Repository: hashicorp/nomad
File: client/allocrunner/taskrunner/getter/sandbox_test.go (Go)

Code before:
	must.NoError(t, err)

	info, err := os.Stat(filepath.Join(taskDir, "local", "downloads"))
	must.NoError(t, err)

	uid := info.Sys().(*syscall.Stat_t).Uid
	must.Eq(t, 65534, uid) // nobody's conventional uid
}

func TestSandbox_Get_inspection(t *testing.T) {
	// These tests disable filesystem isolation as the
	// artifact inspection is what is being tested.
	testutil.RequireRoot(t)
	logger := testlog.HCLogger(t)

	// Create a temporary directory directly so the repos
	// don't end up being found improperly
	tdir, err := os.MkdirTemp("", "nomad-test")
	must.NoError(t, err, must.Sprint("failed to create top level local repo directory"))

	t.Run("symlink escaped sandbox", func(t *testing.T) {
		dir, err := os.MkdirTemp(tdir, "fake-repo")
		must.NoError(t, err, must.Sprint("failed to create local repo directory"))
		must.NoError(t, os.Symlink("/", filepath.Join(dir, "bad-file")), must.Sprint("could not create symlink in local repo"))
		srv := makeAndServeGitRepo(t, dir)
		t.Cleanup(srv.Close)

		artifact := &structs.TaskArtifact{
			RelativeDest: "local/symlink",
			GetterSource: fmt.Sprintf("git::%s/%s", srv.URL, filepath.Base(dir)),
		}

		t.Run("default", func(t *testing.T) {
			ac := artifactConfig(10 * time.Second)
			sbox := New(ac, logger)

			_, taskDir := SetupDir(t)
			env := noopTaskEnv(taskDir)
			sbox.ac.DisableFilesystemIsolation = true

			err := sbox.Get(env, artifact, "nobody")
			must.ErrorIs(t, err, ErrSandboxEscape)
		})

		t.Run("DisableArtifactInspection", func(t *testing.T) {
			ac := artifactConfig(10 * time.Second)
			sbox := New(ac, logger)

			_, taskDir := SetupDir(t)
			env := noopTaskEnv(taskDir)
			sbox.ac.DisableFilesystemIsolation = true

Review comment (refactor):
test design time: unless you ever want to stop the server mid-test, you could move this Cleanup into the helper

Code after:
	must.NoError(t, err)

	info, err := os.Stat(filepath.Join(taskDir, "local", "downloads"))
	must.NoError(t, err)

	uid := info.Sys().(*syscall.Stat_t).Uid
	must.Eq(t, 65534, uid) // nobody's conventional uid
}

func TestSandbox_Get_inspection(t *testing.T) {
	// These tests disable filesystem isolation as the
	// artifact inspection is what is being tested.
	testutil.RequireRoot(t)
	logger := testlog.HCLogger(t)

	// Create a temporary directory directly so the repos
	// don't end up being found improperly
	tdir, err := os.MkdirTemp("", "nomad-test")
	must.NoError(t, err, must.Sprint("failed to create top level local repo directory"))

	t.Run("symlink escaped sandbox", func(t *testing.T) {
		dir, err := os.MkdirTemp(tdir, "fake-repo")
		must.NoError(t, err, must.Sprint("failed to create local repo directory"))
		must.NoError(t, os.Symlink("/", filepath.Join(dir, "bad-file")), must.Sprint("could not create symlink in local repo"))
		srv := makeAndServeGitRepo(t, dir)

		artifact := &structs.TaskArtifact{
			RelativeDest: "local/symlink",
			GetterSource: fmt.Sprintf("git::%s/%s", srv.URL, filepath.Base(dir)),
		}

		t.Run("default", func(t *testing.T) {
			ac := artifactConfig(10 * time.Second)
			sbox := New(ac, logger)

			_, taskDir := SetupDir(t)
			env := noopTaskEnv(taskDir)
			sbox.ac.DisableFilesystemIsolation = true

			err := sbox.Get(env, artifact, "nobody")
			must.ErrorIs(t, err, ErrSandboxEscape)
		})

		t.Run("DisableArtifactInspection", func(t *testing.T) {
			ac := artifactConfig(10 * time.Second)
			sbox := New(ac, logger)

			_, taskDir := SetupDir(t)
			env := noopTaskEnv(taskDir)
			sbox.ac.DisableFilesystemIsolation = true
			sbox.ac.DisableArtifactInspection = true