Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Test the managed agent's direct-mode launch without privileges

Aperta
  • Qualcosa non va?
#601 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
linux, python, rust
Ambito
backend, security, testing

Direzione di ricerca

Start with the dispatch and spawn paths in nvx-rs/src/guest/managed_agent/seam.rs and nvx-rs/src/guest/sys/spawn.rs, then review the existing cases in git show 8142d4e54~1:scripts/test_nvx_tools.py. The issue calls for a fork-safe identity-call seam, a setpriv shim, a real spawn path, and a pseudo-terminal helper in nvx-rs/tests/guest_tools.rs. Done means the listed working-directory, identity, PWD, and sandbox STOP cases run without root privileges.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Follow-up to #561, part of #358.

#561 deletes scripts/test_managed_agent.py and the C-backed managed-agent classes of scripts/test_nvx_tools.py, and ports their cases to nvx-rs. The remaining cases need the real direct-mode launch, which no unprivileged test can run today:

  • TestSystem::spawn in nvx-rs/src/guest/managed_agent/seam.rs returns ENOSYS, so the dispatch tests stop before a workload starts.
  • The child's setgroups, setegid, seteuid, and chdir calls in nvx-rs/src/guest/sys/spawn.rs run after fork and bypass the System seam, so a non-root test fails at setgroups before it reaches the directory check.

The C harnesses stubbed those calls at link time and ran a setpriv shim. These cases remain to port, from ManagedAgentWorkingDirectoryTests and ManagedAgentStopTests (git show 8142d4e54~1:scripts/test_nvx_tools.py):

  • Working-directory refusals. A missing directory (ENOENT), a regular file (ENOTDIR), and a directory that the workload cannot search (EACCES) each print nvx-managed-agent: cannot enter working directory DIR: STRERROR on the workload's stderr, then answer APP_ERROR(errno, "cwd-failed"), and run nothing. This is the guest side of FEATURE_EXEC_CWD.
  • Identity failure. A setgroups failure answers APP_ERROR(125, "launch-failed") and runs nothing.
  • Checked directory. A symbolic link retargeted, or a directory renamed, between the check and the exec still starts the workload in the directory that was checked.
  • End-to-end PWD. The default working directory is /; a requested directory sets both the physical directory and PWD; a symbolic link keeps its name in PWD, while link/. gives the physical path; an exact environment controls PWD; a layered environment keeps the agent's PWD.
  • Sandbox stop. In sandbox mode, STOP answers STOPPED, and the agent process then exits 0.

What is needed:

  1. A fork-safe, test-only way to make the identity calls in spawn.rs succeed or fail without privileges, as the C harness's link-time stubs did.
  2. A setpriv shim through Paths.setpriv that can change the file system between the directory check and the exec.
  3. A scripted or real spawn path in the dispatch test harness.
  4. A pseudo-terminal helper in nvx-rs/tests/guest_tools.rs that drives a real agent through RESET and STOP, then reaps it.

Running these tests as root in CI would avoid (1) for the success paths, but unprivileged developers would then skip them.

Lingua principale
Python
Stelle
408
Fork
28
Merge medio
15h 20m
PR unite (30g)
301

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/nvx

Tutte le issue di microsoft/nvx

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.