test(features): add the remaining CDI scenarios

Add the scenarios for read-only and read-write mounts, library parent
derivation, device nodes with and without a supplementary group, and a
unix socket, with one test per scenario in the cdi suite. Each test
delegates to the scenario wrapper, which checks the workload against the
expectations recorded in the spec.

Add the fixture machinery the scenarios need: a named group for the
device, pipe and character device fixture types, and the echo socket,
which a systemd service serves on every boot.

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

tests/suites/features/cdi/tests/injection.rs

@@ -19,3 +19,78 @@ use testkit::Context;
 async fn mount_under_read_only_baseline(cx: &mut Context) -> testkit::Result {
     cdi::scenario(cx, "mount-under-read-only-baseline").await
 }
+
+/// A read-only file mounted outside any directory the sandbox baseline
+/// grants. The spec's expectations record whether the workload can read it.
+#[testkit::test]
+async fn read_only_file(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "read-only-file").await
+}
+
+/// A read-only directory mounted outside the baseline grants. The
+/// expectations record whether its marker is readable and whether files can be
+/// created in it.
+#[testkit::test]
+async fn read_only_directory(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "read-only-directory").await
+}
+
+/// A mount named like a shared library, `libfixture.so.1`, under a directory of
+/// its own. The expectations record whether the library's parent directory is
+/// granted for the workload.
+#[testkit::test]
+async fn library_parent(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "library-parent").await
+}
+
+/// A mount named like a shared library directly under `/`. Granting its parent
+/// would grant the whole root, so the expectations record how that is handled.
+#[testkit::test]
+async fn broad_library_parent(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "broad-library-parent").await
+}
+
+/// A file the CDI spec mounts read-write. The expectations record whether the
+/// workload can read or write it.
+#[testkit::test]
+async fn writable_file(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "writable-file").await
+}
+
+/// A directory the CDI spec mounts read-write. The expectations record whether
+/// the workload can create files in it.
+#[testkit::test]
+async fn writable_directory(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "writable-directory").await
+}
+
+/// A bind mount whose options omit both `ro` and `rw`, so the access it grants
+/// is implicit. The expectations record how the workload can use it.
+#[testkit::test]
+async fn omitted_access_file(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "omitted-access-file").await
+}
+
+/// A character device node injected from `/dev/null` with read-write
+/// permissions. The expectations record whether a non-root workload can write
+/// it.
+#[testkit::test]
+async fn device_node(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "device-node").await
+}
+
+/// A device node that is mode 0660 and owned by a group only the spec's
+/// `additionalGids` grants. The expectations record whether the workload gets
+/// that group and can use the device.
+#[testkit::test]
+async fn device_node_with_gid(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "device-node-with-gid").await
+}
+
+/// A unix socket mounted on its own, without the directory it lives in. The
+/// expectations record that a sibling file in the host directory stays
+/// invisible.
+#[testkit::test]
+async fn unix_socket(cx: &mut Context) -> testkit::Result {
+    cdi::scenario(cx, "unix-socket").await
+}

tests/tmachine/ansible/roles/cdi_fixtures/tasks/scenarios.yaml

@@ -2,6 +2,13 @@
 # SPDX-License-Identifier: Apache-2.0
 
 ---
+- name: Allocate a supplementary group for the CDI device fixture
+  become: true
+  ansible.builtin.group:
+    name: openshell-cdi-fixture
+    system: true
+  register: cdi_fixture_group
+
 - name: Load named CDI scenarios
   ansible.builtin.include_vars:
     file: scenarios.yaml
@@ -45,6 +52,90 @@
   loop_control:
     label: "{{ item.path }}"
 
