roundabout

#![cfg(target_os = "linux")]

use std::{

    fs,

    io::Write,

    os::fd::{AsRawFd, FromRawFd, OwnedFd},

    os::unix::process::CommandExt,

    process::{Child, Command, Stdio},

    time::Duration,

};

fn gated_command(program: &str, arguments: &[&str]) -> (Child, OwnedFd) {

    let mut descriptors = [-1; 2];

    assert_eq!(

        unsafe { libc::pipe2(descriptors.as_mut_ptr(), libc::O_CLOEXEC) },

        0

    );

    let read = unsafe { OwnedFd::from_raw_fd(descriptors[0]) };

    let write = unsafe { OwnedFd::from_raw_fd(descriptors[1]) };

    let descriptor = read.as_raw_fd();

    let mut command = Command::new(env!("CARGO_BIN_EXE_roundabout"));

    command

        .args(["__roundabout_exec", &descriptor.to_string(), program])

        .args(arguments)

        .stdout(Stdio::piped())

        .stderr(Stdio::piped());

    unsafe {

        command.pre_exec(move || {

            if libc::fcntl(descriptor, libc::F_SETFD, 0) == -1 {

                return Err(std::io::Error::last_os_error());

            }

            Ok(())

        });

    }

    let child = command.spawn().unwrap();

    drop(read);

    (child, write)

}

#[test]

fn command_waits_for_scope_setup() {

    let (mut child, gate) = gated_command(env!("CARGO_BIN_EXE_roundabout"), &["--version"]);

    let mut output = libc::pollfd {

        fd: child.stdout.as_ref().unwrap().as_raw_fd(),

        events: libc::POLLIN,

        revents: 0,

    };

    assert_eq!(unsafe { libc::poll(&raw mut output, 1, 100) }, 0);

    assert!(child.try_wait().unwrap().is_none());

    fs::File::from(gate).write_all(b"1").unwrap();

    let output = child.wait_with_output().unwrap();

    assert!(output.status.success());

    assert!(

        String::from_utf8(output.stdout)

            .unwrap()

            .starts_with("roundabout ")

    );

}

#[test]

fn failed_scope_setup_never_executes_the_command() {

    let (child, gate) = gated_command(env!("CARGO_BIN_EXE_roundabout"), &["--version"]);

    drop(gate);

    let output = child.wait_with_output().unwrap();

    assert_eq!(output.status.code(), Some(1));

    assert!(output.stdout.is_empty());

}

#[test]

fn missing_commands_keep_exit_127() {

    let (child, gate) = gated_command("/roundabout-missing-command", &[]);

    fs::File::from(gate).write_all(b"1").unwrap();

    assert_eq!(child.wait_with_output().unwrap().status.code(), Some(127));

}

#[test]

#[ignore = "requires a systemd user manager and cgroup v2"]

fn transient_scope_enforces_the_grant() {

    if std::env::var_os("ROUNDABOUT_SCOPE_PROBE").is_some() {

        let membership = fs::read_to_string("/proc/self/cgroup").unwrap();

        let path = membership

            .lines()

            .find_map(|line| line.strip_prefix("0::"))

            .unwrap();

        assert!(path.contains("roundabout-"));

        let cgroup = std::path::Path::new("/sys/fs/cgroup").join(path.trim_start_matches('/'));

        let cpu = fs::read_to_string(cgroup.join("cpu.max")).unwrap();

        let limits: Vec<_> = cpu.split_whitespace().collect();

        assert_eq!(limits[0], limits[1]);

        assert_eq!(

            fs::read_to_string(cgroup.join("memory.max"))

                .unwrap()

                .trim(),

            (80 * 1024 * 1024).to_string()

        );

        assert_eq!(

            fs::read_to_string(cgroup.join("memory.high"))

                .unwrap()

                .trim(),

            (64 * 1024 * 1024).to_string()

        );

        assert_eq!(

            fs::read_to_string(cgroup.join("memory.oom.group"))

                .unwrap()

                .trim(),

            "1"

        );

        assert_eq!(std::env::var("CARGO_BUILD_JOBS").unwrap(), "1");

        assert!(std::env::var("ROUNDABOUT_LEASE").is_ok());

        return;

    }

    let directory =

        std::env::temp_dir().join(format!("roundabout-scope-test-{}", std::process::id()));

    fs::create_dir_all(&directory).unwrap();

    let config = directory.join("config.toml");

    fs::write(

        &config,

        "[overrun]\nram = \"throttle\"\n[queue]\nlinger = \"0s\"\n",

    )

    .unwrap();

    let output = Command::new(env!("CARGO_BIN_EXE_roundabout"))

        .args([

            "run", "--ram", "64M", "--disk", "0", "--cores", "1", "--time", "5s", "--exact", "--",

        ])

        .arg(std::env::current_exe().unwrap())

        .args([

            "--exact",

            "transient_scope_enforces_the_grant",

            "--ignored",

            "--nocapture",

        ])

        .current_dir(&directory)

        .env("ROUNDABOUT_CONFIG", &config)

        .env("ROUNDABOUT_RUNTIME_DIR", directory.join("runtime"))

        .env("ROUNDABOUT_STATE_DIR", directory.join("state"))

        .env("ROUNDABOUT_SCOPE_PROBE", "1")

        .output()

        .unwrap();

    std::thread::sleep(Duration::from_secs(2));

    fs::remove_dir_all(directory).unwrap();

    assert!(

        output.status.success(),

        "{}\n{}",

        String::from_utf8_lossy(&output.stdout),

        String::from_utf8_lossy(&output.stderr)

    );

}