containerization (#3)

Co-authored-by: Floweynt <50057682+Floweynt@users.noreply.github.com>
Co-authored-by: Autumn Liu <al63244@my.utexas.edu>
Reviewed-on: #3
Co-authored-by: autumn <aut.tea7@gmail.com>

tests/server-n0/integration.py

@@ -27,6 +27,7 @@ if TYPE_CHECKING:
     HOST_ADDR: dict[str, str] = {}
     IFACE: dict[str, str] = {}
     KIND: dict[str, str] = {}
+    DEVICES: dict[str, list[str]] = {}
     EDGES: list[tuple[str, str, list[int], list[int]]] = []
     SSH_KEY: str = ""
     SSH_OPTS: str = ""
@@ -55,6 +56,11 @@ def container_pid(name):
     return server.succeed(f"machinectl show {name} -p Leader --value").strip()
 
 
+def ct_cmd(name, cmd):
+    pid = container_pid(name)
+    return f"{NSENTER} --mount=/proc/{pid}/ns/mnt --root=/proc/{pid}/root -- {SH} -c '{cmd}'"
+
+
 def net_cmd(name, cmd):
     pid = container_pid(name)
     return f"{NSENTER} --net=/proc/{pid}/ns/net -- {cmd}"
@@ -323,3 +329,27 @@ with subtest("(functional): published ports follow the container's lifetime"):
     server.succeed("systemctl start container@nginx")
     server.wait_for_unit("container@nginx.service")
     internet.wait_until_succeeds(ext_connect(80), timeout=30)
+
+with subtest("(functional): declared devices are usable in-container"):
+    for name, devices in DEVICES.items():
+        for dev in devices:
+            if server.execute(f"test -e {dev}")[0] != 0:
+                # host lacks the device (e.g. /dev/kvm without nested
+                # virtualization, as in this test's own VM) - nspawn skips
+                # populating it in-container, so there's nothing to check.
+                continue
+            # opened, not stat'd: without DeviceAllow= the node is still visible
+            server.succeed(ct_cmd(name, f"exec 3<> {dev}"))
+
+
+with subtest("(isolation): devices reach only the container that declared them"):
+    for name in enterable:
+        for dev in {d for ds in DEVICES.values() for d in ds} - set(DEVICES.get(name, [])):
+            server.fail(ct_cmd(name, f"test -e {dev}"))
+
+
+with subtest("(isolation): identity uid mapping keeps the user namespace"):
+    for name in (n for n, ds in DEVICES.items() if ds):
+        host_ns = server.succeed("readlink /proc/1/ns/user").strip()
+        ct_ns = server.succeed(f"readlink /proc/{container_pid(name)}/ns/user").strip()
+        assert host_ns != ct_ns, f"{name} shares the host user namespace"