Skip to content

Commit 0c9dd8a

Browse files
pauldreikpauldreik
authored
add debian CI and fix running tests as root #170 
2 parents f86108b + 0a6b58b commit 0c9dd8a

File tree

5 files changed

+178
-34
lines changed

5 files changed

+178
-34
lines changed

‎.github/workflows/debian-bookworm.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: debian 12 bookworm
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- devel
8+
pull_request:
9+
10+
11+
jobs:
12+
container-test-job:
13+
runs-on: ubuntu-latest
14+
container:
15+
image: debian:bookworm-slim
16+
steps:
17+
- name: checkout
18+
uses: actions/checkout@v4
19+
- name: install packages
20+
run: apt-get update && apt-get install autoconf build-essential nettle-dev libcap2-bin --yes
21+
- name: bootstrap
22+
run: ./bootstrap.sh
23+
- name: configure
24+
run: ./configure --enable-warnings CXXFLAGS=-std=c++11
25+
- name: make
26+
run: make
27+
- name: make check
28+
run: make check
29+
- name: make distcheck
30+
run: make distcheck CXXFLAGS=-std=c++11
31+
- name: build with hardened build flags
32+
run: |
33+
make clean
34+
eval $(DEB_BUILD_MAINT_OPTIONS="hardening=+all qa=+all,-canary reproducible=+all" dpkg-buildflags --export=sh)
35+
./configure
36+
make
37+
make check
38+
- name: store the logs as an artifact
39+
if: ${{ always() }}
40+
uses: actions/upload-artifact@v4
41+
with:
42+
path: '**/*.log'

‎.github/workflows/debian-bullseye.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: debian 11 bullseye
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- devel
8+
pull_request:
9+
10+
11+
jobs:
12+
container-test-job:
13+
runs-on: ubuntu-latest
14+
container:
15+
image: debian:bullseye-slim
16+
steps:
17+
- name: checkout
18+
uses: actions/checkout@v4
19+
- name: install packages
20+
run: apt-get update && apt-get install autoconf build-essential nettle-dev libcap2-bin --yes
21+
- name: bootstrap
22+
run: ./bootstrap.sh
23+
- name: configure
24+
run: ./configure --enable-warnings CXXFLAGS=-std=c++11
25+
- name: make
26+
run: make
27+
- name: make check
28+
run: make check
29+
- name: make distcheck
30+
run: make distcheck CXXFLAGS=-std=c++11
31+
- name: build with hardened build flags
32+
run: |
33+
make clean
34+
eval $(DEB_BUILD_MAINT_OPTIONS="hardening=+all qa=+all,-canary reproducible=+all" dpkg-buildflags --export=sh)
35+
./configure
36+
make
37+
make check
38+
- name: store the logs as an artifact
39+
if: ${{ always() }}
40+
uses: actions/upload-artifact@v4
41+
with:
42+
path: '**/*.log'

‎.github/workflows/debian-trixie.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: debian 13 trixie
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- devel
8+
pull_request:
9+
10+
11+
jobs:
12+
container-test-job:
13+
runs-on: ubuntu-latest
14+
container:
15+
image: debian:trixie-slim
16+
steps:
17+
- name: checkout
18+
uses: actions/checkout@v4
19+
- name: install packages
20+
run: apt-get update && apt-get install autoconf build-essential nettle-dev libcap2-bin --yes
21+
- name: bootstrap
22+
run: ./bootstrap.sh
23+
- name: configure
24+
run: ./configure --enable-warnings CXXFLAGS=-std=c++11
25+
- name: make
26+
run: make
27+
- name: make check
28+
run: make check
29+
- name: make distcheck
30+
run: make distcheck CXXFLAGS=-std=c++11
31+
- name: build with hardened build flags
32+
run: |
33+
make clean
34+
eval $(DEB_BUILD_MAINT_OPTIONS="hardening=+all qa=+all,-canary reproducible=+all" dpkg-buildflags --export=sh)
35+
./configure
36+
make
37+
make check
38+
- name: store the logs as an artifact
39+
if: ${{ always() }}
40+
uses: actions/upload-artifact@v4
41+
with:
42+
path: '**/*.log'

‎testcases/hardlink_fails.sh‎

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -30,30 +30,36 @@ for n in $files ; do
3030
done
3131
dbgecho passed the happy path
3232

