Skip to content

Commit 4cc55d7

Browse files
ammarioammario
committed
Fix macOS fork permission issue
1 parent 7670a41 commit 4cc55d7

2 files changed

Lines changed: 140 additions & 138 deletions

File tree

‎.github/workflows/tests.yml‎

Lines changed: 137 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ name: Tests
22

33
on:
44
push:
5-
branches: [ main ]
5+
branches: [main]
66
pull_request:
7-
branches: [ main ]
7+
branches: [main]
88

99
env:
1010
CARGO_TERM_COLOR: always
@@ -14,158 +14,158 @@ jobs:
1414
test-macos:
1515
name: macOS Integration Tests
1616
runs-on: macos-latest
17-
17+
1818
steps:
19-
- uses: actions/checkout@v4
20-
21-
- name: Install Rust
22-
uses: dtolnay/rust-toolchain@stable
23-
with:
24-
toolchain: stable
25-
26-
- name: Cache cargo registry
27-
uses: actions/cache@v3
28-
with:
29-
path: ~/.cargo/registry
30-
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
31-
restore-keys: |
32-
${{ runner.os }}-cargo-registry-
33-
34-
- name: Cache cargo index
35-
uses: actions/cache@v3
36-
with:
37-
path: ~/.cargo/git
38-
key: ${{ runner.os }}-cargo-git-${{ hashFiles('**/Cargo.lock') }}
39-
restore-keys: |
40-
${{ runner.os }}-cargo-git-
41-
42-
- name: Cache cargo build
43-
uses: actions/cache@v3
44-
with:
45-
path: target
46-
key: ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
47-
restore-keys: |
48-
${{ runner.os }}-cargo-build-
49-
50-
- name: Build
51-
run: cargo build --verbose
52-
53-
- name: Run unit tests
54-
run: cargo test --bins --verbose
55-
56-
- name: Run smoke tests
57-
run: cargo test --test smoke_test --verbose
58-
59-
- name: Run weak mode tests
60-
run: cargo test --test weak_integration --verbose
61-
62-
- name: Run macOS integration tests (with sudo)
63-
run: |
64-
# The tests require root privileges for PF rules on macOS
65-
# GitHub Actions provides passwordless sudo on macOS runners
66-
sudo cargo test --test macos_integration --verbose
19+
- uses: actions/checkout@v4
20+
21+
- name: Install Rust
22+
uses: dtolnay/rust-toolchain@stable
23+
with:
24+
toolchain: stable
25+
26+
- name: Cache cargo registry
27+
uses: actions/cache@v3
28+
with:
29+
path: ~/.cargo/registry
30+
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
31+
restore-keys: |
32+
${{ runner.os }}-cargo-registry-
33+
34+
- name: Cache cargo index
35+
uses: actions/cache@v3
36+
with:
37+
path: ~/.cargo/git
38+
key: ${{ runner.os }}-cargo-git-${{ hashFiles('**/Cargo.lock') }}
39+
restore-keys: |
40+
${{ runner.os }}-cargo-git-
41+
42+
- name: Cache cargo build
43+
uses: actions/cache@v3
44+
with:
45+
path: target
46+
key: ${{ runner.os }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
47+
restore-keys: |
48+
${{ runner.os }}-cargo-build-
49+
50+
- name: Build
51+
run: cargo build --verbose
52+
53+
- name: Run unit tests
54+
run: cargo test --bins --verbose
55+
56+
- name: Run smoke tests
57+
run: cargo test --test smoke_test --verbose
58+
59+
- name: Run weak mode tests
60+
run: cargo test --test weak_integration --verbose
61+
62+
- name: Run macOS integration tests (with sudo)
63+
run: |
64+
# The tests require root privileges for PF rules on macOS
65+
# GitHub Actions provides passwordless sudo on macOS runners
66+
sudo cargo test --test macos_integration --verbose
6767
6868
test-linux:
6969
name: Linux Tests
7070
runs-on: ubuntu-latest
7171
strategy:
7272
matrix:
73-
rust: [stable, nightly]
74-
73+
rust: [stable]
74+
7575
steps:
76-
- uses: actions/checkout@v4
77-
78-
- name: Install Rust
79-
uses: dtolnay/rust-toolchain@stable
80-
with:
81-
toolchain: ${{ matrix.rust }}
82-
83-
- name: Cache cargo registry
84-
uses: actions/cache@v3
85-
with:
86-
path: ~/.cargo/registry
87-
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
88-
restore-keys: |
89-
${{ runner.os }}-cargo-registry-
90-
91-
- name: Cache cargo index
92-
uses: actions/cache@v3
93-
with:
94-
path: ~/.cargo/git
95-
key: ${{ runner.os }}-cargo-git-${{ hashFiles('**/Cargo.lock') }}
96-
restore-keys: |
97-
${{ runner.os }}-cargo-git-
98-
99-
- name: Cache cargo build
100-
uses: actions/cache@v3
101-
with:
102-
path: target
103-
key: ${{ runner.os }}-${{ matrix.rust }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
104-
restore-keys: |
105-
${{ runner.os }}-${{ matrix.rust }}-cargo-build-
106-
107-
- name: Build
108-
run: cargo build --verbose
109-
110-
- name: Run unit tests
111-
run: cargo test --bins --verbose
112-
113-
- name: Run smoke tests
114-
run: cargo test --test smoke_test --verbose
115-
116-
- name: Run weak mode tests
117-
run: cargo test --test weak_integration --verbose
118-
119-
- name: Run jail integration tests
120-
run: cargo test --test jail_integration --verbose
121-
76+
- uses: actions/checkout@v4
77+
78+
- name: Install Rust
79+
uses: dtolnay/rust-toolchain@stable
80+
with:
81+
toolchain: ${{ matrix.rust }}
82+
83+
- name: Cache cargo registry
84+
uses: actions/cache@v3
85+
with:
86+
path: ~/.cargo/registry
87+
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
88+
restore-keys: |
89+
${{ runner.os }}-cargo-registry-
90+
91+
- name: Cache cargo index
92+
uses: actions/cache@v3
93+
with:
94+
path: ~/.cargo/git
95+
key: ${{ runner.os }}-cargo-git-${{ hashFiles('**/Cargo.lock') }}
96+
restore-keys: |
97+
${{ runner.os }}-cargo-git-
98+
99+
- name: Cache cargo build
100+
uses: actions/cache@v3
101+
with:
102+
path: target
103+
key: ${{ runner.os }}-${{ matrix.rust }}-cargo-build-${{ hashFiles('**/Cargo.lock') }}
104+
restore-keys: |
105+
${{ runner.os }}-${{ matrix.rust }}-cargo-build-
106+
107+
- name: Build
108+
run: cargo build --verbose
109+
110+
- name: Run unit tests
111+
run: cargo test --bins --verbose
112+
113+
- name: Run smoke tests
114+
run: cargo test --test smoke_test --verbose
115+
116+
- name: Run weak mode tests
117+
run: cargo test --test weak_integration --verbose
118+
119+
- name: Run jail integration tests
120+
run: cargo test --test jail_integration --verbose
121+
122122
# Note: Linux jail tests that require root are not run in CI
123123
# as they need iptables/nftables configuration which is complex in containers
124124

