test: drop mocklibc (#461)

* test: drop mocklibc

Let's get rid of mocklibc and replace it with a simple combination of
mount & user namespaces + bind mount to replace the host's /etc with our
own version.

This means we don't $LD_PRELOAD the mocklibc DSO, but instead run each
unit test through a very simple python wrapper that sets up a temporary
user & mount namespace through the unshare() syscall,  gains "fake" root
using uid_map and gid_map, overmounts /etc in this new namespace (with
our own custom test files), and then executes the test binary itself.
Check user_namespaces(7) for more information about the namespace
shenanigans.

* Replace duk_error() with duk_push_error_object() + duk_throw()

duk_error() never returns, so the error string gets leaked every time an error
is thrown. Let's avoid this by creating the error object first without throwing
it, freeing the original error string (we don't need it anymore since it gets
sprintf-ed into the error object), and then throwing the error object from top
of the current context stack.

 =================================================================
==1270==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 231 byte(s) in 2 object(s) allocated from:
    #0 0x7f3a489258b7 in malloc (/lib64/libasan.so.8+0xf68b7) (BuildId: 388cbb99455c2e2eaec79bd8db6d9a78eb39f80d)
    #1 0x7f3a47b27487 in __vasprintf_internal (/lib64/libc.so.6+0x8a487) (BuildId: 4a92fcedbba6d6d2629ce066a2970017faa9995e)
    #2 0x7f3a484b06a2 in g_vasprintf (/lib64/libglib-2.0.so.0+0xb16a2) (BuildId: 795136df3faa85587229ddc59d709f81d6f697df)
    #3 0x7f3a48480a92 in g_strdup_vprintf (/lib64/libglib-2.0.so.0+0x81a92) (BuildId: 795136df3faa85587229ddc59d709f81d6f697df)
    #4 0x7f3a48480b50 in g_strdup_printf (/lib64/libglib-2.0.so.0+0x81b50) (BuildId: 795136df3faa85587229ddc59d709f81d6f697df)
    #5 0x41fcec in js_polkit_spawn ../src/polkitbackend/polkitbackendduktapeauthority.c:1090
    #6 0x7f3a483b31b8 in duk__handle_call_raw.lto_priv.0 (/lib64/libduktape.so.207+0x2a1b8) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #7 0x7f3a483962e1 in duk__js_execute_bytecode_inner.lto_priv.0 (/lib64/libduktape.so.207+0xd2e1) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #8 0x7f3a483b33eb in duk_js_execute_bytecode (/lib64/libduktape.so.207+0x2a3eb) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #9 0x7f3a483b319d in duk__handle_call_raw.lto_priv.0 (/lib64/libduktape.so.207+0x2a19d) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #10 0x7f3a48399ab0 in duk__pcall_prop_raw (/lib64/libduktape.so.207+0x10ab0) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #11 0x7f3a483b23cc in duk_handle_safe_call.lto_priv.0 (/lib64/libduktape.so.207+0x293cc) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #12 0x7f3a483972e8 in duk_pcall_prop (/lib64/libduktape.so.207+0xe2e8) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #13 0x41d048 in runaway_killer_thread_call_js ../src/polkitbackend/polkitbackendduktapeauthority.c:682
    #14 0x7f3a4888cb45 in asan_thread_start(void*) (/lib64/libasan.so.8+0x5db45) (BuildId: 388cbb99455c2e2eaec79bd8db6d9a78eb39f80d)

Direct leak of 128 byte(s) in 1 object(s) allocated from:
    #0 0x7f3a489247b8 in realloc.part.0 (/lib64/libasan.so.8+0xf57b8) (BuildId: 388cbb99455c2e2eaec79bd8db6d9a78eb39f80d)
    #1 0x7f3a4846304a in g_realloc (/lib64/libglib-2.0.so.0+0x6404a) (BuildId: 795136df3faa85587229ddc59d709f81d6f697df)
    #2 0x7f3a48481b19 in g_string_expand (/lib64/libglib-2.0.so.0+0x82b19) (BuildId: 795136df3faa85587229ddc59d709f81d6f697df)
    #3 0x7f3a48481b90 in g_string_sized_new (/lib64/libglib-2.0.so.0+0x82b90) (BuildId: 795136df3faa85587229ddc59d709f81d6f697df)
    #4 0x41fb0f in js_polkit_spawn ../src/polkitbackend/polkitbackendduktapeauthority.c:1099
    #5 0x7f3a483b31b8 in duk__handle_call_raw.lto_priv.0 (/lib64/libduktape.so.207+0x2a1b8) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #6 0x7f3a483962e1 in duk__js_execute_bytecode_inner.lto_priv.0 (/lib64/libduktape.so.207+0xd2e1) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #7 0x7f3a483b33eb in duk_js_execute_bytecode (/lib64/libduktape.so.207+0x2a3eb) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #8 0x7f3a483b319d in duk__handle_call_raw.lto_priv.0 (/lib64/libduktape.so.207+0x2a19d) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #9 0x7f3a48399ab0 in duk__pcall_prop_raw (/lib64/libduktape.so.207+0x10ab0) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #10 0x7f3a483b23cc in duk_handle_safe_call.lto_priv.0 (/lib64/libduktape.so.207+0x293cc) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #11 0x7f3a483972e8 in duk_pcall_prop (/lib64/libduktape.so.207+0xe2e8) (BuildId: a9f661ee1766489794e9ece7cfd0d6a7fb420ccb)
    #12 0x41d048 in runaway_killer_thread_call_js ../src/polkitbackend/polkitbackendduktapeauthority.c:682
    #13 0x7f3a4888cb45 in asan_thread_start(void*) (/lib64/libasan.so.8+0x5db45) (BuildId: 388cbb99455c2e2eaec79bd8db6d9a78eb39f80d)

