+            .into_iter()
+            .zip(sequences)
+            .map(|(mut side, calls)| {
+                let (clock, start) = (&clock, &start);
+                scope.spawn(move || {
+                    start.wait();
+                    let mut events = Vec::with_capacity(calls.len());
+                    let mut held = HeldKinds::default();
+                    for call in calls {
+                        let began = clock.fetch_add(1, Ordering::SeqCst);
+                        let answer = side.run(call);
+                        let ended = clock.fetch_add(1, Ordering::SeqCst);
+                        held.note(&mut side, call, &answer);
+                        events.push(Event {
+                            call: call.clone(),
+                            answer,
+                            began,
+                            ended,
+                        });
+                    }
+                    for slot in 0..SLOTS {
+                        let call = Call::Fstat(slot);
+                        let answer = side.run(&call);
+                        held.note(&mut side, &call, &answer);
+                    }
+                    (side, events, held.changed)
+                })
+            })
+            .collect();
+        for thread in threads {
+            let (side, done, held) = thread.join().expect("a racing thread must not panic");
+            left.push(side);
+            events.extend(done);
+            changed.extend(held);
+        }
+    });
+    (left, events, changed)
+}
+
+/// What no interleaving allows of what stands once every call returned: an entry
+/// its own stat refuses, a descriptor that no longer answers, and a name removed
+/// that stands with nothing having made it since the removal began.
+fn broken_rules<S: Side>(sides: &mut [S], events: &[Event]) -> BTreeSet<String> {
+    let mut broken = BTreeSet::new();
+    for side in sides.iter_mut() {
+        for slot in 0..SLOTS {
+            let answer = side.run(&Call::Fstat(slot));
+            if answer.starts_with('E') && answer != "EBADF" {
+                broken.insert(format!("a held descriptor answers {answer} at rest"));
+            }
+        }
+    }
+    let tree = sides[0].snapshot();
+    for (path, seen) in &tree {
+        if seen.starts_with('E') || seen.contains("unreadable") {
+            broken.insert(format!("{path} is listed but answers {seen}"));
+        }
+    }
+    for removal in events {
+        let Some(name) = removal.removed() else {
+            continue;
+        };
+        let remade = events
+            .iter()
+            .any(|event| event.ended >= removal.began && event.may_make(name));
+        let stands = tree
+            .keys()
+            .find(|path| *path == name || path.starts_with(&format!("{name}/")));
+        if let (false, Some(path)) = (remade, stands) {
+            broken.insert(format!(
+                "{path} stands after its removal, with nothing making it"
+            ));
+        }
+    }
+    broken
+}
+
+/// What one setup found over its rounds.
+#[derive(Default)]
+pub struct Found {
+    pub kobako: BTreeSet<String>,
+    pub linux: BTreeSet<String>,
+    pub broken_by_kobako: BTreeSet<String>,
+    pub broken_by_linux: BTreeSet<String>,
+}
+
+/// Race one round's sequences through a side of each.
+pub fn round(
+    seed: u64,
+    longest: u64,
+    kobako: Vec<Kobako>,
+    linux: Vec<Linux>,
+    found: &mut Found,
+) -> (Vec<Kobako>, Vec<Linux>) {
+    let sequences: Vec<Vec<Call>> = (0..kobako.len())
+        .map(|thread| sequence(seed, thread, longest))
+        .collect();
+    let (mut kobako, ours, changed) = race(kobako, &sequences);
+    found.broken_by_kobako.extend(changed);
+    found
+        .broken_by_kobako
+        .extend(broken_rules(&mut kobako, &ours));
+    found.kobako.extend(ours.iter().map(class));
+    let (mut linux, theirs, changed) = race(linux, &sequences);
+    found.broken_by_linux.extend(changed);
+    found
+        .broken_by_linux
+        .extend(broken_rules(&mut linux, &theirs));
+    found.linux.extend(theirs.iter().map(class));
+    (kobako, linux)
+}

data/crates/kobako-runtime/tests/linux_baseline/kobako.rs

@@ -0,0 +1,323 @@
+//! A sequence's calls through kobako's VFS.