125125
clippy:
126126
name: Clippy
127127
runs-on: ubuntu-latest
128-
128+
129129
steps:
130-
- uses: actions/checkout@v4
131-
132-
- name: Install Rust
133-
uses: dtolnay/rust-toolchain@stable
134-
with:
135-
toolchain: stable
136-
components: clippy
137-
138-
- name: Cache cargo registry
139-
uses: actions/cache@v3
140-
with:
141-
path: ~/.cargo/registry
142-
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
143-
restore-keys: |
144-
${{ runner.os }}-cargo-registry-
145-
146-
- name: Cache cargo index
147-
uses: actions/cache@v3
148-
with:
149-
path: ~/.cargo/git
150-
key: ${{ runner.os }}-cargo-git-${{ hashFiles('**/Cargo.lock') }}
151-
restore-keys: |
152-
${{ runner.os }}-cargo-git-
153-
154-
- name: Run clippy
155-
run: cargo clippy -- -D warnings
130+
- uses: actions/checkout@v4
131+
132+
- name: Install Rust
133+
uses: dtolnay/rust-toolchain@stable
134+
with:
135+
toolchain: stable
136+
components: clippy
137+
138+
- name: Cache cargo registry
139+
uses: actions/cache@v3
140+
with:
141+
path: ~/.cargo/registry
142+
key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }}
143+
restore-keys: |
144+
${{ runner.os }}-cargo-registry-
145+
146+
- name: Cache cargo index
147+
uses: actions/cache@v3
148+
with:
149+
path: ~/.cargo/git
150+
key: ${{ runner.os }}-cargo-git-${{ hashFiles('**/Cargo.lock') }}
151+
restore-keys: |
152+
${{ runner.os }}-cargo-git-
153+
154+
- name: Run clippy
155+
run: cargo clippy -- -D warnings
156156

157157
fmt:
158158
name: Format
159159
runs-on: ubuntu-latest
160-
160+
161161
steps:
162-
- uses: actions/checkout@v4
163-
164-
- name: Install Rust
165-
uses: dtolnay/rust-toolchain@stable
166-
with:
167-
toolchain: stable
168-
components: rustfmt
169-
170-
- name: Check formatting
171-
run: cargo fmt -- --check
162+
- uses: actions/checkout@v4
163+
164+
- name: Install Rust
165+
uses: dtolnay/rust-toolchain@stable
166+
with:
167+
toolchain: stable
168+
components: rustfmt
169+
170+
- name: Check formatting
171+
run: cargo fmt -- --check

‎src/jail/macos/fork.rs‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,9 +131,11 @@ mod tests {
131131
// This test would need to run as root to properly test GID setting
132132
// For now, just test that the function compiles and basic execution works
133133
unsafe {
134+
// Use current GID to avoid permission issues
135+
let current_gid = libc::getgid();
134136
let result = fork_exec_with_gid(
135137
&vec!["echo".to_string(), "test".to_string()],
136-
0, // Use current GID
138+
current_gid,
137139
None, // No UID change
138140
&[],
139141
);

0 commit comments

Comments
 (0)