20350393628

Committed 18 Dec 2025 08:28PM UTC coverage: 32.588% (-1.3%) from 33.871%

Build # 20350393628

Build Type

Pull #82

github

Committed by

web-flow

Commit Message

Merge 7e3fecea0 into 2f4720aec

Pull Request Pull Request #82: Cleanup and refactor of daemon.rs

Coverage Stats

10 of 49 new or added lines in 6 files covered. (20.41%)

102 of 313 relevant lines covered (32.59%)

0.61 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

12.5

/src/mount.rs

// SPDX-License-Identifier: Apache-2.0
// Copyright (c) NVIDIA CORPORATION

use crate::coreutils::{ln, mknod};
use anyhow::{Context, Result};
use nix::mount::{self, MsFlags};
use nix::sys::stat;
use std::fs;
use std::path::Path;

// Simplified helper: perform mount only if target not already mounted
fn mount(
    source: &str,
    target: &str,
    fstype: &str,
    flags: MsFlags,
    data: Option<&str>,
) -> Result<()> {
    if !is_mounted(target) {
        mount::mount(Some(source), target, Some(fstype), flags, data)
            .with_context(|| format!("Failed to mount {source} on {target}"))?;
    }
    Ok(())
}

fn is_mounted(path: &str) -> bool {
    fs::read_to_string("/proc/mounts")
        .map(|mounts| mounts.lines().any(|line| line.contains(path)))
        .unwrap_or(false)
}

fn fs_available(fs: &str) -> bool {
    fs::read_to_string("/proc/filesystems")
        .map(|filesystems| filesystems.lines().any(|line| line.contains(fs)))
        .unwrap_or(false)
}

pub fn readonly(target: &str) -> Result<()> {
    let flags = MsFlags::MS_NOSUID | MsFlags::MS_NODEV | MsFlags::MS_RDONLY | MsFlags::MS_REMOUNT;
    mount::mount(None::<&str>, target, None::<&str>, flags, None::<&str>)
        .with_context(|| format!("Failed to remount {target} readonly"))
}

fn mount_if(
    fstype: &str,
    source: &str,
    target: &str,
    flags: MsFlags,
    data: Option<&str>,
) -> Result<()> {
    if fs_available(fstype) && Path::new(target).exists() && !is_mounted(target) {
        mount(source, target, fstype, flags, data)?;
    }
    Ok(())
}

fn proc_symlinks() -> Result<()> {
    for (src, dst) in [
        ("/proc/kcore", "/dev/core"),
        ("/proc/self/fd", "/dev/fd"),
        ("/proc/self/fd/0", "/dev/stdin"),
        ("/proc/self/fd/1", "/dev/stdout"),
        ("/proc/self/fd/2", "/dev/stderr"),
    ] {
        ln(src, dst)?;
    }
    Ok(())
}

fn device_nodes() -> Result<()> {
    // (path, minor)
    for (path, minor) in [
        ("/dev/null", 3u64),
        ("/dev/zero", 5u64),
        ("/dev/random", 8u64),
        ("/dev/urandom", 9u64),
    ] {
        mknod(path, stat::SFlag::S_IFCHR, None, 1, minor)?; // major 1 for memory devices
    }
    Ok(())
}

pub fn setup() -> Result<()> {
    let common = MsFlags::MS_NOSUID | MsFlags::MS_NOEXEC | MsFlags::MS_NODEV | MsFlags::MS_RELATIME;
    mount("proc", "/proc", "proc", common, None)?;
    let dev_flags = MsFlags::MS_NOSUID | MsFlags::MS_NOEXEC | MsFlags::MS_RELATIME; // allow device nodes
    mount("dev", "/dev", "devtmpfs", dev_flags, Some("mode=0755"))?;
    mount("sysfs", "/sys", "sysfs", common, None)?;
    mount("run", "/run", "tmpfs", common, Some("mode=0755"))?;
    let tmp_flags = MsFlags::MS_NOSUID | MsFlags::MS_NODEV | MsFlags::MS_RELATIME;
    mount("tmpfs", "/tmp", "tmpfs", tmp_flags, None)?;
    mount_if(
        "securityfs",
        "securityfs",
        "/sys/kernel/security",
        common,
        None,
    )?;
    mount_if(
        "efivarfs",
        "efivarfs",
        "/sys/firmware/efi/efivars",
        common,
        None,
    )?;
    proc_symlinks()?;
    device_nodes()?;
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;
    use mktemp::Temp;
    use nix::unistd::Uid;
    use std::env;
    use std::fs;
    use std::path::Path;
    use std::process::Command;

    fn rerun_with_sudo() {
        let args: Vec<String> = env::args().collect();
        let output = Command::new("sudo").args(&args).status();
        match output {
            Ok(output) => {
                if output.success() {
                    println!("running with sudo")
                } else {
                    panic!("not running with sudo")
                }
            }
            Err(e) => panic!("Failed to escalate privileges: {e:?}"),
        }
    }

    fn cleanup_path<P: AsRef<Path>>(path: P) {
        let path = path.as_ref();
        if path.exists() {
            if path.is_dir() {
                let _ = fs::remove_dir_all(path);
            } else {
                let _ = fs::remove_file(path);
            }
        }
    }

