testsupport

Documentation

Overview

Fixture policies for backend tests. These preserve isolated backend mechanism shapes: they deliberately do not model a production profile or an ExecutorSet-owned HOME/TMPDIR, and must not be used for lifecycle, profile, or guarantee-contract tests. They live here rather than in a _test.go file because the policy, darwin, linux, and executor suites all build on them.

Package testsupport holds construction helpers shared by the test suites of several internal packages. It exists so that splitting the module into packages did not force each one to re-declare the same profile fixtures. It is internal and test-only by convention; production code never imports it.

Index

• Constants
• func FixturePolicy(shape FixtureShape, workspace string, opts ...FixtureOption) policy.Effective
• func FixtureSecretDenials() []policy.FSEntry
• func MustProfile(t *testing.T, config profile.ProfileConfig) *profile.Profile
• func UnconfinedConfig(workspace string, ack bool) profile.ProfileConfig
• type FixtureOption
  • func FixtureWithAckUnconfined() FixtureOption
  • func FixtureWithDenyRead(path string) FixtureOption
  • func FixtureWithEnv(env policy.EnvPolicy) FixtureOption
  • func FixtureWithLimits(limits policy.Limits) FixtureOption
  • func FixtureWithNet(net policy.NetPolicy) FixtureOption
  • func FixtureWithWritable(path string) FixtureOption
  • func FixtureWithoutSecretDenials() FixtureOption
• type FixtureShape

Constants

const FixtureSharedTmpRoot = "/tmp"

Functions

func FixturePolicy

func FixturePolicy(shape FixtureShape, workspace string, opts ...FixtureOption) policy.Effective

func FixtureSecretDenials

func FixtureSecretDenials() []policy.FSEntry

func MustProfile

func MustProfile(t *testing.T, config profile.ProfileConfig) *profile.Profile

MustProfile builds a Profile from config or fails the test.

func UnconfinedConfig

func UnconfinedConfig(workspace string, ack bool) profile.ProfileConfig

UnconfinedConfig is the minimum configuration a valid Unconfined profile requires: every filesystem and network authority at Allow, plus the explicit acknowledgement. Pass ack=false to build the invalid variant on purpose.

Types

type FixtureOption

type FixtureOption func(*policy.Effective)

func FixtureWithAckUnconfined

func FixtureWithAckUnconfined() FixtureOption

func FixtureWithDenyRead

func FixtureWithDenyRead(path string) FixtureOption

func FixtureWithEnv

func FixtureWithEnv(env policy.EnvPolicy) FixtureOption

func FixtureWithLimits

func FixtureWithLimits(limits policy.Limits) FixtureOption

func FixtureWithNet

func FixtureWithNet(net policy.NetPolicy) FixtureOption

func FixtureWithWritable

func FixtureWithWritable(path string) FixtureOption

func FixtureWithoutSecretDenials

func FixtureWithoutSecretDenials() FixtureOption

type FixtureShape

type FixtureShape uint8

These fixtures preserve isolated backend mechanism shapes. They deliberately do not model a production profile or ExecutorSet-owned HOME/TMPDIR and must not be used for lifecycle, profile, or guarantee-contract tests.

const (
	FixtureScopedRuntime FixtureShape = iota
	FixtureHostRead
	FixtureWorkspaceWrite
	FixtureBroadNetwork
	FixtureDirect
)