jpmschweitzer/odysseus
1
0
Fork 0
mirror of https://github.com/pewdiepie-archdaemon/odysseus.git synced 2026-10-17 12:22:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(runtime): verify namespace init death and record Wave 3-S validation

Browse Source
This commit is contained in:
Alexandre Teixeira
2026-10-01 23:17:01 +01:00
parent 0dec375631
commit 57143a14ba
7 changed files with 720 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_native_execution_containment.py
+5 -1
View File
@@ -108,15 +108,19 @@ async def test_blocked_stdin_is_inside_wall_clock(native_boundary):
@pytest.mark.parametrize("source", ["print(1 + 1)", "import os; print(os.getcwd())",
"exec('print(2)')", "print('/workspace')"])
@pytest.mark.skipif(os.name == "nt", reason="POSIX namespace argv; Windows refusal tested separately")
async def test_python_namespace_is_independent_of_content(source, native_boundary, monkeypatch):
from tests.containment_helpers import capture_owned_spawn
captured = capture_owned_spawn(monkeypatch, native_boundary)
monkeypatch.setattr(containment, "MECHANISMS", (containment.Mechanism(
"bubblewrap", 30, lambda: True, lambda spec: containment.DEFAULT_REQUIRED,
),))
original_which = containment.shutil.which
monkeypatch.setattr(containment.shutil, "which", lambda name:
"/usr/bin/bwrap" if name == "bwrap" else original_which(name))
monkeypatch.setattr(containment, "CONTAINMENT_MODE", containment.MODE_ENFORCING)
result = await subprocess_tools.PythonTool().execute(source, {})
assert captured["argv"][0] == "bwrap"
assert os.path.basename(captured["argv"][0]) == "bwrap"
assert "--bind" in captured["argv"]
assert result["containment"]["enforced"] == sorted(containment.DEFAULT_REQUIRED)
assert "-I" in captured["argv"]