    #[test]
    fn test_ln_dir() {
        let target = Temp::new_dir().unwrap();
        let linkpath = Temp::new_dir().unwrap();
        cleanup_path(&linkpath);
        let src = target.to_str().unwrap();
        let dst = linkpath.to_str().unwrap();
        ln(src, dst).expect("Failed to create symbolic link");
        assert!(Path::new(dst).exists());
        cleanup_path(target);
        cleanup_path(linkpath);
    }

    #[test]
    fn test_ln_file() {
        let target = Temp::new_file().unwrap();
        let linkpath = Temp::new_file().unwrap();
        fs::write(&target, "test").expect("Failed to create test file");
        cleanup_path(&linkpath);
        let src = target.to_str().unwrap();
        let dst = linkpath.to_str().unwrap();
        ln(src, dst).expect("Failed to create symbolic link");
        assert!(Path::new(dst).exists());
        cleanup_path(target);
        cleanup_path(linkpath);
    }

    #[test]
    fn test_mknod() {
        if !Uid::effective().is_root() {
            return rerun_with_sudo();
        }
        let device = "/tmp/test_node";
        if Path::new(device).exists() {
            cleanup_path(device);
        }
        mknod(device, stat::SFlag::S_IFCHR, None, 1, 3).expect("Failed to create device node");
        assert!(Path::new(device).exists());
        cleanup_path(device);
    }

    #[test]
    fn test_is_mounted() {
        assert!(is_mounted("/"));
        assert!(!is_mounted("/nonexistent"));
        assert!(is_mounted("/dev"));
    }

    #[test]
    fn test_fs_available() {
        assert!(fs_available("proc"));
        assert!(fs_available("sysfs"));
        assert!(!fs_available("nonexistent_fs"));
    }
}