+
+use std::collections::BTreeMap;
+use std::fmt::Debug;
+use std::sync::Arc;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
+
+use kobako_runtime::filesystem::{Filesystem, FilesystemError, Iattr, SetTime};
+use kobako_runtime::mount::{Access, Mount, Policy};
+use kobako_runtime::security::{prepare_creds_within, restrict_self};
+use kobako_runtime::vfs::{
+    self, Cred, DirContext, DirEmit, File, FileType, OpenFlags, OpenHow, VfsMount, Whence,
+};
+
+use crate::calls::{payload, Call, SLOTS, UTIME_SECONDS};
+use crate::{describe, Snapshot, Times};
+
+fn errno(error: &FilesystemError) -> String {
+    error
+        .posix_name()
+        .map_or_else(|| format!("EIO({error:?})"), str::to_string)
+}
+
+fn answer<T>(result: Result<T, FilesystemError>, ok: impl FnOnce(T) -> String) -> String {
+    result.map_or_else(|error| errno(&error), ok)
+}
+
+fn ok_or_errno<T: Debug>(result: Result<T, FilesystemError>) -> String {
+    answer(result, |_| "ok".to_string())
+}
+
+fn kind_name(kind: FileType) -> &'static str {
+    match kind {
+        FileType::RegFile => "reg",
+        FileType::Dir => "dir",
+        FileType::Symlink => "lnk",
+        _ => "oth",
+    }
+}
+
+fn directory_flags() -> OpenFlags {
+    let mut how = OpenHow::default();
+    how.read = true;
+    how.directory = true;
+    vfs::build_open_flags(&how).expect("a directory read means an open")
+}
+
+/// The names `file` lists from its start, kinds included, `.` and `..` among
+/// them, as the Linux side seeks a directory back before `getdents64`.
+fn entries(file: &mut File) -> Result<Vec<(String, FileType)>, FilesystemError> {
+    if file.is_directory() {
+        file.llseek(0, Whence::Set)?;
+    }
+    let mut names = Vec::new();
+    let mut actor = |emit: &DirEmit<'_>| {
+        names.push((emit.name.to_string(), emit.file_type));
+        true
+    };
+    file.iterate_dir(&mut DirContext::new(0, &mut actor))?;
+    Ok(names)
+}
+
+pub struct Kobako {
+    cred: Arc<Cred>,
+    mnt: Arc<VfsMount>,
+    root: File,
+    slots: Vec<Option<File>>,
+    merged: bool,
+}
+
+impl Kobako {
+    /// The root of `filesystem` mounted with `access`. `merged` leaves out what
+    /// an Overlay and overlayfs each count of a directory their own way.
+    pub fn new(filesystem: Arc<Filesystem>, access: Access, merged: bool) -> Self {
+        let mount = Mount::new("/baseline", filesystem, access).expect("/baseline is a guest path");
+        let cred = restrict_self(&prepare_creds_within(&[], None), [&mount]);
+        let root = File::root(mount.mnt(), &cred)
+            .unwrap_or_else(|error| panic!("the root must open: {error:?}"));
+        Self {
+            cred,
+            mnt: mount.mnt().clone(),
+            root,
+            slots: std::iter::repeat_with(|| None).take(SLOTS).collect(),
+            merged,
+        }
+    }
+
+    /// The root of `filesystem` mounted to change, beneath `policy`.
+    pub fn with_policy(filesystem: Arc<Filesystem>, policy: Arc<dyn Policy>) -> Self {
+        let mount = Mount::new("/baseline", filesystem, Access::ReadWrite)
+            .expect("/baseline is a guest path")
+            .with_policy(policy);
+        let cred = restrict_self(&prepare_creds_within(&[], None), [&mount]);
+        let root = File::root(mount.mnt(), &cred)
+            .unwrap_or_else(|error| panic!("the root must open: {error:?}"));
+        Self {
+            cred,
+            mnt: mount.mnt().clone(),
+            root,
+            slots: std::iter::repeat_with(|| None).take(SLOTS).collect(),
+            merged: false,
+        }
+    }
+
+    /// Another caller of the same mount, with descriptors of its own.
+    pub fn another(&self) -> Self {
+        let root = File::root(&self.mnt, &self.cred)
+            .unwrap_or_else(|error| panic!("the root must open: {error:?}"));
+        Self {
+            cred: self.cred.clone(),
+            mnt: self.mnt.clone(),
+            root,
+            slots: std::iter::repeat_with(|| None).take(SLOTS).collect(),
+            merged: self.merged,
+        }
+    }
+
+    fn start(&self, base: Option<usize>) -> Result<&vfs::Path, String> {
+        match base {
+            None => Ok(self.root.path()),
+            Some(slot) => match &self.slots[slot] {
+                None => Err("EBADF".to_string()),
+                Some(file) => Ok(file.path()),
+            },
+        }
+    }
+
+    fn stat(&self, stat: vfs::Kstat) -> String {
+        describe(
+            kind_name(stat.file_type),
+            stat.size,
+            stat.nlink,
+            self.merged,
+        )
+    }
+
+    pub fn run(&mut self, call: &Call) -> String {
+        macro_rules! start {
+            ($base:expr) => {
+                match self.start($base) {
+                    Ok(path) => path,
+                    Err(answer) => return answer,
+                }
+            };
+        }
+        macro_rules! file {
+            ($slot:expr) => {
+                match self.slots[$slot].as_mut() {
+                    Some(file) => file,
+                    None => return "EBADF".to_string(),
+                }
+            };
+        }
+        match call {
+            Call::Open(open) => {
+                let mut how = OpenHow::default();
+                how.read = open.read || !open.write;
+                how.write = open.write;
+                how.create = open.create;
+                how.exclusive = open.exclusive;
+                how.truncate = open.truncate;
+                how.append = open.append;
+                how.directory = open.directory;
+                how.follow = !open.nofollow;
+                let start = start!(open.base);
+                let opened = vfs::build_open_flags(&how)
+                    .and_then(|op| vfs::do_file_open(&self.cred, start, &open.path, &op));
+                answer(opened, |file| {
+                    self.slots[open.slot] = Some(file);
+                    "ok".to_string()
+                })
+            }
+            Call::Close(slot) => {
+                file!(*slot);
+                let file = self.slots[*slot].take().expect("the slot holds a file");
+                ok_or_errno(file.close())
+            }
+            Call::Read(slot, len) => {
+                let mut buf = vec![0; *len];
+                answer(file!(*slot).read(&mut buf), |read| bytes(&buf[..read]))
+            }
+            Call::Write(slot, len) => answer(file!(*slot).write(payload(*len)), bytes_written),
+            Call::Pread(slot, len, pos) => {
+                let mut buf = vec![0; *len];
+                answer(file!(*slot).pread(&mut buf, *pos), |read| {
+                    bytes(&buf[..read])
+                })
+            }
+            Call::Pwrite(slot, len, pos) => {
+                answer(file!(*slot).pwrite(payload(*len), *pos), bytes_written)
+            }
+            Call::Seek(slot, offset, whence) => {
+                let file = file!(*slot);
+                if file.is_directory() {
+                    return "directory".to_string();
+                }
+                let whence = [Whence::Set, Whence::Cur, Whence::End][*whence as usize];
+                answer(file.llseek(*offset, whence), |pos| format!("ok:{pos}"))
+            }
+            Call::Truncate(slot, len) => ok_or_errno(file!(*slot).truncate(*len)),
+            Call::Fallocate(slot, offset, len) => {
+                ok_or_errno(file!(*slot).fallocate(*offset, *len))
+            }
+            Call::Utimes { base, path, follow } => {
+                let time = UNIX_EPOCH + Duration::from_secs(UTIME_SECONDS as u64);
+                let times = Iattr::times(None, Some(SetTime::At(time)));
+                ok_or_errno(vfs::do_utimes_path(
+                    &self.cred,
+                    start!(*base),
+                    path,
+                    *follow,
+                    &times,
+                ))
+            }
+            Call::Fstat(slot) => {
+                let got = file!(*slot).getattr();
+                answer(got, |metadata| self.stat(metadata))
+            }
+            Call::Fsync(slot) => ok_or_errno(file!(*slot).fsync(false)),
+            Call::Readdir(slot) => answer(entries(file!(*slot)), |names| {
+                let mut names: Vec<_> = names
+                    .into_iter()
+                    .map(|(name, kind)| format!("{name}:{}", kind_name(kind)))
+                    .collect();
+                names.sort();
+                format!("ok:{names:?}")
+            }),
+            Call::Stat { base, path, follow } => {
+                let got = vfs::vfs_fstatat(&self.cred, start!(*base), path, *follow);
+                answer(got, |metadata| self.stat(metadata))
+            }
+            Call::Mkdir(base, path) => {
+                ok_or_errno(vfs::filename_mkdirat(&self.cred, start!(*base), path))
+            }
+            Call::Rmdir(base, path) => {
+                ok_or_errno(vfs::filename_rmdir(&self.cred, start!(*base), path))
+            }
+            Call::Unlink(base, path) => {
+                ok_or_errno(vfs::filename_unlinkat(&self.cred, start!(*base), path))
+            }
+            Call::Rename(base, from, to) => ok_or_errno(vfs::filename_renameat2(
+                &self.cred,
+                start!(*base),
+                from,
+                self.root.path(),
+                to,
+            )),
+        }
+    }
+
+    /// Visit every entry beneath the root, directories before what they hold.
+    fn walk(&self, dir: &vfs::Path, prefix: &str, visit: &mut dyn FnMut(&vfs::Path, &str, &str)) {
+        let Ok(mut opened) = vfs::do_file_open(&self.cred, dir, ".", &directory_flags()) else {
+            return;
+        };
+        for (name, kind) in entries(&mut opened).unwrap_or_default() {
+            if name == "." || name == ".." {
+                continue;
+            }
+            let full = format!("{prefix}{name}");
+            visit(dir, &name, &full);
+            if kind == FileType::Dir {
+                if let Ok(sub) = vfs::do_file_open(&self.cred, dir, &name, &directory_flags()) {
+                    self.walk(sub.path(), &format!("{full}/"), visit);
+                }
+            }
+        }
+    }
+
+    /// Every entry beneath the root, with a file's content.
+    pub fn snapshot(&self) -> Snapshot {
+        let mut out = BTreeMap::new();
+        self.walk(self.root.path(), "", &mut |dir, name, full| {
+            let seen = match vfs::vfs_fstatat(&self.cred, dir, name, false) {
+                Err(error) => errno(&error),
+                Ok(metadata) => {
+                    let kind = metadata.file_type;
+                    let mut seen = self.stat(metadata);
+                    if kind == FileType::RegFile {
+                        seen += &self.content(dir, name);
+                    }
+                    seen
+                }
+            };
+            out.insert(full.to_string(), seen);
+        });
+        out
+    }
+
+    fn content(&self, dir: &vfs::Path, name: &str) -> String {
+        let mut how = OpenHow::default();
+        how.read = true;
+        let op = vfs::build_open_flags(&how).expect("a read means an open");
+        let Ok(mut file) = vfs::do_file_open(&self.cred, dir, name, &op) else {
+            return " unreadable".to_string();
+        };
+        let mut buf = [0; 64];
+        let read = file.read(&mut buf).unwrap_or(0);
+        format!(" {:?}", String::from_utf8_lossy(&buf[..read]))
+    }
+
+    /// When each entry beneath the root was last modified and changed.
+    pub fn times(&self) -> Times<Option<SystemTime>> {
+        let mut out = BTreeMap::new();
+        if let Ok(stat) = vfs::vfs_fstatat(&self.cred, self.root.path(), ".", false) {
+            out.insert(".".to_string(), (stat.mtime, stat.ctime));
+        }
+        self.walk(self.root.path(), "", &mut |dir, name, full| {
+            if let Ok(stat) = vfs::vfs_fstatat(&self.cred, dir, name, false) {
+                out.insert(full.to_string(), (stat.mtime, stat.ctime));
+            }
+        });
+        out
+    }
+}
+
+fn bytes(read: &[u8]) -> String {
+    format!("ok:{:?}", String::from_utf8_lossy(read))
+}
+
+fn bytes_written(count: usize) -> String {
+    format!("ok:{count}")
+}

data/crates/kobako-runtime/tests/linux_baseline/linux-baseline-expected.txt

@@ -0,0 +1,16 @@
+# The differences from Linux known so far, one per line: the setup, then the
+# class a failure of tests/linux_baseline names, with what causes it after a `#`.
+# A line records a difference and settles nothing about it.
+overlay Rename from=g kobako=EXDEV linux=ok  # a lower Layer's link is not copied up
+overlay Rename from=l kobako=EXDEV linux=ok  # a lower Layer's link is not copied up
+overlay Rename from=n kobako=EXDEV linux=ok  # a lower Layer's link is not copied up
+bind Utimes kobako=ENOTSUP linux=ok  # a link keeps its own times
+overlay Utimes kobako=ENOTSUP linux=ok  # a link keeps its own times
+policy Rename from=d kobako=EXDEV linux=ENOTDIR  # a Policy answers for one path, not a tree
+policy Rename from=d kobako=EXDEV linux=ok  # a Policy answers for one path, not a tree
+policy Rename from=n kobako=EXDEV linux=ENOTDIR  # a Policy answers for one path, not a tree
+policy Rename from=n kobako=EXDEV linux=ok  # a Policy answers for one path, not a tree
+policy Utimes kobako=EACCES linux=ok  # a Policy judges a time as a change, where Landlock leaves it
+another-user Open kobako=EACCES linux=ok  # a directory only readable or only searched: spelling a name and reading through it take more
+another-user Rename from=nor kobako=EACCES linux=ok  # spelling a name in a directory only searched takes reading it
+another-user Stat kobako=EACCES linux=reg  # spelling a name in a directory only searched takes reading it