test(features): add the remaining CDI scenarios

Add the scenarios for read-only and read-write mounts, library parent
derivation, a device node, and a unix socket, with one test per scenario
in the cdi suite. Each test delegates to the scenario wrapper, which
checks the workload against the expectations recorded in the spec.

Add the fixture machinery the scenarios need: a pipe fixture type, a
host device node that a systemd service creates and labels on every
boot, and the echo socket, which a systemd service serves on every
boot. The node has the SELinux type of /dev/null so that a rootless
runtime, which bind-mounts it, can use it.

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

tests/suites/features/cdi/tests/injection.rs

@@ -19,3 +19,70 @@ use testkit::Context;
 async fn mount_under_read_only_baseline(cx: &mut Context) -> testkit::Result {
     cdi::scenario(cx, "mount-under-read-only-baseline").await
 }
+
+/// A read-only file mounted outside any directory the sandbox baseline
+/// grants. The spec's expectations record whether the workload can read it.
+#[testkit::test]
+async fn read_only_file(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "read-only-file").await
+}
+
+/// A read-only directory mounted outside the baseline grants. The
+/// expectations record whether its marker is readable and whether files can be
+/// created in it.
+#[testkit::test]
+async fn read_only_directory(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "read-only-directory").await
+}
+
+/// A mount named like a shared library, `libfixture.so.1`, under a directory of
+/// its own. The expectations record whether the library's parent directory is
+/// granted for the workload.
+#[testkit::test]
+async fn library_parent(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "library-parent").await
+}
+
+/// A mount named like a shared library directly under `/`. Granting its parent
+/// would grant the whole root, so the expectations record how that is handled.
+#[testkit::test]
+async fn broad_library_parent(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "broad-library-parent").await
+}
+
+/// A file the CDI spec mounts read-write. The expectations record whether the
+/// workload can read or write it.
+#[testkit::test]
+async fn writable_file(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "writable-file").await
+}
+
+/// A directory the CDI spec mounts read-write. The expectations record whether
+/// the workload can create files in it.
+#[testkit::test]
+async fn writable_directory(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "writable-directory").await
+}
+
+/// A bind mount whose options omit both `ro` and `rw`, so the access it grants
+/// is implicit. The expectations record how the workload can use it.
+#[testkit::test]
+async fn omitted_access_file(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "omitted-access-file").await
+}
+
+/// A character device node injected from `/dev/null` with read-write
+/// permissions. The expectations record whether a non-root workload can write
+/// it.
+#[testkit::test]
+async fn device_node(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "device-node").await
+}
+
+/// A unix socket mounted on its own, without the directory it lives in. The
+/// expectations record that a sibling file in the host directory stays
+/// invisible.
+#[testkit::test]
+async fn unix_socket(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "unix-socket").await
+}

tests/tmachine/ansible/roles/cdi_fixtures/tasks/scenarios.yaml

@@ -45,6 +45,127 @@
   loop_control:
     label: "{{ item.path }}"
 
