//go:build linux

package host

import (
	"fmt"
	"os"
	"path/filepath"
	"testing"
)

func TestPlan14GenerationKernelRetainedNamespaceMount(t *testing.T) {
	for _, fs := range []string{"tmpfs", "nsfs"} {
		t.Run(fs, func(t *testing.T) {
			f := generationProc(t)
			b := f.reservation.Binding
			mounts := fmt.Sprintf("1 0 %d:%d / / rw - tmpfs tmpfs rw\n", generationMajor(b.TreeIdentity.Device), generationMinor(b.TreeIdentity.Device))
			// A namespace bind mount survives its last task and descriptor.
			// Its device differs from the release tree and its path names no build.
			mounts += fmt.Sprintf("2 1 0:999 / /retained-namespace rw shared:7 - %s %s rw\n", fs, fs)
			generationWrite(t, f.task+"/mountinfo", mounts)
			k := generationKernel{proc: f.proc}
			if _, err := k.absent(t.Context(), f.reservation); (err == nil) != (fs == "tmpfs") {
				t.Errorf("retirement with %s mount: %v", fs, err)
			}
			tree := filepath.Dir(filepath.Dir(b.Tree))
			if _, _, err := k.census(t.Context(), tree); (err == nil) != (fs == "tmpfs") {
				t.Errorf("completeness with %s mount: %v", fs, err)
			}
		})
	}
}

func TestPlan14GenerationKernelCensusUnknownReference(t *testing.T) {
	for _, attack := range []string{"none", "unreserved-executable", "unreserved-sibling", "uncontained", "namespace"} {
		t.Run(attack, func(t *testing.T) {
			f := generationProc(t)
			tree := filepath.Dir(filepath.Dir(f.reservation.Binding.Tree))
			other := filepath.Join(tree, "unreserved", "other")
			if err := os.MkdirAll(filepath.Dir(other), 0700); err != nil {
				t.Fatal(err)
			}
			generationWrite(t, other, "unknown build")
			switch attack {
			case "unreserved-executable":
				generationRelink(t, other, f.task+"/exe")
			case "unreserved-sibling":
				generationLink(t, other, f.task+"/fd/7")
			case "uncontained":
				generationWrite(t, f.task+"/status", "Uid:\t1001\t1001\t1001\t1001\nKthread:\t0\n")
			case "namespace":
				generationRelink(t, "foreign", f.task+"/ns/mnt")
			}
			boot, digest, err := (generationKernel{proc: f.proc}).census(t.Context(), tree)
			if attack == "none" {
				if err != nil || boot == "" || len(digest) != 64 {
					t.Fatalf("positive: %s %s %v", boot, digest, err)
				}
			} else if err == nil {
				t.Fatal("unknown kernel obligation certified")
			}
		})
	}
}