Add support for bind mount options and clean up connector tests

connector_test.go

@@ -12,6 +12,7 @@
 	"testing"
 	"time"
 
+	"github.com/opencontainers/selinux/go-selinux"
 	"go.arcalot.io/assert"
 	log "go.arcalot.io/log/v2"
 	"go.flow.arcalot.io/deployer"
@@ -116,25 +117,16 @@
 }
 `
 
-func bindMountHelper(t *testing.T, options string) {
+func bindMountHelper(t *testing.T, options string, expectedPass bool) {
 	fileContent, err := os.ReadFile("./tests/volume/test_file.txt")
 	assert.NoError(t, err)
 
 	connector, _ := getConnector(t, fmt.Sprintf(volumeConfig, options))
 
-	if tests.IsRunningOnLinux() && options == "" {
-		// On Linux, when SELinux is enabled, then bind mounts without
-		// relabeling options will fail.  So, to test this case, disable
-		// SELinux on the test folder in order to make the file readable
-		// from within the container.
-		cmd := exec.Command("chcon", "-Rt", "svirt_sandbox_file_t", "./tests/volume")
-		var stderr bytes.Buffer
-		cmd.Stderr = &stderr
-		err = cmd.Run()
-		if err != nil {
-			t.Logf("chcon error: %s: %s", err.Error(), stderr.String())
-			t.Fail()
-		}
+	if tests.IsRunningOnLinux() && options == "" && selinux.GetEnabled() {
+		// On Linux, bind mounts without relabeling options will fail when
+		// SELinux is enabled.  So, reset expectations appropriately.
+		expectedPass = false
 	}
 
 	container, err := connector.Deploy(
@@ -149,25 +141,28 @@
 	// Note: If it ends up with length zero buffer, restarting the VM may help:
 	// https://stackoverflow.com/questions/71977532/podman-mount-host-volume-return-error-statfs-no-such-file-or-directory-in-ma
 	readBuffer := readOutputUntil(t, container, string(fileContent))
-	assert.Contains(t, string(readBuffer), string(fileContent))
+	assert.Equals(t, strings.Contains(string(readBuffer), string(fileContent)), expectedPass)
 }
 
 func TestBindMount(t *testing.T) {
-	scenarios := map[string]string{
-		"ReadOnly":   ":ro",
-		"Multiple":   ":ro,noexec",
-		"No options": "",
+	type param struct {
+		option       string
+		expectedPass bool
+	}
+	scenarios := map[string]param{
+		"ReadOnly":   param{":ro", true},
+		"Multiple":   param{":ro,noexec", true},
+		"No options": param{"", true},
 	}
-	//goland:noinspection GoBoolExpressions  // The linter cannot tell that this expression is not constant.
 	if tests.IsRunningOnLinux() {
 		// The SELinux options seem to cause problems on Mac OS X, so only test
 		// them on Linux.
-		scenarios["Private"] = ":Z"
-		scenarios["Shared"] = ":z"
+		scenarios["Private"] = param{":Z", true}
+		scenarios["Shared"] = param{":z", true}
 	}
-	for name, s := range scenarios {
-		options := s
-		t.Run(name, func(t *testing.T) { bindMountHelper(t, options) })
+	for name, p := range scenarios {
+		param := p
+		t.Run(name, func(t *testing.T) { bindMountHelper(t, param.option, param.expectedPass) })
 	}
 }
 
@@ -323,7 +318,6 @@
 }
 
 func TestHostCgroupNs(t *testing.T) {
-	//goland:noinspection GoBoolExpressions  // The linter cannot tell that this expression is not constant.
 	if !tests.IsRunningOnLinux() {
 		t.Skipf("Not running on Linux. Skipping cgroup test.")
 	}

go.mod

@@ -14,10 +14,12 @@ require (
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
+	golang.org/x/sys v0.1.0 // indirect
 	gotest.tools/v3 v3.5.1 // indirect
 )
 
 require (
+	github.com/opencontainers/selinux v1.11.0
 	go.arcalot.io/log/v2 v2.1.0
 	go.flow.arcalot.io/pluginsdk v0.8.0
 )

go.sum

@@ -10,6 +10,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
 github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
+github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
+github.com/opencontainers/selinux v1.11.0/go.mod h1:E5dMC3VPuVvVHDYmi78qvhJp8+M586T4DlDRYpFkyec=
 go.arcalot.io/assert v1.8.0 h1:hGcHMPncQXwQvjj7MbyOu2gg8VIBB00crUJZpeQOjxs=
 go.arcalot.io/assert v1.8.0/go.mod h1:nNmWPoNUHFyrPkNrD2aASm5yPuAfiWdB/4X7Lw3ykHk=
 go.arcalot.io/lang v1.1.0 h1:ugglRKpd3qIMkdghAjKJxsziIgHm8QpxrzZPSXoa08I=
@@ -20,6 +22,8 @@ go.flow.arcalot.io/deployer v0.5.0 h1:yXYogvL3shNBEEoTx9U9CNbfxuf8777uAH5Vn3hv1Y
 go.flow.arcalot.io/deployer v0.5.0/go.mod h1:whj8wOUursCnfZCt1a7eY5hU3EyOcUG48vM4NeAe5N8=
 go.flow.arcalot.io/pluginsdk v0.8.0 h1:cShsshrR17ZFLcbgi3aZvqexLttcp3JISFNqPUPuDvA=
 go.flow.arcalot.io/pluginsdk v0.8.0/go.mod h1:sk7ssInR/T+Gy+RSRr+QhKqZcECFFxMyn1hPQCTZSyU=
+golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=