CalvinBackup/gstack
1
0 Fork 0
mirror of https://github.com/garrytan/gstack.git synced 2026-11-03 23:37:53 +01:00
Code Issues Packages Projects Releases Wiki Activity

DIAG 2: sysctl userns control/fix probe (not for merge)

Browse Source 
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
This commit is contained in:
garrytanandcapy-ai[bot] committed 2026-10-29 17:17:53 +00:00
1 parent 77f2bc8e42
commit 42c545e59e
1 file changed
+14 -26
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/free-tests.yml
+14 -26
View File
@@ -432,32 +432,6 @@ jobs:
sudo install -T -o root -g root -m 4755 "$helper" "$installed"
test "$(stat -c '%u:%a' "$installed")" = '0:4755'
cmp -s "$helper" "$installed"
- name: DIAG chromium launch on this image
run: |
set +e
grep -m1 -E 'Version' /etc/os-release; uname -a
cat "$RUNNER_TEMP/../../.setup_info" 2>/dev/null | head -20
for k in kernel.apparmor_restrict_unprivileged_userns kernel.apparmor_restrict_unprivileged_unconfined kernel.unprivileged_userns_clone user.max_user_namespaces kernel.yama.ptrace_scope; do echo "$k=$(sysctl -n $k 2>&1)"; done
findmnt -T "$HOME"; findmnt -T /tmp; findmnt -T /dev/shm
chrome=$(bun -e 'import { chromium } from "playwright"; console.log(chromium.executablePath())')
ls -l "${chrome%/*}/chrome-sandbox" "$chrome"
sudo aa-status 2>&1 | head -40
ls /etc/apparmor.d | head -60
unshare -Ur true && echo "unshare userns OK" || echo "unshare userns FAILED"
d=$(mktemp -d)
"$chrome" --headless=new --user-data-dir="$d/a" --dump-dom about:blank 2>&1 | tail -20; echo "plain exit=$?"
"$chrome" --headless=new --no-zygote --user-data-dir="$d/b" --dump-dom about:blank 2>&1 | tail -5; echo "nozygote exit=$?"
"$chrome" --headless=new --disable-namespace-sandbox --user-data-dir="$d/c" --dump-dom about:blank 2>&1 | tail -10; echo "suid-only exit=$?"
"$chrome" --headless=new --no-sandbox --user-data-dir="$d/e" --dump-dom about:blank 2>&1 | tail -5; echo "nosandbox exit=$?"
DEBUG=pw:browser node -e '
const { chromium } = require("playwright");
(async () => {
try { const c = await chromium.launchPersistentContext(process.argv[1], { headless: true, chromiumSandbox: true, args: ["--remote-debugging-pipe"] }); console.log("PW OK"); await c.close(); }
catch (e) { console.log("PW ERR", e.message.slice(0, 4000)); }
})();' "$d/pw" 2>&1 | tail -60
sudo dmesg 2>&1 | tail -30
sudo journalctl -k --no-pager 2>&1 | grep -iE 'apparmor|denied|audit' | tail -20
exit 1
# Headed-browser tests (handoff, extension sidepanel DOM) need a real
# DISPLAY — first Linux run failed with Playwright's "launched a headed
@@ -522,6 +496,20 @@ jobs:
# GSTACK_EXPECT_BINARIES=1 arms make-pdf/test/e2e/ci-prereqs.test.ts:
# if a future edit drops the gate build (or poppler), the lane FAILS
# instead of the gates silently self-skipping back to false green.
- name: DIAG chromium sandbox on this image
run: |
set +e
grep -A1 'Runner Image' /dev/null
echo "restrict_userns=$(sysctl -n kernel.apparmor_restrict_unprivileged_userns) profiles=$(sudo aa-status --profiled 2>/dev/null)"
chrome=$(bun -e 'import { chromium } from "playwright"; console.log(chromium.executablePath())')
d=$(mktemp -d)
timeout 20 "$chrome" --headless=new --user-data-dir="$d/a" --dump-dom about:blank 2>&1 | head -12; echo "plain-before exit=${PIPESTATUS[0]}"
timeout 60 bun test browse/test/cookie-import-native.test.ts -t 'pipe smoke' 2>&1 | tail -4; echo "smoke-before exit=${PIPESTATUS[0]}"
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
unshare -Ur true && echo "unshare userns OK" || echo "unshare userns FAILED"
timeout 20 "$chrome" --headless=new --user-data-dir="$d/b" --dump-dom about:blank 2>&1 | head -5; echo "plain-after exit=${PIPESTATUS[0]}"
timeout 60 bun test browse/test/cookie-import-native.test.ts 2>&1 | tail -4; echo "file-after exit=${PIPESTATUS[0]}"
exit 1
- name: Run free suite
run: xvfb-run -a bun run test:free --ci-run "$RUNNER_TEMP/free-plan.json" --shard ${{ matrix.shard }} --result "$RUNNER_TEMP/free-results/shard-${{ matrix.shard }}.json"
env: