From: Willy Tarreau <w@1wt.eu>
Date: Wed, 9 Sep 2026 16:29:58 +0000 (+0200)
Subject: REGTESTS: specify explicit chroot in confs using unix-stream servers
X-Git-Tag: v3.5-dev7~49
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=7be73f6758cdef48d214cf79dc5b8b9ec4c8cfee;p=haproxy.git

REGTESTS: specify explicit chroot in confs using unix-stream servers

For convenience reasons, a small tens of tests make use of unix sockets
on server lines, and as such cannot be chrooted. Given that non-chrooted
startups are frowned upon and even emit a warning for privileged users,
let's explicitly use the recommended "chroot /" for them.
---

diff --git a/reg-tests/checks/extcheck.vtc b/reg-tests/checks/extcheck.vtc
index 619b6ac8d..16f1f00fb 100644
--- a/reg-tests/checks/extcheck.vtc
+++ b/reg-tests/checks/extcheck.vtc
@@ -27,6 +27,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+        chroot /
         external-check
         insecure-fork-wanted
 
diff --git a/reg-tests/lua/lua_httpclient.vtc b/reg-tests/lua/lua_httpclient.vtc
index 25a6c3dad..2c468c11f 100644
--- a/reg-tests/lua/lua_httpclient.vtc
+++ b/reg-tests/lua/lua_httpclient.vtc
@@ -41,6 +41,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+	chroot /
 
         tune.lua.openlibs string
         tune.lua.bool-sample-conversion normal
@@ -68,6 +69,8 @@ haproxy h1 -conf {
 } -start
 
 client c0 -connect ${h1_fe1_sock} {
+    # will cause the fe1 client to attempt a connection to each of these ports,
+    # the last one being a local UNIX socket (li1).
     txreq -url "/" -hdr "vtcport: ${s1_port}" -hdr "vtcport2: ${s2_port}" -hdr "vtcport3: unix@${tmpdir}/srv3"
     rxresp
     expect resp.status == 200
diff --git a/reg-tests/ssl/set_ssl_cert_bundle.vtc b/reg-tests/ssl/set_ssl_cert_bundle.vtc
index 37fc41b04..0a892984b 100644
--- a/reg-tests/ssl/set_ssl_cert_bundle.vtc
+++ b/reg-tests/ssl/set_ssl_cert_bundle.vtc
@@ -31,6 +31,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+	chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048
diff --git a/reg-tests/ssl/ssl_alpn.vtc b/reg-tests/ssl/ssl_alpn.vtc
index 7ad3c33e0..fa9c7780b 100644
--- a/reg-tests/ssl/ssl_alpn.vtc
+++ b/reg-tests/ssl/ssl_alpn.vtc
@@ -14,6 +14,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+	chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048
diff --git a/reg-tests/ssl/ssl_curves.vtc b/reg-tests/ssl/ssl_curves.vtc
index 340ea2ddd..75be6e602 100644
--- a/reg-tests/ssl/ssl_curves.vtc
+++ b/reg-tests/ssl/ssl_curves.vtc
@@ -42,6 +42,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+	chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048
diff --git a/reg-tests/ssl/ssl_errors.vtc b/reg-tests/ssl/ssl_errors.vtc
index 55ef811ff..25fa0ee8f 100644
--- a/reg-tests/ssl/ssl_errors.vtc
+++ b/reg-tests/ssl/ssl_errors.vtc
@@ -171,6 +171,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+	chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048
diff --git a/reg-tests/ssl/ssl_generate_certificate.vtc b/reg-tests/ssl/ssl_generate_certificate.vtc
index 3144d6e91..918074ebb 100644
--- a/reg-tests/ssl/ssl_generate_certificate.vtc
+++ b/reg-tests/ssl/ssl_generate_certificate.vtc
@@ -36,6 +36,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+	chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048
diff --git a/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc b/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
index 94a3b61aa..1cd408e85 100644
--- a/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
+++ b/reg-tests/ssl/tls12_ssl_crt-list_filters.vtc
@@ -23,6 +23,7 @@ haproxy h1 -conf {
     .if feature(THREAD)
         thread-groups 1
     .endif
+	chroot /
 
     .if !ssllib_name_startswith(AWS-LC)
         tune.ssl.default-dh-param 2048
diff --git a/reg-tests/ssl/verifyhost_san.vtc b/reg-tests/ssl/verifyhost_san.vtc
index 1bdf88fdf..5d56e35a8 100644
--- a/reg-tests/ssl/verifyhost_san.vtc
+++ b/reg-tests/ssl/verifyhost_san.vtc
@@ -20,6 +20,7 @@ haproxy h1 -conf {
         thread-groups 1
     .endif
         stats socket "${tmpdir}/h1/stats" level admin
+	chroot /
 
     defaults
         mode http