tests/test_byoc_confinement.py

• confined_probe · function · L67-L83 — def confined_probe(tmp_path, monkeypatch)
• run · function · L74-L81 — def run(*, wrapped: bool = True) -> dict
• test_the_home_directory_is_unreadable_from_inside · function · L92-L98 — def test_the_home_directory_is_unreadable_from_inside(confined_probe)
• test_the_same_probe_succeeds_unconfined · function · L102-L107 — def test_the_same_probe_succeeds_unconfined(confined_probe)
• test_the_stage_directory_is_the_only_place_it_may_write · function · L111-L116 — def test_the_stage_directory_is_the_only_place_it_may_write(confined_probe)
• test_the_interpreter_can_still_start · function · L120-L125 — def test_the_interpreter_can_still_start(confined_probe)
• test_the_stage_path_is_canonicalised · function · L129-L136 — def test_the_stage_path_is_canonicalised()
• test_the_profile_denies_the_keychain_services · function · L144-L165 — def test_the_profile_denies_the_keychain_services()
• test_the_keychain_cannot_be_read_from_inside · function · L169-L224 — def test_the_keychain_cannot_be_read_from_inside(tmp_path)
• security · function · L181-L187 — def security(*args, wrapped: bool = False)
• test_the_self_test_probes_the_keychain_too · function · L228-L250 — def test_the_self_test_probes_the_keychain_too()
• test_an_unavailable_backend_says_why · function · L258-L265 — def test_an_unavailable_backend_says_why()
• test_wrapping_refuses_rather_than_returning_a_bare_argv · function · L268-L273 — def test_wrapping_refuses_rather_than_returning_a_bare_argv(monkeypatch)
• test_the_manager_reports_the_boundary_it_actually_applies · function · L276-L289 — def test_the_manager_reports_the_boundary_it_actually_applies(tmp_path)
• test_confinement_off_is_reported_as_a_deliberate_choice · function · L292-L304 — def test_confinement_off_is_reported_as_a_deliberate_choice(tmp_path, monkeypatch)
• test_the_linux_wrapper_replaces_the_home_directory · function · L312-L326 — def test_the_linux_wrapper_replaces_the_home_directory()
• test_the_linux_wrapper_binds_the_runtime_back_over_the_tmpfs · function · L329-L341 — def test_the_linux_wrapper_binds_the_runtime_back_over_the_tmpfs()
• test_the_linux_wrapper_makes_only_the_stage_writable · function · L344-L353 — def test_the_linux_wrapper_makes_only_the_stage_writable()
• test_the_linux_wrapper_isolates_the_pid_namespace · function · L356-L365 — def test_the_linux_wrapper_isolates_the_pid_namespace()
• test_the_linux_wrapper_masks_host_control_sockets · function · L368-L387 — def test_the_linux_wrapper_masks_host_control_sockets()
• test_the_linux_wrapper_rebinds_dns_config_hidden_by_the_run_tmpfs · function · L390-L410 — def test_the_linux_wrapper_rebinds_dns_config_hidden_by_the_run_tmpfs(monkeypatch)
• fake_realpath · function · L398-L401 — def fake_realpath(p, **kw): # os.path.realpath is shared (pathlib.resolve calls it with strict=), so # forward everything but the one path this test cares about.
• test_the_linux_wrapper_does_not_claim_network_isolation · function · L413-L421 — def test_the_linux_wrapper_does_not_claim_network_isolation()
• test_the_status_says_out_loud_that_the_network_is_not_isolated · function · L424-L439 — def test_the_status_says_out_loud_that_the_network_is_not_isolated( tmp_path, monkeypatch )
• test_the_host_supplies_the_anchor_the_probe_needs · function · L442-L446 — def test_the_host_supplies_the_anchor_the_probe_needs()
• test_the_helper_probe_reads_that_anchor · function · L449-L462 — def test_the_helper_probe_reads_that_anchor(monkeypatch, tmp_path)
• _FakeStat · class · L465-L467 — class _FakeStat
• init · method · L466-L467 — def init(self, ino: int) -> None
• _stat_seeing · function · L470-L486 — def _stat_seeing(present: dict, real=os.stat)
• fake · function · L478-L484 — def fake(path, a, *kw)
• test_the_probe_fails_closed_when_it_cannot_verify_the_boundary · function · L489-L523 — def test_the_probe_fails_closed_when_it_cannot_verify_the_boundary(monkeypatch)
• test_the_macos_probe_is_already_fail_closed · function · L526-L542 — def test_the_macos_probe_is_already_fail_closed(monkeypatch, tmp_path)
• _run_the_real_helper_path · function · L619-L642 — def _run_the_real_helper_path(tmp_path, mode: str) -> dict
• test_the_profile_keeps_the_helper_out_of_other_processes · function · L645-L655 — def test_the_profile_keeps_the_helper_out_of_other_processes()
• test_the_helper_is_started_in_its_own_session · function · L658-L696 — def test_the_helper_is_started_in_its_own_session(tmp_path, monkeypatch)
• _Proc · class · L672-L681 — class _Proc
• init · method · L675-L678 — def init(self) -> None
• wait · method · L680-L681 — def wait(self, timeout=None)
• fake_popen · function · L683-L685 — def fake_popen(argv, **kwargs)
• test_a_confined_helper_cannot_read_the_daemons_environment · function · L700-L716 — def test_a_confined_helper_cannot_read_the_daemons_environment(tmp_path)
• test_the_helper_is_not_execd_with_the_daemons_credentials · function · L720-L733 — def test_the_helper_is_not_execd_with_the_daemons_credentials(tmp_path)
• test_credential_shaped_variables_never_reach_the_helper_exec · function · L737-L805 — def test_credential_shaped_variables_never_reach_the_helper_exec( tmp_path, monkeypatch, confined )
• fake_spawn · function · L761-L764 — def fake_spawn(argv, creds, env, deadline, op, stage)