add shellHook to permit tests with capability requirements

Author: mazunki

test.sh

@@ -67,23 +67,23 @@ build_chainloader(){
 }
 
 build_example(){
-  nix-build $CCACHE_FLAG example.nix
+  nix-build $CCACHE_FLAG unikernel.nix
 }
 
 multicore_subset(){
-  nix-shell --pure --arg smp true $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/smp --run ./test.py
+  nix-build ./unikernel.nix --arg smp true $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/smp --arg doCheck true
 
   # The following tests are not using multiple CPU's, but have been equippedd with some anyway
   # to make sure core functionality is not broken by missing locks etc. when waking up more cores.
-  nix-shell --pure --arg smp true $CCACHE_FLAG --argstr unikernel ./test/net/integration/udp --run ./test.py
-  nix-shell --pure --arg smp true $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/paging --run ./test.py
+  nix-shell ./unikernel.nix --arg smp true $CCACHE_FLAG --argstr unikernel ./test/net/integration/udp
+  nix-build ./unikernel.nix --arg smp true $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/paging --arg doCheck true
 }
 
 smoke_tests(){
-  nix-shell --pure $CCACHE_FLAG --argstr unikernel ./test/net/integration/udp --run ./test.py
-  nix-shell --pure $CCACHE_FLAG --argstr unikernel ./test/net/integration/tcp --run ./test.py
-  nix-shell --pure $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/paging --run ./test.py
-  nix-shell --pure $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/smp --run ./test.py
+  nix-build ./unikernel.nix $CCACHE_FLAG --argstr unikernel ./test/net/integration/udp
+  nix-build ./unikernel.nix $CCACHE_FLAG --argstr unikernel ./test/net/integration/tcp
+  nix-build ./unikernel.nix $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/paging --arg doCheck true
+  nix-build ./unikernel.nix $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/smp --arg doCheck true
 }
 
 run unittests "Build and run unit tests"
@@ -112,6 +112,7 @@ fi
 
 # Continuing from here will run all integration tests.
 
+sandboxed=true
 run_testsuite() {
   local base_folder="$1"
   shift
@@ -151,7 +152,11 @@ run_testsuite() {
 
 
     # The command to run, as string to be able to print the fully expanded command
-    cmd="nix-shell --pure $CCACHE_FLAG --argstr unikernel $subfolder --run ./test.py"
+    if $sandboxed; then
+      cmd="nix-build ./unikernel.nix $CCACHE_FLAG --argstr unikernel ${subfolder%/} --arg doCheck true"
+    else
+      cmd="nix-shell ./unikernel.nix $CCACHE_FLAG --argstr unikernel ${subfolder%/}"
+    fi
 
     echo ""
     echo "🚧 Step $steps.$substeps"
@@ -223,7 +228,9 @@ exclusions=(
   "websocket" # Linking fails, undefined ref to http_parser_parse_url, http_parser_execute
 )
 
+sandboxed=false
 run_testsuite "./test/net/integration" "${exclusions[@]}"
+sandboxed=true
 
 echo -e "\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
 

unikernel.nix

@@ -1,10 +1,12 @@
 {
-
   # The unikernel to build
   unikernel ? ./example,
 
+  # The test file to run
+  test ? "test.py",
+
   # Boot unikernel after building it
-  doCheck ? true,
+  doCheck ? false,
 
   # Which architecture to build against
   arch ? "x86_64",
@@ -20,12 +22,27 @@
 
   # The includeos library to build and link against
   includeos ? import ./default.nix { inherit withCcache; inherit smp; },
+
+  # vmrunner path, for vmrunner development
+  vmrunner ? "",
 }:
+let
+  absolutePathOf = base: p:
+    if p == null then null else
+    if builtins.isPath p then p
+    else builtins.toPath (base + "/${p}");
 
+  unikernelPath = absolutePathOf ./. unikernel;
+  vmrunnerPkg =
+    if vmrunner == "" then
+      includeos.vmrunner
+    else
+      includeos.pkgs.callPackage (builtins.toPath /. + vmrunner) {};
+in
 includeos.stdenv.mkDerivation rec {
   pname = "includeos_example";
   version = "dev";
-  src = includeos.pkgs.lib.cleanSource "${unikernel}";
+  src = includeos.pkgs.lib.cleanSource unikernelPath;
   dontStrip = true;
   inherit doCheck;
 
@@ -46,14 +63,58 @@ includeos.stdenv.mkDerivation rec {
     "-DFOR_PRODUCTION=${if forProduction then "ON" else "OFF"}"
   ];
 
+  installPhase = ''
+    runHook preInstall
+    find -mindepth 1 -maxdepth 1 -type f -exec install -v -D -t "$out/" {} \;
+    find -mindepth 2 -name '*.elf.bin' -exec install -v -t "$out/" {} \;
+    runHook postInstall
+  '';
+
+
   nativeCheckInputs = [
     includeos.vmrunner
+    includeos.pkgs.grub2
+    includeos.pkgs.python3
     includeos.pkgs.qemu
+    includeos.pkgs.iputils
+    includeos.pkgs.xorriso
+  ];
+
+  checkInputs = [
+    includeos.lest
   ];
 
+  # use `nix-build --arg doCheck true` to run tests normally
   checkPhase = ''
     runHook preCheck
-    boot *.elf.bin
+    set -e
+    if [ -e "${src}/${test}" ]; then
+      echo "Running IncludeOS test: ${src}/${test}"
+      python3 "${src}/${test}"
+    else
+      echo "Requested test, but no test was found 😟"
+      exit 1
+    fi
     runHook postCheck
   '';
+
+  # this is a hack
+  # some tests need to be run through a shell because of net_cap_raw+ep and net_cap_admin+ep
+  # replace nix-build with nix-shell to test without dropping capabilities
+  packages = [
+    (includeos.pkgs.python3.withPackages (p: [
+      vmrunnerPkg
+    ]))
+  ];
+  shellHook = ''
+    set -eu
+    pkg="$(nix-build ./unikernel.nix --arg doCheck false --arg unikernel ${unikernel})"
+
+    testPath="$(realpath "${unikernel}/${test}")"
+    cd "$pkg"
+    "$testPath" || exit 1
+
+    exit 0
+  '';
+
 }