1	// SPDX-License-Identifier: Apache-2.0
2	// Copyright (c) NVIDIA CORPORATION
3
4	use crate::coreutils::{ln, mknod};
5	use anyhow::{Context, Result};
6	use nix::mount::{self, MsFlags};
7	use nix::sys::stat;
8	use std::fs;
9	use std::path::Path;
10
11	// Simplified helper: perform mount only if target not already mounted
12	fn mount(	×
13	source: &str,
14	target: &str,
15	fstype: &str,
16	flags: MsFlags,
17	data: Option<&str>,
18	) -> Result<()> {
19	if !is_mounted(target) {	×
20	mount::mount(Some(source), target, Some(fstype), flags, data)	×
21	.with_context(\|\| format!("Failed to mount {source} on {target}"))?;	×
22	}
23	Ok(())	×
24	}
25
26	fn is_mounted(path: &str) -> bool {	1✔
27	fs::read_to_string("/proc/mounts")	1✔
28	.map(\|mounts\| mounts.lines().any(\|line\| line.contains(path)))	5✔
29	.unwrap_or(false)
30	}
31
32	fn fs_available(fs: &str) -> bool {	1✔
33	fs::read_to_string("/proc/filesystems")	1✔
34	.map(\|filesystems\| filesystems.lines().any(\|line\| line.contains(fs)))	5✔
35	.unwrap_or(false)
36	}
37
38	pub fn readonly(target: &str) -> Result<()> {	×
39	let flags = MsFlags::MS_NOSUID \| MsFlags::MS_NODEV \| MsFlags::MS_RDONLY \| MsFlags::MS_REMOUNT;	×
40	mount::mount(None::<&str>, target, None::<&str>, flags, None::<&str>)	×
41	.with_context(\|\| format!("Failed to remount {target} readonly"))	×
42	}
43
44	fn mount_if(	×
45	fstype: &str,
46	source: &str,
47	target: &str,
48	flags: MsFlags,
49	data: Option<&str>,
50	) -> Result<()> {
51	if fs_available(fstype) && Path::new(target).exists() && !is_mounted(target) {	×
52	mount(source, target, fstype, flags, data)?;	×
53	}
54	Ok(())	×
55	}
56
57	fn proc_symlinks() -> Result<()> {	×
58	for (src, dst) in [	×
59	("/proc/kcore", "/dev/core"),	×
60	("/proc/self/fd", "/dev/fd"),	×
61	("/proc/self/fd/0", "/dev/stdin"),	×
62	("/proc/self/fd/1", "/dev/stdout"),	×
63	("/proc/self/fd/2", "/dev/stderr"),	×
64	] {
65	ln(src, dst)?;	×
66	}
67	Ok(())	×
68	}
69
70	fn device_nodes() -> Result<()> {	×
71	// (path, minor)
72	for (path, minor) in [	×
73	("/dev/null", 3u64),	×
74	("/dev/zero", 5u64),	×
75	("/dev/random", 8u64),	×
76	("/dev/urandom", 9u64),	×
77	] {
NEW 78	mknod(path, stat::SFlag::S_IFCHR, None, 1, minor)?; // major 1 for memory devices	×
79	}
80	Ok(())	×
81	}
82
83	pub fn setup() -> Result<()> {	×
84	let common = MsFlags::MS_NOSUID \| MsFlags::MS_NOEXEC \| MsFlags::MS_NODEV \| MsFlags::MS_RELATIME;	×
85	mount("proc", "/proc", "proc", common, None)?;	×
86	let dev_flags = MsFlags::MS_NOSUID \| MsFlags::MS_NOEXEC \| MsFlags::MS_RELATIME; // allow device nodes	×
87	mount("dev", "/dev", "devtmpfs", dev_flags, Some("mode=0755"))?;	×
88	mount("sysfs", "/sys", "sysfs", common, None)?;	×
89	mount("run", "/run", "tmpfs", common, Some("mode=0755"))?;	×
90	let tmp_flags = MsFlags::MS_NOSUID \| MsFlags::MS_NODEV \| MsFlags::MS_RELATIME;	×
91	mount("tmpfs", "/tmp", "tmpfs", tmp_flags, None)?;	×
92	mount_if(
93	"securityfs",
94	"securityfs",
95	"/sys/kernel/security",
96	common,
97	None,
98	)?;
99	mount_if(
100	"efivarfs",
101	"efivarfs",
102	"/sys/firmware/efi/efivars",
103	common,
104	None,
105	)?;
106	proc_symlinks()?;	×
107	device_nodes()?;	×
108	Ok(())	×
109	}
110
111	#[cfg(test)]
112	mod tests {
113	use super::*;
114	use mktemp::Temp;
115	use nix::unistd::Uid;
116	use std::env;
117	use std::fs;
118	use std::path::Path;
119	use std::process::Command;
120
121	fn rerun_with_sudo() {
122	let args: Vec<String> = env::args().collect();
123	let output = Command::new("sudo").args(&args).status();
124	match output {
125	Ok(output) => {
126	if output.success() {
127	println!("running with sudo")
128	} else {
129	panic!("not running with sudo")
130	}
131	}
132	Err(e) => panic!("Failed to escalate privileges: {e:?}"),
133	}
134	}
135
136	fn cleanup_path<P: AsRef<Path>>(path: P) {
137	let path = path.as_ref();
138	if path.exists() {
139	if path.is_dir() {
140	let _ = fs::remove_dir_all(path);
141	} else {
142	let _ = fs::remove_file(path);
143	}
144	}
145	}
146
147	#[test]
148	fn test_ln_dir() {
149	let target = Temp::new_dir().unwrap();
150	let linkpath = Temp::new_dir().unwrap();
151	cleanup_path(&linkpath);
152	let src = target.to_str().unwrap();
153	let dst = linkpath.to_str().unwrap();
154	ln(src, dst).expect("Failed to create symbolic link");
155	assert!(Path::new(dst).exists());
156	cleanup_path(target);
157	cleanup_path(linkpath);
158	}
159
160	#[test]
161	fn test_ln_file() {
162	let target = Temp::new_file().unwrap();
163	let linkpath = Temp::new_file().unwrap();
164	fs::write(&target, "test").expect("Failed to create test file");
165	cleanup_path(&linkpath);
166	let src = target.to_str().unwrap();
167	let dst = linkpath.to_str().unwrap();
168	ln(src, dst).expect("Failed to create symbolic link");
169	assert!(Path::new(dst).exists());
170	cleanup_path(target);
171	cleanup_path(linkpath);
172	}
173
174	#[test]
175	fn test_mknod() {
176	if !Uid::effective().is_root() {
177	return rerun_with_sudo();
178	}
179	let device = "/tmp/test_node";
180	if Path::new(device).exists() {
181	cleanup_path(device);
182	}
183	mknod(device, stat::SFlag::S_IFCHR, None, 1, 3).expect("Failed to create device node");
184	assert!(Path::new(device).exists());
185	cleanup_path(device);
186	}
187
188	#[test]
189	fn test_is_mounted() {
190	assert!(is_mounted("/"));
191	assert!(!is_mounted("/nonexistent"));
192	assert!(is_mounted("/dev"));
193	}
194
195	#[test]
196	fn test_fs_available() {
197	assert!(fs_available("proc"));
198	assert!(fs_available("sysfs"));
199	assert!(!fs_available("nonexistent_fs"));
200	}
201	}

NVIDIA / nvrc / 20350393628

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous