Add test root readonly

tests/contest/contest/src/main.rs

@@ -22,6 +22,7 @@ use crate::tests::mounts_recursive::get_mounts_recursive_test;
 use crate::tests::no_pivot::get_no_pivot_test;
 use crate::tests::pidfile::get_pidfile_test;
 use crate::tests::readonly_paths::get_ro_paths_test;
+use crate::tests::root_readonly_true::get_root_readonly_test;
 use crate::tests::scheduler::get_scheduler_test;
 use crate::tests::seccomp::get_seccomp_test;
 use crate::tests::seccomp_notify::get_seccomp_notify_test;
@@ -114,6 +115,7 @@ fn main() -> Result<()> {
     let scheduler = get_scheduler_test();
     let io_priority_test = get_io_priority_test();
     let devices = get_devices_test();
+    let root_readonly = get_root_readonly_test();
     let no_pivot = get_no_pivot_test();
 
     tm.add_test_group(Box::new(cl));
@@ -138,6 +140,7 @@ fn main() -> Result<()> {
     tm.add_test_group(Box::new(sysctl));
     tm.add_test_group(Box::new(scheduler));
     tm.add_test_group(Box::new(devices));
+    tm.add_test_group(Box::new(root_readonly));
     tm.add_test_group(Box::new(no_pivot));
 
     tm.add_test_group(Box::new(io_priority_test));

tests/contest/contest/src/tests/mod.rs

@@ -12,6 +12,7 @@ pub mod mounts_recursive;
 pub mod no_pivot;
 pub mod pidfile;
 pub mod readonly_paths;
+pub mod root_readonly_true;
 pub mod scheduler;
 pub mod seccomp;
 pub mod seccomp_notify;

tests/contest/contest/src/tests/root_readonly_true/mod.rs

@@ -0,0 +1,2 @@
+mod root_readonly_tests;
+pub use root_readonly_tests::get_root_readonly_test;

tests/contest/contest/src/tests/root_readonly_true/root_readonly_tests.rs

@@ -0,0 +1,28 @@
+use anyhow::{Context, Ok, Result};
+use oci_spec::runtime::{RootBuilder, Spec, SpecBuilder};
+use test_framework::{test_result, Test, TestGroup, TestResult};
+
+use crate::utils::test_inside_container;
+
+fn create_spec() -> Result<Spec> {
+    let spec = SpecBuilder::default()
+        .root(RootBuilder::default().readonly(true).build().unwrap())
+        .build()
+        .context("failed to build spec")?;
+
+    Ok(spec)
+}
+
+fn root_readonly_test() -> TestResult {
+    let spec = test_result!(create_spec());
+    test_inside_container(spec, &|_| Ok(()))
+}
+
+pub fn get_root_readonly_test() -> TestGroup {
+    let mut root_readonly_test_group = TestGroup::new("root_readonly");
+
+    let test = Test::new("root_readonly_test", Box::new(root_readonly_test));
+    root_readonly_test_group.add(vec![Box::new(test)]);
+
+    root_readonly_test_group
+}

tests/contest/runtimetest/src/main.rs

@@ -44,7 +44,9 @@ fn main() {
         "io_priority_class_be" => tests::test_io_priority_class(&spec, IoprioClassBe),
         "io_priority_class_idle" => tests::test_io_priority_class(&spec, IoprioClassIdle),
         "devices" => tests::validate_devices(&spec),
+        "root_readonly" => tests::test_validate_root_readonly(),
         "no_pivot" => tests::validate_rootfs(),
+
         _ => eprintln!("error due to unexpected execute test name: {execute_test}"),
     }
 }

tests/contest/runtimetest/src/tests.rs

@@ -546,6 +546,19 @@ pub fn test_io_priority_class(spec: &Spec, io_priority_class: IOPriorityClass) {
     }
 }
 
+pub fn test_validate_root_readonly() {
+    if let std::io::Result::Err(e) = test_read_access("/") {
+        let errno = Errno::from_raw(e.raw_os_error().unwrap());
+        if errno == Errno::ENOENT {
+            /* This is expected */
+        } else {
+            eprintln!("in readonly paths, error in testing read access for / : {e:?}");
+        }
+    } else {
+        /* Expected */
+    }
+}
+
 // the validate_rootfs function is used to validate the rootfs of the container is
 // as expected. This function is used in the no_pivot test to validate the rootfs
 pub fn validate_rootfs() {