REGTESTS: specify explicit chroot in confs using unix-stream servers

For convenience reasons, a small tens of tests make use of unix sockets
on server lines, and as such cannot be chrooted. Given that non-chrooted
startups are frowned upon and even emit a warning for privileged users,
let's explicitly use the recommended "chroot /" for them.

diff --git a/reg-tests/checks/extcheck.vtc b/reg-tests/checks/extcheck.vtc
index 619b6ac8d235ba23d88f0f5cea96f9d2d43eb6d5..16f1f00fb46efc4386590e1f1d9a9125cf0ef444 100644 (file)
--- a/reg-tests/checks/extcheck.vtc
+++ b/reg-tests/checks/extcheck.vtc
@@ -27,6 +27,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+        chroot /
         external-check
         insecure-fork-wanted
 

diff --git a/reg-tests/lua/lua_httpclient.vtc b/reg-tests/lua/lua_httpclient.vtc
index 25a6c3dad2a40bec8127beba58a61fc865792da1..2c468c11f7569cb0166b44ce87bf9b095e21bb69 100644 (file)
--- a/reg-tests/lua/lua_httpclient.vtc
+++ b/reg-tests/lua/lua_httpclient.vtc
@@ -41,6 +41,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+       chroot /
 
         tune.lua.openlibs string
         tune.lua.bool-sample-conversion normal
@@ -68,6 +69,8 @@ haproxy h1 -conf {
 } -start
 
 client c0 -connect ${h1_fe1_sock} {
+    # will cause the fe1 client to attempt a connection to each of these ports,
+    # the last one being a local UNIX socket (li1).
     txreq -url "/" -hdr "vtcport: ${s1_port}" -hdr "vtcport2: ${s2_port}" -hdr "vtcport3: unix@${tmpdir}/srv3"
     rxresp
     expect resp.status == 200

diff --git a/reg-tests/ssl/set_ssl_cert_bundle.vtc b/reg-tests/ssl/set_ssl_cert_bundle.vtc
index 37fc41b04c23025cc3037b0db230058b4ddbffa2..0a892984bf72c1f099d325043874e07c5599c92c 100644 (file)
--- a/reg-tests/ssl/set_ssl_cert_bundle.vtc
+++ b/reg-tests/ssl/set_ssl_cert_bundle.vtc
@@ -31,6 +31,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+       chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048

diff --git a/reg-tests/ssl/ssl_alpn.vtc b/reg-tests/ssl/ssl_alpn.vtc
index 7ad3c33e0197c1a22f109314f6b3aaf796ff483b..fa9c7780b9bd9001fcf2b1383f5aaf63bae82407 100644 (file)
--- a/reg-tests/ssl/ssl_alpn.vtc
+++ b/reg-tests/ssl/ssl_alpn.vtc
@@ -14,6 +14,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+       chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048

diff --git a/reg-tests/ssl/ssl_curves.vtc b/reg-tests/ssl/ssl_curves.vtc
index 340ea2ddd7da20654aa6fa799f9287a9a4d5c70c..75be6e6029228e4a2932ea5c82fd5d53da6dfebf 100644 (file)
--- a/reg-tests/ssl/ssl_curves.vtc
+++ b/reg-tests/ssl/ssl_curves.vtc
@@ -42,6 +42,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+       chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048

diff --git a/reg-tests/ssl/ssl_errors.vtc b/reg-tests/ssl/ssl_errors.vtc
index 55ef811ffd2279f1e1e377bcac474e935dc73b6c..25fa0ee8f560c2b53b64b6a6eb80810e47c60cd0 100644 (file)
--- a/reg-tests/ssl/ssl_errors.vtc
+++ b/reg-tests/ssl/ssl_errors.vtc
@@ -171,6 +171,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+       chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048

diff --git a/reg-tests/ssl/ssl_generate_certificate.vtc b/reg-tests/ssl/ssl_generate_certificate.vtc
index 3144d6e914abdecbc77dfcef26eb47133e528a22..918074ebbb5a3d37f73761095e16e1bc4884ac65 100644 (file)
--- a/reg-tests/ssl/ssl_generate_certificate.vtc
+++ b/reg-tests/ssl/ssl_generate_certificate.vtc
@@ -36,6 +36,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+       chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048

diff --git a/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc b/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
index 94a3b61aa6d0ca35b9e6d49fcee935f6a46af05d..1cd408e852735e1f0dc5c9e846c8fa52c121f532 100644 (file)
--- a/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
+++ b/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
@@ -23,6 +23,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+       chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048

diff --git a/reg-tests/ssl/verifyhost_san.vtc b/reg-tests/ssl/verifyhost_san.vtc
index 1bdf88fdfc5d7620f03f341b108a288ed5cc369d..5d56e35a8c07241e22cebb87d84bd8b7e968d9cf 100644 (file)
--- a/reg-tests/ssl/verifyhost_san.vtc
+++ b/reg-tests/ssl/verifyhost_san.vtc
@@ -20,6 +20,7 @@ haproxy h1 -conf {
         thread-groups 1
     .endif
         stats socket "${tmpdir}/h1/stats" level admin
+       chroot /
 
     defaults
         mode http