+- name: Create scenario fixture named pipes
+  become: true
+  ansible.builtin.command:
+    argv: [mkfifo, "--mode={{ item.mode }}", "{{ cdi_scenario_dir }}/{{ item.path }}"]
+    creates: "{{ cdi_scenario_dir }}/{{ item.path }}"
+  loop: "{{ cdi_scenario_fixtures | selectattr('type', 'eq', 'fifo') | list }}"
+  loop_control:
+    label: "{{ item.path }}"
+
+- name: Set scenario fixture pipe ownership
+  become: true
+  ansible.builtin.file:
+    path: "{{ cdi_scenario_dir }}/{{ item.path }}"
+    owner: "{{ item.owner | default('root') }}"
+    group: "{{ item.group | default('root') }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ cdi_scenario_fixtures | selectattr('type', 'eq', 'fifo') | list }}"
+  loop_control:
+    label: "{{ item.path }}"
+
+# A service that creates the socket, not a socket unit: on SELinux hosts systemd
+# labels a socket it creates from the policy's default for the path, which
+# denies /var/lib.
+# A process creates a file with its directory's type, so the socket the service
+# creates inherits this one, and does so again on every boot. On SELinux hosts
+# (Fedora) a container cannot stat a socket of the default /usr/local type. The
+# file module ignores the type where SELinux is not enabled.
+- name: Label the socket fixture directory for containers
+  become: true
+  ansible.builtin.file:
+    path: "{{ cdi_scenario_dir }}/socket"
+    state: directory
+    setype: container_file_t
+
+- name: Check for systemd-socket-activate
+  ansible.builtin.stat:
+    path: /usr/bin/systemd-socket-activate
+  register: cdi_socket_activate
+
+- name: Require systemd-socket-activate for the socket fixture
+  ansible.builtin.assert:
+    that: [cdi_socket_activate.stat.exists]
+    fail_msg: systemd-socket-activate is not installed; the socket fixture needs it
+
+- name: Install the socket fixture unit
+  become: true
+  ansible.builtin.template:
+    src: openshell-cdi-echo.service.j2
+    dest: /etc/systemd/system/openshell-cdi-echo.service
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Start the persistent socket fixture
+  block:
+    - name: Start the socket fixture service
+      become: true
+      ansible.builtin.systemd_service:
+        name: openshell-cdi-echo.service
+        daemon_reload: true
+        enabled: true
+        state: restarted
+
+    - name: Wait for the socket fixture
+      become: true
+      ansible.builtin.wait_for:
+        path: "{{ cdi_scenario_dir }}/socket/echo.sock"
+        state: present
+        timeout: 15
+
+  rescue:
+    - name: Collect socket fixture diagnostics
+      become: true
+      ansible.builtin.shell: |
+        systemctl status openshell-cdi-echo.service --no-pager -l
+        journalctl -u openshell-cdi-echo.service --no-pager -n 40
+        ls -lZd {{ cdi_scenario_dir }}/socket
+        (ausearch -m avc,user_avc -ts recent 2>&1 || true) | tail -20
+      changed_when: false
+      failed_when: false
+      register: cdi_socket_diagnostics
+
+    - name: Report why the socket fixture did not start
+      ansible.builtin.fail:
+        msg: "openshell-cdi-echo.service did not start:\n{{ cdi_socket_diagnostics.stdout }}\n{{ cdi_socket_diagnostics.stderr }}"
+
+# The device-node scenario injects /dev/tmachine-cdi-null, a copy of /dev/null,
+# from a host node at the same path. A rootless runtime cannot create nodes, so
+# it bind-mounts the host node, and the container sees the host node's SELinux
+# type: it needs the type of /dev/null, which containers may use. /dev is
+# recreated on every boot, so a service creates and labels the node each time.
+# The label is ignored where SELinux is not enabled.
+- name: Install the host device node unit
+  become: true
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/openshell-cdi-device.service
+    content: |
+      [Unit]
+      Description=OpenShell tmachine CDI host device node fixture
+
+      [Service]
+      Type=oneshot
+      RemainAfterExit=yes
+      ExecStart=/bin/rm -f /dev/tmachine-cdi-null
+      ExecStart=/usr/bin/mknod --mode=0666 /dev/tmachine-cdi-null c 1 3
+      ExecStart=-/usr/bin/chcon --type=null_device_t /dev/tmachine-cdi-null
+
+      [Install]
+      WantedBy=multi-user.target
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Create the host device node
+  become: true
+  ansible.builtin.systemd_service:
+    name: openshell-cdi-device.service
+    daemon_reload: true
+    enabled: true
+    state: restarted
+
 - name: Generate named CDI scenario devices
   become: true
   ansible.builtin.template:

tests/tmachine/ansible/roles/cdi_fixtures/templates/openshell-cdi-echo.service.j2

@@ -0,0 +1,16 @@
+{# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. #}
+{# SPDX-License-Identifier: Apache-2.0 #}
+[Unit]
+Description=OpenShell tmachine CDI Unix socket fixture
+After=local-fs.target
+
+[Service]
+# The socket is created by this process, not by PID 1, and `cat` echoes each
+# connection. A zero umask makes the socket connectable by any user.
+UMask=0000
+ExecStartPre=/bin/rm -f {{ cdi_scenario_dir }}/socket/echo.sock
+ExecStart=/usr/bin/systemd-socket-activate --listen={{ cdi_scenario_dir }}/socket/echo.sock --accept /bin/cat
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