+- name: Create scenario fixture named pipes
+  become: true
+  ansible.builtin.command:
+    argv: [mkfifo, "--mode={{ item.mode }}", "{{ cdi_scenario_dir }}/{{ item.path }}"]
+    creates: "{{ cdi_scenario_dir }}/{{ item.path }}"
+  loop: "{{ cdi_scenario_fixtures | selectattr('type', 'eq', 'fifo') | list }}"
+  loop_control:
+    label: "{{ item.path }}"
+
+- name: Create scenario fixture character devices
+  become: true
+  ansible.builtin.command:
+    argv: [mknod, "{{ cdi_scenario_dir }}/{{ item.path }}", c, "{{ item.major }}", "{{ item.minor }}"]
+    creates: "{{ cdi_scenario_dir }}/{{ item.path }}"
+  loop: "{{ cdi_scenario_fixtures | selectattr('type', 'eq', 'chardev') | list }}"
+  loop_control:
+    label: "{{ item.path }}"
+
+- name: Set scenario fixture device ownership
+  become: true
+  ansible.builtin.file:
+    path: "{{ cdi_scenario_dir }}/{{ item.path }}"
+    owner: "{{ item.owner | default('root') }}"
+    group: "{{ item.group | default('root') }}"
+    mode: "{{ item.mode }}"
+  loop: "{{ cdi_scenario_fixtures | selectattr('type', 'in', ['chardev', 'fifo']) | list }}"
+  loop_control:
+    label: "{{ item.path }}"
+
+# A service that creates the socket, not a socket unit: on SELinux hosts systemd
+# labels a socket it creates from the policy's default for the path, which
+# denies /var/lib.
+- name: Check for systemd-socket-activate
+  ansible.builtin.stat:
+    path: /usr/bin/systemd-socket-activate
+  register: cdi_socket_activate
+
+- name: Require systemd-socket-activate for the socket fixture
+  ansible.builtin.assert:
+    that: [cdi_socket_activate.stat.exists]
+    fail_msg: systemd-socket-activate is not installed; the socket fixture needs it
+
+- name: Install the socket fixture unit
+  become: true
+  ansible.builtin.template:
+    src: openshell-cdi-echo.service.j2
+    dest: /etc/systemd/system/openshell-cdi-echo.service
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Start the persistent socket fixture
+  block:
+    - name: Start the socket fixture service
+      become: true
+      ansible.builtin.systemd_service:
+        name: openshell-cdi-echo.service
+        daemon_reload: true
+        enabled: true
+        state: restarted
+
+    - name: Wait for the socket fixture
+      become: true
+      ansible.builtin.wait_for:
+        path: "{{ cdi_scenario_dir }}/socket/echo.sock"
+        state: present
+        timeout: 15
+
+  rescue:
+    - name: Collect socket fixture diagnostics
+      become: true
+      ansible.builtin.shell: |
+        systemctl status openshell-cdi-echo.service --no-pager -l
+        journalctl -u openshell-cdi-echo.service --no-pager -n 40
+        ls -lZd {{ cdi_scenario_dir }}/socket
+        (ausearch -m avc,user_avc -ts recent 2>&1 || true) | tail -20
+      changed_when: false
+      failed_when: false
+      register: cdi_socket_diagnostics
+
+    - name: Report why the socket fixture did not start
+      ansible.builtin.fail:
+        msg: "openshell-cdi-echo.service did not start:\n{{ cdi_socket_diagnostics.stdout }}\n{{ cdi_socket_diagnostics.stderr }}"
+
 - name: Generate named CDI scenario devices
   become: true
   ansible.builtin.template:

tests/tmachine/ansible/roles/cdi_fixtures/templates/openshell-cdi-echo.service.j2

@@ -0,0 +1,16 @@
+{# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. #}
+{# SPDX-License-Identifier: Apache-2.0 #}
+[Unit]
+Description=OpenShell tmachine CDI Unix socket fixture
+After=local-fs.target
+
+[Service]
+# The socket is created by this process, not by PID 1, and `cat` echoes each
+# connection. A zero umask makes the socket connectable by any user.
+UMask=0000
+ExecStartPre=/bin/rm -f {{ cdi_scenario_dir }}/socket/echo.sock
+ExecStart=/usr/bin/systemd-socket-activate --listen={{ cdi_scenario_dir }}/socket/echo.sock --accept /bin/cat
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

