1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
//! Security isolation tests for evalbox-sandbox.
//!
//! These tests verify that the sandbox correctly isolates processes and
//! blocks dangerous operations. Most tests require user namespace permissions.
//!
//! ## Running Tests
//!
//! ```bash
//! # Build first (compiles C payloads)
//! cargo build -p evalbox-sandbox
//!
//! # Run unit tests (no special permissions)
//! cargo test -p evalbox-sandbox
//!
//! # Run security tests (require user namespaces)
//! cargo test -p evalbox-sandbox --test security_tests --ignored
//!
//! # Run specific test with output
//! cargo test -p evalbox-sandbox --test security_tests test_ptrace_blocked --ignored -- --nocapture
//! ```
//!
//! ## Test Categories
//!
//! - **seccomp**: Verify dangerous syscalls are blocked (ptrace, mount, reboot)
//! - **filesystem**: Verify filesystem isolation (/etc/shadow, /root not accessible)
//! - **network**: Verify network is blocked by default
//! - **resources**: Verify limits work (timeout, memory, pids, output)
//! - **cve**: Verify real-world CVE attack vectors are blocked