amadan
Roll notes: kernel test commands runnable under /tmp/k/zddr3
The edge-hardening test needs TMPDIR under /tmp to check PrivateTmp, and TestStrictKernel needs a mode and CARLOS_STRICT_PROOF_DIR. Give both the commands that passed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+21
−4
docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md+21 −4
diff --git a/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md b/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md| index 43d591d88..dec929058 100644 |
| --- a/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md |
| +++ b/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md |
| @@ -669,12 +669,29 @@ review and CI come after these notes. Nothing here was run on a real box. |
| driver that starts its own units, so it runs outside any unit: |
| ```bash |
| - cd internal/cgroup && CARLOS_EDGE_HARDENING_KERNEL=1 TMPDIR="$TMPDIR/k" \ |
| - "$TMPDIR/k/cgroup.test" -test.run '^TestEdgeHardeningPlacement$' -test.v -test.count=1 |
| + mkdir -p /tmp/k/zddr3 && go test -c -o /tmp/k/zddr3/cgroup.test ./internal/cgroup |
| + (cd internal/cgroup && CARLOS_EDGE_HARDENING_KERNEL=1 TMPDIR=/tmp/k/zddr3 \ |
| + /tmp/k/zddr3/cgroup.test -test.run '^TestEdgeHardeningPlacement$' -test.v -test.count=1) |
| + rm -rf /tmp/k/zddr3 |
| ``` |
| - `TestStrictKernel` takes `CARLOS_STRICT_KERNEL=<mode>` and a delegated unit |
| - with no `RestrictNamespaces`, since the strict path keeps `clone3`. |
| + This test needs a `TMPDIR` under `/tmp`, so it can check `PrivateTmp`. It |
| + fails with "needs TMPDIR under /tmp" otherwise, which is why this command |
| + does not use the on-disk `$TMPDIR` of the recipe above. |
| + |
| + `TestStrictKernel` takes a mode in `CARLOS_STRICT_KERNEL` and a proof |
| + directory in `CARLOS_STRICT_PROOF_DIR`. This is the `full` mode. It runs in a |
| + delegated unit without `RestrictNamespaces`, because the strict path keeps |
| + `clone3`: |
| + |
| + ```bash |
| + mkdir -p /tmp/k/zddr3/strictproof && go test -c -o /tmp/k/zddr3/cgroup.test ./internal/cgroup && \ |
| + systemd-run --user --wait --pipe --collect -p Delegate=yes \ |
| + -E TMPDIR=/tmp/k/zddr3 -E CARLOS_STRICT_KERNEL=full \ |
| + -E CARLOS_STRICT_PROOF_DIR=/tmp/k/zddr3/strictproof \ |
| + /tmp/k/zddr3/cgroup.test -test.run '^TestStrictKernel$' -test.v -test.count=1 |
| + rm -rf /tmp/k/zddr3 |
| + ``` |
| ### Real-box checks (need Paul's approval; not run by this branch) |