tests/tmachine/ansible/roles/cdi_fixtures/vars/scenarios.yaml

@@ -10,7 +10,9 @@
 # Fixture `path` is relative to {{ cdi_fixture_root }}/scenarios. Types:
 #   dir     directory (parents must be declared first)
 #   file    regular file with `content`
-# Both accept `mode`, `owner` and `group`.
+#   fifo    named pipe
+#   chardev character device with `major` and `minor`
+# All accept `mode`, `owner` and `group`.
 #
 # `expect` records the behavior the CDI feature tests assert for the scenario,
 # and is rendered to {{ cdi_fixture_root }}/scenarios.json for them. It states
@@ -72,3 +74,152 @@ cdi_scenarios:
       checks:
         - {type: contents, path: /usr/share/tmachine-cdi/baseline-read-only-file, expect: tmachine-cdi-baseline-read-only-file}
         - {type: write, path: /usr/share/tmachine-cdi/baseline-read-only-file, expect: denied}
+
+  - name: read-only-file
+    fixtures:
+      - {path: read-only-file, type: file, content: "tmachine-cdi-read-only-file\n", mode: "0644"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/read-only-file"
+          containerPath: /tmachine-cdi/read-only/file
+          options: [bind, ro]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/read-only/file, expect: file}
+        - {type: read, path: /tmachine-cdi/read-only/file, expect: denied}
+        - {type: write, path: /tmachine-cdi/read-only/file, expect: denied}
+
+  - name: read-only-directory
+    fixtures:
+      - {path: read-only-directory, type: dir, mode: "0755"}
+      - {path: read-only-directory/marker, type: file, content: "tmachine-cdi-read-only-directory/marker\n", mode: "0644"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/read-only-directory"
+          containerPath: /tmachine-cdi/read-only/directory
+          options: [bind, ro]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/read-only/directory, expect: directory}
+        - {type: read, path: /tmachine-cdi/read-only/directory/marker, expect: denied}
+        - {type: write, path: /tmachine-cdi/read-only/directory/marker, expect: denied}
+        - {type: write, path: /tmachine-cdi/read-only/directory/new-file, expect: denied}
+
+  # Both library cases bind the same file; they differ in whether its parent
+  # directory is narrow or the container root.
+
+  - name: library-parent
+    fixtures:
+      - {path: libfixture.so.1, type: file, content: "tmachine-cdi-libfixture.so.1\n", mode: "0644"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/libfixture.so.1"
+          containerPath: /tmachine-cdi/library/libfixture.so.1
+          options: [bind, ro]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/library/libfixture.so.1, expect: file}
+        - {type: read, path: /tmachine-cdi/library/libfixture.so.1, expect: denied}
+        - {type: write, path: /tmachine-cdi/library/libfixture.so.1, expect: denied}
+
+  - name: broad-library-parent
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/libfixture.so.1"
+          containerPath: /libtmachinefixture.so.1
+          options: [bind, ro]
+    expect:
+      checks:
+        - {type: filetype, path: /libtmachinefixture.so.1, expect: file}
+        - {type: read, path: /libtmachinefixture.so.1, expect: denied}
+        - {type: write, path: /libtmachinefixture.so.1, expect: denied}
+
+  - name: writable-file
+    fixtures:
+      - {path: writable-file, type: file, content: "tmachine-cdi-original\n", mode: "0666"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/writable-file"
+          containerPath: /tmachine-cdi/writable/file
+          options: [bind, rw]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/writable/file, expect: file}
+        - {type: read, path: /tmachine-cdi/writable/file, expect: denied}
+        - {type: write, path: /tmachine-cdi/writable/file, expect: denied}
+
+  - name: writable-directory
+    fixtures:
+      - {path: writable-directory, type: dir, mode: "0777"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/writable-directory"
+          containerPath: /tmachine-cdi/writable/directory
+          options: [bind, rw]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/writable/directory, expect: directory}
+        - {type: write, path: /tmachine-cdi/writable/directory/probe, expect: denied}
+
+  - name: omitted-access-file
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/writable-file"
+          containerPath: /tmachine-cdi/writable/omitted-access
+          options: [bind]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/writable/omitted-access, expect: file}
+        - {type: read, path: /tmachine-cdi/writable/omitted-access, expect: denied}
+        - {type: write, path: /tmachine-cdi/writable/omitted-access, expect: denied}
+
+  - name: device-node
+    edits:
+      deviceNodes:
+        - path: /dev/tmachine-cdi-null
+          hostPath: /dev/null
+          permissions: rw
+    expect:
+      checks:
+        - {type: filetype, path: /dev/tmachine-cdi-null, expect: character-device}
+        - {type: non-root}
+        - {type: write, path: /dev/tmachine-cdi-null, expect: denied}
+
+  # The device is mode 0660 with a group that only `additionalGids` grants.
+  - name: device-node-with-gid
+    fixtures:
+      - {path: group-device, type: chardev, major: 1, minor: 3, mode: "0660", group: openshell-cdi-fixture}
+    edits:
+      additionalGids: ["{{ cdi_fixture_group.gid | int }}"]
+      deviceNodes:
+        - path: /dev/tmachine-cdi-group-null
+          hostPath: "{{ cdi_scenario_dir }}/group-device"
+          permissions: rw
+          uid: 0
+          gid: "{{ cdi_fixture_group.gid | int }}"
+          fileMode: 432
+    expect:
+      checks:
+        - {type: filetype, path: /dev/tmachine-cdi-group-null, expect: character-device}
+        - {type: non-root}
+        - {type: in-group-of, path: /dev/tmachine-cdi-group-null}
+        - {type: write, path: /dev/tmachine-cdi-group-null, expect: denied}
+
+  # The echo socket is served by the systemd service installed in scenarios.yaml.
+  # Its sibling file checks that only the socket path is exposed.
+
+  - name: unix-socket
+    fixtures:
+      - {path: socket, type: dir, mode: "0755"}
+      - {path: socket/sibling, type: file, content: "tmachine-cdi-socket/sibling\n", mode: "0644"}
+    edits:
+      mounts:
+        - hostPath: "{{ cdi_scenario_dir }}/socket/echo.sock"
+          containerPath: /tmachine-cdi/socket/echo.sock
+          options: [bind]
+    expect:
+      checks:
+        - {type: filetype, path: /tmachine-cdi/socket/echo.sock, expect: socket}
+        # Only the socket is mounted, so its sibling in the host directory is
+        # not visible. Connecting to the socket is not checked yet.
+        - {type: exists, path: /tmachine-cdi/socket/sibling, expect: false}