Repository: containerd/containerd
File: pkg/oci/spec_test.go (Go)

Code before:
		case "cgroup":
			foundCgroup = true
			var found bool
			for _, o := range m.Options {
				switch o {
				case "ro":
					t.Errorf("Found unexpected read only %s mount", m.Type)
				case "rw":
					found = true
				}
			}
			if !found {
				t.Errorf("Did not find rw mount option for %s", m.Type)
			}
		}
	}
	if !foundSys {
		t.Error("Did not find mount for sysfs")
	}
	if !foundCgroup {
		t.Error("Did not find mount for cgroupfs")
	}
}

func TestOpenUserFile_AbsoluteSymlink(t *testing.T) {
	tmpDir := t.TempDir()

	targetName := "passwd"
	targetPath := filepath.Join(tmpDir, targetName)
	expectedContent := []byte("root:x:0:0:root:/root:/bin/bash")
	if err := os.WriteFile(targetPath, expectedContent, 0644); err != nil {
		t.Fatal(err)
	}

	linkName := "abs_link"
	linkPath := filepath.Join(tmpDir, linkName)
	if err := os.Symlink(targetPath, linkPath); err != nil {
		t.Fatal(err)
	}

	rootFS := os.DirFS(tmpDir)

	f, err := openUserFile(rootFS, linkName)
	if err != nil {
		t.Fatalf("openUserFile failed on absolute symlink: %v", err)
	}
	defer f.Close()

	content, err := io.ReadAll(f)
	if err != nil {
		t.Fatal(err)

Review comment (bug):
I think this test doesn't trigger readlink logic becase they are in the same folder. 
Please consider using fstest to build test case. It's easy to read, like this.

```go
func TestOpenUserFile_AbsoluteSymlink(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("absolute symlink handling is only supported on non-Windows platforms")
	}

	expectedContent := []byte("root:x:0:0:root:/root:/bin/bash" + t.Name())

	root := t.TempDir()
	if err := fstest.Apply(
		fstest.CreateDir("/etc", 0o755),
		fstest.CreateDir("/nix/store/abcd", 0o755),
		fstest.CreateFile("/nix/store/abcd/passwd", expectedContent, 0o644),
		// /etc/passwd -> /nix/store/abcd/passwd (absolute symlink)
		fstest.Symlink("/nix/store/abcd/passwd", "/etc/passwd"),
	).Apply(root); err != nil {
		t.Fatal(err)
	}

	rootFS := os.DirFS(root)
	if _, ok := rootFS.(readLinker); !ok {
		t.Logf("os.DirFS does not implement ReadLink; wrapping to use ReadLink")
		rootFS = readLinkFS{root: root, fs: rootFS}
	}

	f, err := openUserFile(rootFS, "etc/passwd")
	if err != nil {
		t.Fatalf("openUserFile failed on absolute symlink: %v", err)
	}
	defer f.Close()

	content, err := io.ReadAll(f)
	if err != nil {
		t.Fatal(err)
	}
	if string(content) != string(expectedContent) {
		t.Errorf("expected content %q, got %q", string(expectedContent), string(content))
	}
}

type readLinkFS struct {
	root string
	fs   fs.FS
}

func (r readLinkFS) Open(name string) (fs.File, error) {
	return r.fs.Open(name)
}

func (r readLinkFS) ReadLink(name string) (string, error) {
	return os.Readlink(filepath.Join(r.root, filepath.FromSlash(name)))
}
```

Code after:
			}
		case "cgroup":
			foundCgroup = true
			var found bool
			for _, o := range m.Options {
				switch o {
				case "ro":
					t.Errorf("Found unexpected read only %s mount", m.Type)
				case "rw":
					found = true
				}
			}
			if !found {
				t.Errorf("Did not find rw mount option for %s", m.Type)
			}
		}
	}
	if !foundSys {
		t.Error("Did not find mount for sysfs")
	}
	if !foundCgroup {
		t.Error("Did not find mount for cgroupfs")
	}
}

func TestOpenUserFile_AbsoluteSymlink(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("absolute symlink handling is only supported on non-Windows platforms")
	}

	expectedContent := []byte("root:x:0:0:root:/root:/bin/bash" + t.Name())

	root := t.TempDir()
	// Use 'continuity' library to create a directory structure simulating NixOS
	if err := fstest.Apply(
		fstest.CreateDir("/etc", 0o755),
		fstest.CreateDir("/nix/store/abcd", 0o755),
		fstest.CreateFile("/nix/store/abcd/passwd", expectedContent, 0o644),
		// /etc/passwd -> /nix/store/abcd/passwd (absolute symlink)
		fstest.Symlink("/nix/store/abcd/passwd", "/etc/passwd"),
	).Apply(root); err != nil {
		t.Fatal(err)
	}

	rootFS := os.DirFS(root)

	// Ensure the FS implements the ReadLink interface.
	// If the native os.DirFS doesn't implement it (depending on Go version),
	// wrap it in our readLinkFS helper.
	if _, ok := rootFS.(readLinker); !ok {
		t.Logf("os.DirFS does not implement ReadLink; wrapping to use ReadLink")