33-
#now try to make a hardlink to somewhere that fails.
34-
#ideally, we want to partitions so it is not possible to hardlink,
35-
#but it is difficult to fix that unless the test environment
36-
#is setup that way. therefore, make the hardlinking fail by
37-
#trying to hardlink something we do not have access to.
38-
#unless run as root which would be horrible.
39-
if [ "$(id -u)" -eq 0 ]; then
40-
dbgecho "running as root or through sudo, dangerous! Will not proceed with this unit tests."
41-
exit 1
42-
fi
33+
# try to make a hardlink to somewhere that fails.
4334

4435
reset_teststate
45-
system_file=$(which ls)
46-
cp $system_file .
47-
$rdfind -makehardlinks true . $system_file 2>&1 |tee rdfind.out
36+
mkdir -p $datadir/readonly.d/
37+
echo xxx > $datadir/readonly.d/a
38+
echo xxx > $datadir/readonly.d/b
39+
chmod 500 $datadir/readonly.d/
40+
41+
if [ "$(id -u)" -eq 0 ]; then
42+
# if running as root, directory rights are not respected. drop the capability
43+
# for doing that (requires capsh from package libcap2-bin)
44+
MAYBEDROP="capsh --drop=CAP_DAC_OVERRIDE -- -c"
45+
else
46+
MAYBEDROP="/bin/sh -c"
47+
fi
48+
$MAYBEDROP "$rdfind -makehardlinks true $datadir/readonly.d/" 2>&1 |tee rdfind.out
4849
if ! grep -iq "failed" rdfind.out ; then
49-
dbgecho "expected failure when trying to make hardlink on system partition"
50+
dbgecho "expected failure when trying to make hardlink on readonly directory"
5051
exit 1
5152
fi
5253

5354
#make sure that our own copy is still there
54-
if [ ! -e $(basename $system_file) ] ; then
55-
dbgecho file is missing, rdfind should not have removed it!
56-
exit 1
57-
fi
55+
for f in a b ; do
56+
if [ ! -e $datadir/readonly.d/$f ] ; then
57+
dbgecho file $f is missing, rdfind should not have removed it!
58+
exit 1
59+
fi
60+
done
61+
62+
# make sure it can be cleaned up
63+
chmod 700 $datadir/readonly.d/
5864

5965
dbgecho "all is good in this test!"

‎testcases/symlinking_action.sh‎

Lines changed: 28 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -44,27 +44,39 @@ for n in $files ; do
4444
done
4545
dbgecho passed the happy path
4646

47-
#now try to make a symlink somewhere where it fails.
48-
if [ "$(id -u)" -eq 0 ]; then
49-
dbgecho "running as root or through sudo, dangerous! Will not proceed with this unit tests."
50-
exit 1
51-
fi
47+
# try to make a symlink somewhere where it fails.
5248

5349
reset_teststate
54-
system_file=$(which ls)
55-
cp $system_file .
56-
$rdfind -makesymlinks true . $system_file 2>&1 |tee rdfind.out
57-
if ! grep -iq "failed to make symlink" rdfind.out ; then
58-
dbgecho "did not get the expected error message. see for yourself above."
59-
exit 1
60-
fi
50+
mkdir -p $datadir/readonly.d/
51+
echo xxx > $datadir/readonly.d/a
52+
echo xxx > $datadir/readonly.d/b
53+
chmod 500 $datadir/readonly.d/
6154

62-
#make sure that our own copy is still there
63-
if [ ! -e $(basename $system_file) ] ; then
64-
dbgecho file is missing, rdfind should not have removed it!
55+
if [ "$(id -u)" -eq 0 ]; then
56+
# if running as root, directory rights are not respected. drop the capability
57+
# for doing that (requires capsh from package libcap2-bin)
58+
MAYBEDROP="capsh --drop=CAP_DAC_OVERRIDE -- -c"
59+
else
60+
MAYBEDROP="/bin/sh -c"
61+
fi
62+
$MAYBEDROP "$rdfind -makesymlinks true $datadir/readonly.d/" 2>&1 |tee rdfind.out
63+
if ! grep -iq "failed" rdfind.out ; then
64+
dbgecho "expected failure when trying to make symlink on readonly directory"
6565
exit 1
6666
fi
67-
dbgecho passed the test with trying to write to a system directory
67+
68+
# make sure that our own copy is still there
69+
for f in a b ; do
70+
if [ ! -e $datadir/readonly.d/$f ] ; then
71+
dbgecho file $f is missing, rdfind should not have removed it!
72+
exit 1
73+
fi
74+
done
75+
76+
# make sure it can be cleaned up
77+
chmod 700 $datadir/readonly.d/
78+
79+
dbgecho passed the test with trying to write to a readonly directory
6880

6981

7082

0 commit comments

Comments
 (0)