test(cdi): assert CDI policy scenarios in the tmachine suite

Run the device-node-with-gid policy fixture as a non-root workload and
require the device group among its groups and read-write access to the
device. Add MPS pipe directory fixtures mounted with the NVIDIA
Container Toolkit IPC options, and a negative variant without noexec.

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

TESTING.md

@@ -384,14 +384,17 @@ the two-device default GPU inventory. Select them with `--gpu 1` and the Docker
 | `omitted-access-file` | Bind without `ro` or `rw` | Effective writable access causes launch rejection. |
 | `device-node` | Null character device at `/dev/tmachine-cdi-null` | Non-root read/write succeeds; an exact authored read-only entry fails launch. |
 | `device-node-with-gid` | Group-restricted null device at `/dev/tmachine-cdi-group-null` | Docker supplies the generated supplementary GID and permits non-root access. |
+| `mps-pipe-directory` | Pipe directory with a `control` FIFO at `/tmp/nvidia-mps`, mounted with the NVIDIA Container Toolkit's IPC options | Non-root workload can open the FIFO read-write and create files in the directory. |
+| `mps-pipe-directory-without-noexec` | The same directory without `noexec` | Launch rejects the IPC directory. |
 | `unix-socket` | Echo socket at `/tmachine-cdi/socket/echo.sock` | Socket communication succeeds without deriving parent filesystem grants. |
 
 Every scenario also supplies a spec-level environment marker and a read-only
 mount at `/tmachine-cdi/common/spec-marker`, allowing checks of spec/device edit
 merging. The device group is allocated in the disposable guest. A systemd
 socket unit restores the echo endpoint after reboot; the existing tmpfiles
 configuration restores the scenario spec. These fixtures prepare the resources;
-the existing eight tests do not yet assert the policy scenarios. Negative
+only `device-node-with-gid` is asserted so far. It requires Docker 29.5 or
+later, which applies CDI `additionalGids`. Negative
 scenarios must be selected individually, not combined with positive cases.
 
 Directory absence, daemon configuration refresh, and restart tests require

tests/ansible/roles/cdi_fixtures/tasks/scenarios.yaml

@@ -61,6 +61,21 @@
     group: openshell-cdi-fixture
     mode: "0660"
 
+- name: Create MPS pipe directory fixture
+  become: true
+  ansible.builtin.file:
+    path: /var/lib/openshell-test-inputs/cdi/policy/mps-pipes
+    state: directory
+    owner: root
+    group: root
+    mode: "0777"
+
+- name: Create MPS control pipe fixture
+  become: true
+  ansible.builtin.command:
+    argv: [mkfifo, --mode=0666, /var/lib/openshell-test-inputs/cdi/policy/mps-pipes/control]
+    creates: /var/lib/openshell-test-inputs/cdi/policy/mps-pipes/control
+
 - name: Install socket fixture units
   become: true
   ansible.builtin.copy:

tests/ansible/roles/cdi_fixtures/templates/policy.yaml.j2

@@ -69,6 +69,18 @@ devices:
           uid: 0
           gid: {{ cdi_fixture_group.gid }}
           fileMode: 432
+  - name: mps-pipe-directory
+    containerEdits:
+      mounts:
+        - hostPath: /var/lib/openshell-test-inputs/cdi/policy/mps-pipes
+          containerPath: /tmp/nvidia-mps
+          options: [nosuid, nodev, rbind, rprivate, noexec]
+  - name: mps-pipe-directory-without-noexec
+    containerEdits:
+      mounts:
+        - hostPath: /var/lib/openshell-test-inputs/cdi/policy/mps-pipes
+          containerPath: /tmp/nvidia-mps
+          options: [nosuid, nodev, rbind, rprivate]
   - name: unix-socket
     containerEdits:
       mounts:

tests/suites/features/cdi/tests/injection.rs

@@ -196,3 +196,33 @@ async fn explicit_device_count_mismatch_is_rejected() {
     )
     .await;
 }
+
+/// The group-restricted device is mode 0660 with the group the spec supplies
+/// through `additionalGids`, so non-root access requires the runtime to apply it.
+const GROUP_DEVICE_PROBE: &str = r#"
+set -eu
+device=/dev/tmachine-cdi-group-null
+test "$(id -u)" != 0
+test -c "$device"
+set -- $(ls -ln "$device")
+gid=$4
+case " $(id -G) " in
+    *" $gid "*) ;;
+    *) echo "workload groups $(id -G) lack device group $gid" >&2; exit 1 ;;
+esac
+head -c 0 "$device"
+printf x > "$device"
+"#;
+
+#[tokio::test]
+async fn additional_gids_grant_group_restricted_device_access() {
+    check_case(
+        "cdi-policy-device-node-with-gid",
+        Some("1"),
+        Some(&["tmachine.example/cdi-policy=device-node-with-gid"]),
+        GROUP_DEVICE_PROBE,
+        Some(&[]),
+        None,
+    )
+    .await;
+}