SUMMARY: AddressSanitizer: 359 byte(s) leaked in 3 allocation(s).

* packit: run unit tests during package build

.github/workflows/ci.sh

@@ -75,8 +75,7 @@ case "$PHASE" in
             -Db_lundef=false \
             "${COMMON_BUILD_OPTS[@]}"
 
-        # Note: we need to set verify_asan_link_order=0 as polkit LD_PRELOADs libmocklibc in unit tests
-        export ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1:verify_asan_link_order=0
+        export ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1
         export UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1
 
         meson compile -C build -v

.github/workflows/ci.yml

@@ -16,7 +16,9 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: registry.fedoraproject.org/fedora:latest
+    container:
+      image: registry.fedoraproject.org/fedora:latest
+      options: "--privileged"
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.phase }}-${{ matrix.js_engine }}
       cancel-in-progress: true

.packit/polkit.spec

@@ -23,6 +23,8 @@ BuildRequires: dbus-devel
 BuildRequires: pkgconfig(duktape)
 BuildRequires: meson
 BuildRequires: git
+BuildRequires: python3-dbus
+BuildRequires: python3-dbusmock
 
 Requires: dbus, polkit-pkla-compat
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
@@ -88,9 +90,10 @@ Libraries files for polkit.
        -D introspection=true \
        -D man=true \
        -D session_tracking=logind \
-       -D tests=false
+       -D tests=true
 
 %meson_build
+%meson_test
 
 %install
 %meson_install

src/polkitbackend/polkitbackendduktapeauthority.c

@@ -1130,7 +1130,12 @@ js_polkit_spawn (duk_context *cx)
     g_main_context_unref (context);
 
   if (err_str)
-    duk_error (cx, DUK_ERR_ERROR, err_str);
+    {
+      duk_push_error_object (cx, DUK_ERR_ERROR, err_str);
+      free (err_str);
+      duk_throw (cx);
+      g_assert_not_reached ();
+    }
 
   return ret;
 }

test/meson.build

@@ -10,17 +10,8 @@ libpolkit_test_helper_dep = declare_dependency(
   link_with: libpolkit_test_helper,
 )
 
-libmocklibc = subproject('mocklibc').get_variable('libmocklibc')
-
+test_wrapper = find_program('wrapper.py')
 test_data_dir = meson.current_source_dir() / 'data'
-test_etc_dir = test_data_dir / 'etc'
-
-test_env = environment()
-test_env.set('LD_PRELOAD', libmocklibc.full_path())
-test_env.set('MOCK_PASSWD', test_etc_dir / 'passwd')
-test_env.set('MOCK_GROUP', test_etc_dir / 'group')
-test_env.set('MOCK_NETGROUP', test_etc_dir / 'netgroup')
-test_env.set('POLKIT_TEST_DATA', test_data_dir)
 
 subdir('polkit')
 if not get_option('libs-only')

test/polkit/meson.build

@@ -20,8 +20,8 @@ foreach test_unit: test_units
 
   test(
     test_unit,
-    exe,
-    env: test_env,
-    is_parallel: false,
+    test_wrapper,
+    args: ['--data-dir', test_data_dir, exe.full_path()],
+    timeout: 30,
   )
 endforeach

test/polkitbackend/meson.build

@@ -10,9 +10,6 @@ c_flags = [
   '-D_POLKIT_BACKEND_COMPILATION',
 ]
 
-test_env.set('TOP_BUILD_DIR', build_root)
-test_env.set('TOP_SRC_DIR', source_root)
-
 exe = executable(
   test_unit,
   test_unit + '.c',
@@ -22,16 +19,9 @@ exe = executable(
   link_with: libpolkit_backend,
 )
 
-prog = find_program('polkitbackendjsauthoritytest-wrapper.py')
-
-if not get_option('b_sanitize').split(',').contains('address')
-  test(
-    test_unit,
-    prog,
-    env: test_env,
-    is_parallel: false,
-    timeout: 90,
-  )
-else
-  warning('@0@ is not (yet) compatible with AddressSanitizer, skipping'.format(test_unit))
-endif
+test(
+  test_unit,
+  test_wrapper,
+  args: ['--data-dir', test_data_dir, '--mock-dbus', exe.full_path()],
+  timeout: 90,
+)