Repository navigation
GEISA-LEE-tests: exercise the "app isolation" and "file layout" tests/subchapters with geisa-test - #53
Merged
Conversation
Add --key-name for the key file name. --key-path is now the directory that holds it (default: ~/.ssh). Update the README to match, and to explain that REFERENCE_APPLICATION selects the reference application from the community submodule. Change-Id: Ic2b9afd60437562f3a6c8c95b066731c17654532 Signed-off-by: Nghia Dam <nghia.dam@savoirfairelinux.com>
The final cleanup read the configuration from the board, and failed when it was missing, for example after a reboot. Send it from the host. Also print the persistence marker before the reboot tests. Change-Id: I6911e39f69042656e2016d5bc10dbfa12c10e10a Signed-off-by: Nghia Dam <nghia.dam@savoirfairelinux.com>
geisa-test supersedes geisa-simple as the reference application. Unlike geisa-simple, it can load the CPU, allocate memory, write to storage and open network connections on demand, which the tests need to check that the platform enforces the manifest limits. Change-Id: Ibaaf6b38b91e1a32037d717d20478c879f86eb91 Signed-off-by: Nghia Dam <nghia.dam@savoirfairelinux.com>
The app isolation tests only read the configured limits. When geisa-test is the reference application, they now also run it past each limit and check that the platform enforces it: - APP-SHALL-05, CPU percent: a full CPU load is throttled to the quota. - APP-SHALL-07, memory: allocating past the limit gets the app killed. - APP-SHALL-08 and 09, persistent and nonpersistent storage: writing past the limit fails. - APP-SHALL-10, standard sockets: the app can connect to each outbound TCP port that its manifest grants. - APP-SHALL-11, ACL: a port that is not granted cannot be reached. - APP-SHALL-12, volume limit: a granted port cannot be reached once the daily volume is used. Change-Id: I779edf86955238f7e9e4a3a0abb222795f1e5030 Signed-off-by: Nghia Dam <nghia.dam@savoirfairelinux.com>
The file layout size tests only compared the mount size with the manifest limit. When geisa-test is the reference application, they now also have it write past the limit inside the container and check that the write fails: - FS-MUST-40: /tmp MUST be limited in size. - FS-MUST-41: /home/geisa MUST be limited in size. Change-Id: I2c8a0b1f492a52bd873d2c7ee1b420fb53a58885 Signed-off-by: Nghia Dam <nghia.dam@savoirfairelinux.com>
Contributor
|
Are you going to update the manifest as part of the test to include network access for some of the tests (APP-SHALL-10/11/12)? Otherwise ok, so merging. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GEISA-LEE-tests: exercise the app isolation and file layout limits with geisa-test
Switch the reference application to geisa-test. The tests now run it
past each manifest limit and check that the platform enforces it:
app-cpu.app-ramgets the app OOM-killed.storage-persistentin/home/geisa fails.
storage-nonpersistentin /tmpfails.
used.
Also adds
--key-nameto select the SSH key, and the final cleanup nowworks after a reboot.