admin
844f19f11e
gates / gates (push) Successful in 31s
On a box whose guest has one data volume the two built-in fill targets, "/" (the controller's overlay on the Docker data volume) and /mnt/sys_drive, are one filesystem. The target list was de-duplicated by path only, so one fill would send two warnings under two names. fillTargets now keeps one target per filesystem; the first stays (app area, system area, drives). The identity is system.FilesystemKey, not st_dev alone: inside the container "/" is an overlay with its own device number, so an overlay path takes the device of a Docker-kept file on the data-root (/etc/hostname, /etc/hosts, /etc/resolv.conf). Measured read-only on demo-hp 9201/9202 and the N100 on 2026-11-10. Tests: TestR1371_* (3), TestFilesystemKey_* (2). Red seen three times. No version, no image, no floor: it waits for a release session. Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
77 lines
2.9 KiB
Go
77 lines
2.9 KiB
Go
package system
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"runtime"
|
|
"testing"
|
|
)
|
|
|
|
// R-1371 — the rule, with the numbers measured on demo-hp's guest 9201 (fskey.go).
|
|
func TestFilesystemKey_AnOverlayRootIsTheDockerDataRoot(t *testing.T) {
|
|
devs := map[string]uint64{"/": 139, "/mnt/sys_drive": 64519, "/etc/hostname": 64519, "/etc/hosts": 64519, "/opt/docker/stacks": 64518}
|
|
ovl := map[string]bool{"/": true}
|
|
dev := func(p string) (uint64, bool) { d, ok := devs[p]; return d, ok }
|
|
overlay := func(p string) (bool, bool) {
|
|
if _, ok := devs[p]; !ok {
|
|
return false, false
|
|
}
|
|
return ovl[p], true
|
|
}
|
|
key := func(p string) (uint64, bool) { return filesystemKeyWith(p, dev, overlay, dockerDataRootAnchors) }
|
|
|
|
root, ok1 := key("/")
|
|
sys, ok2 := key("/mnt/sys_drive")
|
|
if !ok1 || !ok2 || root != sys {
|
|
t.Fatalf("/ (%d,%v) and /mnt/sys_drive (%d,%v) are ONE filesystem on every box measured — the keys must be equal", root, ok1, sys, ok2)
|
|
}
|
|
if stacks, ok := key("/opt/docker/stacks"); !ok || stacks == root {
|
|
t.Fatalf("/opt/docker/stacks (%d,%v) is another filesystem — its key must differ from %d", stacks, ok, root)
|
|
}
|
|
if _, ok := key("/mnt/not-mounted"); ok {
|
|
t.Fatal("an unreadable path must have no key")
|
|
}
|
|
if _, ok := key(""); ok {
|
|
t.Fatal("an empty path must have no key")
|
|
}
|
|
|
|
// No anchor readable → NO key (never the overlay's own number, which would look like a filesystem of its own
|
|
// only by luck, and never a guess).
|
|
if k, ok := filesystemKeyWith("/", dev, overlay, []string{"/etc/absent"}); ok {
|
|
t.Fatalf("an overlay with no readable anchor got key %d — want no key", k)
|
|
}
|
|
// An anchor that is itself on the overlay (not bind-mounted) names nothing; the next one is used.
|
|
devs["/etc/plain"] = 139
|
|
ovl["/etc/plain"] = true
|
|
if k, ok := filesystemKeyWith("/", dev, overlay, []string{"/etc/plain", "/etc/hosts"}); !ok || k != 64519 {
|
|
t.Fatalf("key = %d,%v — want the first anchor that is NOT on the overlay (64519)", k, ok)
|
|
}
|
|
}
|
|
|
|
// The real system calls: two paths on one filesystem share a key, a path on another filesystem does not, and an
|
|
// absent path has none. Runs on the machine's real filesystems (and, in a container, through the overlay branch).
|
|
func TestFilesystemKey_RealSyscalls(t *testing.T) {
|
|
if runtime.GOOS != "linux" {
|
|
t.Skip("the identity is Linux-only")
|
|
}
|
|
dir := t.TempDir()
|
|
sub := filepath.Join(dir, "sub")
|
|
if err := os.Mkdir(sub, 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
a, okA := FilesystemKey(dir)
|
|
b, okB := FilesystemKey(sub)
|
|
if !okA || !okB || a != b {
|
|
t.Fatalf("a folder (%d,%v) and its sub-folder (%d,%v) must share a key", a, okA, b, okB)
|
|
}
|
|
if p, ok := FilesystemKey("/proc"); !ok || p == a {
|
|
t.Fatalf("/proc (%d,%v) is another filesystem than %s (%d)", p, ok, dir, a)
|
|
}
|
|
if k, ok := FilesystemKey(filepath.Join(dir, "absent")); ok {
|
|
t.Fatalf("an absent path got key %d", k)
|
|
}
|
|
if ov, ok := isOverlayFS("/proc"); !ok || ov {
|
|
t.Fatalf("/proc read as overlay=%v ok=%v", ov, ok)
|
|
}
|
|
}
|