Skip to content

Make log pipe test tolerate restricted kernels - #13431

Merged
bneradt merged 1 commit into
apache:masterfrom
bneradt:log-pipe-permission-test
Jul 31, 2026
Merged

Make log pipe test tolerate restricted kernels#13431
bneradt merged 1 commit into
apache:masterfrom
bneradt:log-pipe-permission-test

Conversation

@bneradt

@bneradt bneradt commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Some CI environments do not permit unprivileged processes to increase
FIFO buffer sizes, even when the requested size is below the system
maximum. The log_pipe AuTest treats this kernel policy as a product
failure and cannot run in those environments.

This makes the test accept only the corresponding Operation not permitted diagnostic when the FIFO remains unchanged, while continuing
to reject other errors and fatal diagnostics. It also waits briefly for
asynchronous diagnostic output before deciding whether the size check
failed.

Some CI environments do not permit unprivileged processes to increase
FIFO buffer sizes, even when the requested size is below the system
maximum. The log_pipe AuTest treats this kernel policy as a product
failure and cannot run in those environments.

This makes the test accept only the corresponding `Operation not
permitted` diagnostic when the FIFO remains unchanged, while continuing
to reject other errors and fatal diagnostics. It also waits briefly for
asynchronous diagnostic output before deciding whether the size check
failed.
Copilot AI review requested due to automatic review settings July 25, 2026 22:19
@bneradt bneradt added this to the 11.0.0 milestone Jul 25, 2026
@bneradt bneradt self-assigned this Jul 25, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

tests/gold_tests/logging/pipe_buffer_is_larger_than.py:61

  • The diags log scan can raise a UnicodeDecodeError (or match an unrelated permission error) and incorrectly fail or pass the verifier. It’s safer to decode with replacement and to require that the permission error corresponds to the specific FIFO being checked.
        for _ in range(50):
            if os.path.exists(diags_log):
                with open(diags_log, encoding='utf-8') as diags:
                    diagnostics = diags.read()
                    if "Set pipe size failed" in diagnostics and "Operation not permitted" in diagnostics:
                        print("Success. The kernel denied increasing the pipe buffer for the unprivileged ATS user.")
                        return 0
            time.sleep(0.1)

tests/gold_tests/logging/log_pipe.test.py:136

  • The negative-lookahead currently only permits the exact string immediately after "ERROR:". If the diags log includes timestamps/tags between "ERROR:" and the message, the allowed "Operation not permitted" line will still be treated as an unexpected error. Consider allowing arbitrary text after "ERROR:" before the permitted substring, and also re-adding the default "Unrecognized configuration value" exclusion since disable_log_checks disables it.
ts.Disk.diags_log.Content += Testers.ExcludesExpression(
    r"ERROR:(?! Set pipe size failed for pipe .*: Operation not permitted)", "The diagnostics should contain no unexpected errors.")
ts.Disk.diags_log.Content += Testers.ExcludesExpression("FATAL:", "The diagnostics should contain no fatal errors.")

@maskit maskit left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks reasonable.

@bneradt
bneradt merged commit f063c0e into apache:master Jul 31, 2026
15 checks passed
@bneradt
bneradt deleted the log-pipe-permission-test branch July 31, 2026 22:05
@github-project-automation github-project-automation Bot moved this to For v10.2.0 in ATS v10.2.x Jul 31, 2026
cmcfarlen pushed a commit that referenced this pull request Aug 4, 2026
Some CI environments do not permit unprivileged processes to increase
FIFO buffer sizes, even when the requested size is below the system
maximum. The log_pipe AuTest treats this kernel policy as a product
failure and cannot run in those environments.

This makes the test accept only the corresponding `Operation not
permitted` diagnostic when the FIFO remains unchanged, while continuing
to reject other errors and fatal diagnostics. It also waits briefly for
asynchronous diagnostic output before deciding whether the size check
failed.

(cherry picked from commit f063c0e)
@cmcfarlen cmcfarlen moved this from For v10.2.0 to Picked v10.2.0 in ATS v10.2.x Aug 4, 2026
@cmcfarlen cmcfarlen modified the milestones: 11.0.0, 10.2.0 Aug 4, 2026
@cmcfarlen

Copy link
Copy Markdown
Contributor

Cherry-picked to the 10.2.x branch as 9bafe09 for the 10.2.0 release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Picked v10.2.0

Development

Successfully merging this pull request may close these issues.

4 participants