From a7c7fa9e76c9c7015c31378062aa5d0c17b0f38f Mon Sep 17 00:00:00 2001 From: James O'Doherty Date: Fri, 29 May 2026 19:56:45 -0400 Subject: Fix DNS leaks, lifecycle race, and editor arg splitting - DNS Leak / Isolation Bypass: Blocked glibc's systemd-resolved and D-Bus socket communication within the unprivileged mount namespace by introducing BlockHostServices(). This targeted mount-blocking forces glibc to fall back to the standard resolv.conf DNS routing path and prevents host leaks. - Lifecycle Race: Reordered and protected the reference-counting cleanup routine under the profile flock to ensure that check-and-unpin operations are atomic and do not teardown namespaces actively used by parallel processes. - Editor Arguments: Split the EDITOR environment variable into discrete field tokens before invocation to support editor configurations containing command-line flags. - Testing: Added E2E regression tests for DNS leak detection, namespace unpinning concurrency, and editor argument parsing. All E2E tests now compile and pass cleanly. --- AGENTS.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'AGENTS.md') diff --git a/AGENTS.md b/AGENTS.md index 8067fdf..c6c66df 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -35,7 +35,10 @@ No piece of code is considered "done" until it has passed the full verification 1. **Formatting**: `go fmt ./...` 2. **Static Analysis**: `go vet ./...` 3. **Linting**: `golangci-lint run` -4. **Verification**: `go test -timeout 30s ./...` +4. **Verification**: Run the test suite via the Makefile: + - **All tests**: `make test` + - **Specific tests**: `make test TEST_ARGS="-run TestName"` (e.g., `make test TEST_ARGS="-run TestDNSLeak"`) + - **Custom flags**: `make test TEST_ARGS="-count=10"` If any of these tools report an error or warning, the code must be corrected before the task is marked as complete. -- cgit v1.2.3