tests/tmachine/ansible/roles/cdi_fixtures/vars/scenarios.yaml

@@ -10,7 +10,8 @@
 # Fixture `path` is relative to {{ cdi_scenario_dir }}. Types:
 #   dir     directory (parents must be declared first)
 #   file    regular file with `content`
-# Both accept `mode`, `owner` and `group`.
+#   fifo    named pipe
+# All accept `mode`, `owner` and `group`.
 #
 # `expect` records the behavior the CDI feature tests assert for the scenario,
 # and is rendered to {{ cdi_fixture_root }}/scenarios.json for them. It states
@@ -72,3 +73,132 @@ cdi_scenarios:
       checks:
         - {type: contents, path: /usr/share/tmachine-cdi/baseline-read-only-file, expect: tmachine-cdi-baseline-read-only-file}
         - {type: write, path: /usr/share/tmachine-cdi/baseline-read-only-file, expect: denied}
+
+  - name: read-only-file
+    fixtures:
+      - {path: read-only-file, type: file, content: "tmachine-cdi-read-only-file\n", mode: "0644"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/read-only-file"
+          containerPath: /tmachine-cdi/read-only/file
+          options: [bind, ro]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/read-only/file, expect: file}
+        - {type: read, path: /tmachine-cdi/read-only/file, expect: denied}
+        - {type: write, path: /tmachine-cdi/read-only/file, expect: denied}
+
+  - name: read-only-directory
+    fixtures:
+      - {path: read-only-directory, type: dir, mode: "0755"}
+      - {path: read-only-directory/marker, type: file, content: "tmachine-cdi-read-only-directory/marker\n", mode: "0644"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/read-only-directory"
+          containerPath: /tmachine-cdi/read-only/directory
+          options: [bind, ro]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/read-only/directory, expect: directory}
+        - {type: read, path: /tmachine-cdi/read-only/directory/marker, expect: denied}
+        - {type: write, path: /tmachine-cdi/read-only/directory/marker, expect: denied}
+        - {type: write, path: /tmachine-cdi/read-only/directory/new-file, expect: denied}
+
+  # Both library cases bind the same file; they differ in whether its parent
+  # directory is narrow or the container root.
+
+  - name: library-parent
+    fixtures:
+      - {path: libfixture.so.1, type: file, content: "tmachine-cdi-libfixture.so.1\n", mode: "0644"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/libfixture.so.1"
+          containerPath: /tmachine-cdi/library/libfixture.so.1
+          options: [bind, ro]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/library/libfixture.so.1, expect: file}
+        - {type: read, path: /tmachine-cdi/library/libfixture.so.1, expect: denied}
+        - {type: write, path: /tmachine-cdi/library/libfixture.so.1, expect: denied}
+
+  - name: broad-library-parent
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/libfixture.so.1"
+          containerPath: /libtmachinefixture.so.1
+          options: [bind, ro]
+    expect:
+      checks:
+        - {type: filetype, path: /libtmachinefixture.so.1, expect: file}
+        - {type: read, path: /libtmachinefixture.so.1, expect: denied}
+        - {type: write, path: /libtmachinefixture.so.1, expect: denied}
+
+  - name: writable-file
+    fixtures:
+      - {path: writable-file, type: file, content: "tmachine-cdi-original\n", mode: "0666"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/writable-file"
+          containerPath: /tmachine-cdi/writable/file
+          options: [bind, rw]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/writable/file, expect: file}
+        - {type: read, path: /tmachine-cdi/writable/file, expect: denied}
+        - {type: write, path: /tmachine-cdi/writable/file, expect: denied}
+
+  - name: writable-directory
+    fixtures:
+      - {path: writable-directory, type: dir, mode: "0777"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/writable-directory"
+          containerPath: /tmachine-cdi/writable/directory
+          options: [bind, rw]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/writable/directory, expect: directory}
+        - {type: write, path: /tmachine-cdi/writable/directory/probe, expect: denied}
+
+  - name: omitted-access-file
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/writable-file"
+          containerPath: /tmachine-cdi/writable/omitted-access
+          options: [bind]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/writable/omitted-access, expect: file}
+        - {type: read, path: /tmachine-cdi/writable/omitted-access, expect: denied}
+        - {type: write, path: /tmachine-cdi/writable/omitted-access, expect: denied}
+
+  - name: device-node
+    edits:
+      # The host node is at the same path, created by tasks/scenarios.yaml.
+      deviceNodes:
+        - path: /dev/tmachine-cdi-null
+          permissions: rw
+    expect:
+      checks:
+        - {type: filetype, path: /dev/tmachine-cdi-null, expect: character-device}
+        - {type: non-root}
+        - {type: write, path: /dev/tmachine-cdi-null, expect: denied}
+
+  # The echo socket is served by the systemd service installed in scenarios.yaml.
+  # Its sibling file checks that only the socket path is exposed.
+
+  - name: unix-socket
+    fixtures:
+      - {path: socket, type: dir, mode: "0755"}
+      - {path: socket/sibling, type: file, content: "tmachine-cdi-socket/sibling\n", mode: "0644"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/socket/echo.sock"
+          containerPath: /tmachine-cdi/socket/echo.sock
+          options: [bind]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/socket/echo.sock, expect: socket}
+        # Only the socket is mounted, so its sibling in the host directory is
+        # not visible. Connecting to the socket is not checked yet.
+        - {type: exists, path: /tmachine-cdi/socket/sibling, expect: false}