From 9b1e84d88ee1d852421b442e9badf63b7cff9493 Mon Sep 17 00:00:00 2001
From: Simon McVittie <smcv@collabora.com>
Date: Mon, 15 Jun 2020 17:21:32 +0100
Subject: [PATCH] tests: Assert that various filesystems are mounted read-only

A possible future enhancement would be to have an option to mount some
of these (those that live in the mutable sysroot) read/write, but for
now any ad-hoc developer modifications will have to happen outside the
container.

Signed-off-by: Simon McVittie <smcv@collabora.com>
---
 tests/containers.py   |  1 +
 tests/inside-scout.py | 39 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/tests/containers.py b/tests/containers.py
index 6234ad404..acc0d9ada 100755
--- a/tests/containers.py
+++ b/tests/containers.py
@@ -404,6 +404,7 @@ class TestContainers(BaseTest):
                     '--',
                     'env',
                     'TEST_INSIDE_SCOUT_ARTIFACTS=' + artifacts,
+                    'TEST_INSIDE_SCOUT_IS_COPY=' + ('1' if copy else ''),
                     'TEST_INSIDE_SCOUT_LOCALES=' + ('1' if locales else ''),
                     'python3.5',
                     os.path.join(self.artifacts, 'tmp', 'inside-scout.py'),
diff --git a/tests/inside-scout.py b/tests/inside-scout.py
index b7e19585e..2df9c5625 100755
--- a/tests/inside-scout.py
+++ b/tests/inside-scout.py
@@ -5,6 +5,7 @@
 
 import contextlib
 import ctypes
+import errno
 import json
 import logging
 import os
@@ -541,6 +542,44 @@ class TestInsideScout(BaseTest):
                     set(arch_info['library-issues-summary']),
                 )
 
+    def test_read_only(self) -> None:
+        for read_only_place in (
+            '/bin',
+            '/etc/ld.so.conf.d',
+            '/lib',
+            '/overrides',
+            '/overrides/lib',
+            '/run/host/bin',
+            '/run/host/lib',
+            '/run/host/usr',
+            '/run/host/usr/bin',
+            '/run/host/usr/lib',
+            '/run/pressure-vessel/pv-from-host',
+            '/run/pressure-vessel/pv-from-host/bin',
+            '/sbin',
+            '/usr',
+            '/usr/lib',
+            '/usr/lib/pressure-vessel/from-host/bin',
+        ):
+            with self.subTest(read_only_place):
+                if (
+                    read_only_place.startswith('/overrides')
+                    and not os.getenv('TEST_INSIDE_SCOUT_IS_COPY')
+                ):
+                    # If we aren't working from a temporary copy of the
+                    # runtime, /overrides is on a tmpfs
+                    continue
+
+                with self.assertRaises(OSError) as raised:
+                    open(os.path.join(read_only_place, 'hello'), 'w')
+
+                if isinstance(raised.exception, FileNotFoundError):
+                    # Some of these paths don't exist under all
+                    # circumstances
+                    continue
+
+                self.assertEqual(raised.exception.errno, errno.EROFS)
+
 
 if __name__ == '__main__':
     assert sys.version_info >= (3, 5), 'Python 3.5+ is required'
-- 
GitLab