@@ -291,20 +291,23 @@ systemd-run --wait --pipe "${ARGUMENTS[@]}" \
291291#
292292# Note: running instrumented binaries requires at least /proc to be accessible, so let's
293293# skip the test when we're running under sanitizers
294+ #
295+ # Note: $GCOV_ERROR_LOG is used during coverage runs to suppress errors when creating *.gcda files,
296+ # since gcov can't access the restricted filesystem (as expected)
294297if [[ ! -v ASAN_OPTIONS ]] && systemctl --version | grep " +BPF_FRAMEWORK" && kernel_supports_lsm bpf; then
295298 ROOTFS=" $( df --output=fstype /usr/bin | sed --quiet 2p) "
296299 systemd-run --wait --pipe -p RestrictFileSystems=" " ls /
297300 systemd-run --wait --pipe -p RestrictFileSystems=" $ROOTFS foo bar" ls /
298301 (! systemd-run --wait --pipe -p RestrictFileSystems=" $ROOTFS " ls /proc)
299- (! systemd-run --wait --pipe -p RestrictFileSystems=" foo" ls /)
302+ (! systemd-run --wait --pipe -p GCOV_ERROR_LOG=/dev/null -p RestrictFileSystems=" foo" ls /)
300303 systemd-run --wait --pipe -p RestrictFileSystems=" $ROOTFS foo bar baz proc" ls /proc
301304 systemd-run --wait --pipe -p RestrictFileSystems=" $ROOTFS @foo @basic-api" ls /proc
302305 systemd-run --wait --pipe -p RestrictFileSystems=" $ROOTFS @foo @basic-api" ls /sys/fs/cgroup
303306
304307 systemd-run --wait --pipe -p RestrictFileSystems=" ~" ls /
305308 systemd-run --wait --pipe -p RestrictFileSystems=" ~proc" ls /
306309 systemd-run --wait --pipe -p RestrictFileSystems=" ~@basic-api" ls /
307- (! systemd-run --wait --pipe -p RestrictFileSystems=" ~$ROOTFS " ls /)
310+ (! systemd-run --wait --pipe -p GCOV_ERROR_LOG=/dev/null -p RestrictFileSystems=" ~$ROOTFS " ls /)
308311 (! systemd-run --wait --pipe -p RestrictFileSystems=" ~proc" ls /proc)
309312 (! systemd-run --wait --pipe -p RestrictFileSystems=" ~@basic-api" ls /proc)
310313 (! systemd-run --wait --pipe -p RestrictFileSystems=" ~proc foo @bar @basic-api" ls /proc)
0 commit comments