passt/test, branch 2026_09_25.df90211

pasta: Add --no-pidns to keep spawned command in caller's PID namespace

2026-09-16T08:54:02+00:00

This is to allow running pasta inside a container without unmasking
/proc for the whole container (Docker's --security-opt
systempaths=unconfined, Podman's --security-opt unmask=ALL), which is
undesirable as it exposes /proc/sysrq-trigger and other masked paths.

In spawn mode, pasta clones the command with CLONE_NEWPID and mounts a
new procfs instance on /proc, so that it matches the new PID namespace.

Mounting procfs in a new user namespace requires a fully visible,
unobstructed procfs. Container runtimes deliberately obstruct /proc
(Docker, for example, masks /proc/kcore and friends and mounts
/proc/sys read-only), so the mount is refused:

  Couldn't mount /proc: Operation not permitted

We only warn and continue, leaving the command in a new PID namespace
while the visible /proc still numbers processes in the outer one.
Anything resolving its own PID through /proc then fails, for example
bubblewrap:

  bwrap: open /proc/22/ns/ns failed: No such file or directory

Add a --no-pidns option: skip CLONE_NEWPID for the spawned command and
don't mount /proc, which is then not needed. User, network, mount, UTS
and IPC namespaces, --config-net and port forwarding are unaffected.
The option is rejected together with PID or --netns, as it only makes
sense when we spawn the command ourselves.

Add a test checking that, by default, the command runs in a new PID
namespace, and that --no-pidns keeps it in the caller's one.

Signed-off-by: Christian Korneck 
Signed-off-by: Stefano Brivio

treewide: Sandbox qrap

2026-07-28T16:09:54+00:00

No sunsetting or rightsizing for you, qrap: dig, bury, and cover.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

pasta: Regression test for bug 216

2026-07-23T09:47:08+00:00

Adds a test that asserts that when pasta is invoked via `unshare -r` in
standalone mode with `--netns-only` it does not print any warnings, and
the command executes successfully.

Link: https://bugs.passt.top/show_bug.cgi?id=216
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Dwayne B. Bent 
Reviewed-by: David Gibson 
Signed-off-by: Stefano Brivio

test: Add test for builds with -DNDEBUG

2026-05-16T15:05:56+00:00

Since bc872d91765d we omit assert()s if the NDEBUG preprocessor symbol is
defined, as is the case with the standard library assert(3).  However,
none of our tests verify that we can actually build that way.  Add an
extra test to test/build/build.py tto verify this.

Fixes: bc872d91765d ("treewide: Spell ASSERT() as assert()")
Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

test: Extend exeter build tests to cover more recent binaries

2026-05-16T14:57:37+00:00

test/build/build.py tests that the Makefile works to build our binaries.
However, it hasn't been updated for a while, and doesn't cover passt-repair
or pesto.  Extend it to cover those too.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

lib/term: Quote tr character ranges to prevent glob expansion

2026-05-16T13:50:52+00:00

Single-letter files in the working directory cause glob expansion of
unquoted tr character ranges like [A-Z] and [a-z].  When the shell
expands these against matching filenames, tr receives wrong arguments
and pane_or_context_run() hangs without errors.

Apply the same fix as in a36031a4d807 ("seccomp.sh: Quote tr character
ranges to prevent glob expansion"): quote all tr ranges in test/lib/term.

Signed-off-by: Laurent Vivier 
Reviewed-by: David Gibson 
Signed-off-by: Stefano Brivio

test: Include sshd-auth in mbuto guest image

2026-01-10T18:27:47+00:00

OpenSSH has split itself into several binaries for greater security.  We
already have logic to make sure we include the sshd-session binary.
OpenSSH 10 has added another: sshd-auth which we also need for a working
sshd within the guest.

Signed-off-by: David Gibson 
Reviewed-by: Laurent Vivier 
Signed-off-by: Stefano Brivio

test: Handle Operating System Command escapes in terminal output

2026-01-10T18:27:47+00:00

Our "old style" test script stuff uses raw terminal output scraped from
tmux.  This might include terminal escape sequences from the shell, or
whatever we run in it: they think they're talking to a terminal emulator
not a script, and they're not entirely incorrect.

In several places we filter out ANSI ESC-[ sequences to make this work.
However, this doesn't include ESC-] "Operating System Command" sequences.
Something I've updated in Fedora 43 generates heaps of these, which break
everything.

Add more hairy regexps to filter these out as well.

Signed-off-by: David Gibson 
Reviewed-by: Laurent Vivier 
Signed-off-by: Stefano Brivio

test: Update Makefile to avoid failing on missing images

2025-12-08T00:32:51+00:00

The image links may become invalid over time, so ignore download
errors to prevent 'make assets' from failing.

Link: https://bugs.passt.top/show_bug.cgi?id=150
Suggested-by: Stefano Brivio 
Signed-off-by: Yumei Huang 
Signed-off-by: Stefano Brivio

test: Expand tmux right status bar to fit pass/fail/skipped counter and time

2025-12-07T22:17:59+00:00

I recently realised I couldn't see seconds elapsing in asciinema test
recordings. That's because now that we display a SKIPPED counter, we
need some extra room for characters, 64 in total:

  PASS: xxx | FAIL: xxx | SKIPPED: xxx | YYYY-MM-DDThh:mm:ss+00:00

Fixes: 4234ace84cdf ("test: Display count of skipped tests in status and summary")
Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson