From a37109ce02c54d07e0d1f1cb348627f9675d84df Mon Sep 17 00:00:00 2001
From: Kir Kolyshkin <kolyshkin@gmail.com>
Date: Thu, 30 Mar 2023 14:33:04 -0700
Subject: [PATCH] tests/int/mount: fix issues with ro cgroup test

Fix the following issues with the "ro /sys/fs/cgroup" test:

1. Disable bogus SC2016 warning from shellcheck.

2. Split the test into two -- with and without cgroupns. This is done
   because not all systems have cgroupns available (so the "+cgroupns"
   test will be skipped).

3. This splitting resulted in a few more bogus shellcheck warnings that
   we have to suppress -- due to a known bug in shellcheck (see [1]).

4. s/mount/mounts/ in the test name, because in case of cgroup v1 there
   are multiple mounts.

[1] https://github.com/koalaman/shellcheck/issues/2431

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
---
 tests/integration/mounts.bats | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/tests/integration/mounts.bats b/tests/integration/mounts.bats
index 1e72c5b14..9ecf87ccf 100644
--- a/tests/integration/mounts.bats
+++ b/tests/integration/mounts.bats
@@ -64,19 +64,28 @@ function teardown() {
 	[ "$status" -eq 0 ]
 }
 
+@test "runc run [ro /sys/fs/cgroup mounts]" {
+	# Without cgroup namespace.
+	update_config '.linux.namespaces -= [{"type": "cgroup"}]'
+	test_ro_cgroup_mount
+}
+
+# shellcheck disable=SC2030
+@test "runc run [ro /sys/fs/cgroup mounts + cgroupns]" {
+	requires cgroupns
+	# With cgroup namespace.
+	update_config '.linux.namespaces |= if index({"type": "cgroup"}) then . else . + [{"type": "cgroup"}] end'
+	test_ro_cgroup_mount
+}
+
 # https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc
-@test "runc run [ro /sys/fs/cgroup mount]" {
-	# With cgroup namespace
+# shellcheck disable=SC2031
+function test_ro_cgroup_mount() {
+	local lines status
+	# shellcheck disable=SC2016
 	update_config '.process.args |= ["sh", "-euc", "for f in `grep /sys/fs/cgroup /proc/mounts | awk \"{print \\\\$2}\"| uniq`; do grep -w $f /proc/mounts | tail -n1; done"]'
 	runc run test_busybox
 	[ "$status" -eq 0 ]
 	[ "${#lines[@]}" -ne 0 ]
 	for line in "${lines[@]}"; do [[ "${line}" == *'ro,'* ]]; done
-
-	# Without cgroup namespace
-	update_config '.linux.namespaces -= [{"type": "cgroup"}]'
-	runc run test_busybox
-	[ "$status" -eq 0 ]
-	[ "${#lines[@]}" -ne 0 ]
-	for line in "${lines[@]}"; do [[ "${line}" == *'ro,'* ]]; done
 }