search

flux-framework / flux-security

Independent project for Flux security code and APIs.
GNU Lesser General Public License v3.0
0 stars 7 forks source link

IMP exec test framework #47

Open grondo opened 6 years ago

grondo commented 6 years ago

A strategy or framework is required for testing of the flux-imp exec subcommand. The test framework should allow the functionality of the exec command to be at least partially tested in simulated environments, e.g. run under fake or manufactured resource hierarchy ensure the IMP works when it should and fails properly when the resource configuration should not allow 3rd party execution.

Ideally the test framework could be fed a set of simulated environments and IMP inputs and ensure the results matches the set of desired outcomes for ease of test development.

grondo commented 6 years ago

It occurs to me that there is a clear testing delineation between tests for the base flux-imp exec functionality and tests for the containment and other IMP plugins that are part of exec and which may require privilege. We'd have to think through this, but I think the former probably does not require privilege, and tests of the core exec functionality could be driven from make check without sudo, perhaps using a set of testing containment plugins built just for this purpose.

Tests for the real containment and other privilege plugins will perhaps require a different scope and different framework (one that will require privileged operation), though it will still be very important to have a good strategy for standalone testing here, as that will be invaluable for plugin developers to test their implementations to at least some extent outside of a real flux environment. More thought needed here.