ci: add ubuntu-22.04 low-ABI job + end-to-end degrade test#107
Open
dzerik wants to merge 1 commit into
Open
Conversation
The CI matrix only had v6-capable runners (ubuntu-latest, ubuntu-24.04-arm), so the Protection opt-out path added in multikernel#71 — which lets a sandbox confine on kernels below Landlock ABI 6 by degrading the scopes the host lacks — had no automated coverage on a real low-ABI kernel. Add a dedicated rust-low-abi job on ubuntu-22.04 (a 6.8 Azure kernel, Landlock ABI v4). The default strict_all() suite hard-requires v6 and would panic there, so the job runs the host-ABI-independent resolution tests plus a new end-to-end test, and reports the runner's Landlock ABI for visibility. degraded_policy_confines_and_runs_below_v6 builds a fully-degradable policy, asserts every scope the host cannot provide resolves to Degraded (not Unavailable), and runs a genuinely confined child — proving confinement still works below v6. Verified on real kernels via multipass: ABI 1 (Ubuntu 22.04), ABI 5 (Rocky 9.6), ABI 8 (host). Also add a workflow_dispatch trigger for manual runs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the CI split-out agreed in #71 (the
ci.ymlreview thread).Motivation
The CI matrix only runs v6-capable runners (
ubuntu-latest,ubuntu-24.04-arm), so the Protection opt-out path added in #71 — which lets a sandbox confine on kernels below Landlock ABI 6 by degrading the scopes the host lacks — has no automated coverage on a real low-ABI kernel. The synthetictest_protectionresolution tests cover the mechanics, but nothing exercised a genuinebuild()+run()below v6.What this adds
rust-low-abijob onubuntu-22.04. That image runs a 6.8 Azure kernel — Landlock ABI v4 — below the project'sMIN_ABI = 6. The defaultstrict_all()suite (test_sandbox,test_network, …) hard-requires v6 and would panic there, so the job runs only the host-ABI-independent resolution tests plus a new end-to-end degrade test, and reports the runner's ABI viasandlock check(so a future runner-image kernel bump that changes it is visible at a glance).degraded_policy_confines_and_runs_below_v6: builds a fully-degradable policy, asserts every scope the host cannot provide resolves toDegraded(notUnavailable, which is what makesconfinerefuse), and runs a genuinely confined child. This is the test that gives a sub-v6 runner its purpose.workflow_dispatchtrigger for manual runs.Verification
Ran on real kernels across the low-ABI spectrum:
ubuntu-22.04runner itself (confirmed by the job's ownsandlock checkoutput)test_protectionis 22/22 on every host; the degrade assertion fires on each sub-v6 kernel and the confined child runs.Note on the
ubuntu-latestcheckRust tests (ubuntu-latest)currently fails onmainindependently of this change:test_restore::test_restore_real_program_resumesfails on x86 (it passes onubuntu-24.04-arm), introduced with the checkpoint/restore merge (#105). This PR doesn't touch that path, and the newrust-low-abijob is green. Happy to file that separately if it isn't already tracked.