Fix containerized AcknowlEDG Forge cg_annotate []

Author: wchilders-nvidia

dev_tools/pylibs/edgacknowledg/forge/runner/roles.py

@@ -25,7 +25,8 @@ class RunnerPolicy:
 
   - ``commands``: allowed argument prefixes. The first element of each is
     resolved on ``search_path`` when the runner starts; a request may name
-    it either way, and the resolved one runs.
+    it by name or by any absolute path to the same file, and the resolved
+    one runs.
   - ``roots``: every absolute path in the request (arguments after the
     allowed prefix, the working directory, and variable values) must lie
     under one of them.

dev_tools/pylibs/edgacknowledg/forge/runner/server.py

@@ -82,6 +82,18 @@ def _under_roots(value: str, roots: Sequence[Path]) -> bool:
   )
 
 
+def _names_program(name: str, prefix: str, resolved: str) -> bool:
+  '''Whether a request's ``name`` names the program ``prefix`` resolved to:
+  by name, or by any absolute path to it (the client may have found it on
+  a search path of its own, e.g. through Fedora's /usr/sbin, which links to
+  /usr/bin).
+  '''
+  if name in (prefix, resolved):
+    return True
+  return (os.path.isabs(name) and
+          os.path.realpath(name) == os.path.realpath(resolved))
+
+
 @dataclass(frozen = True)
 class Job:
   argv: tuple[str, ...]
@@ -102,7 +114,7 @@ def check_request(request: Mapping[str, Any],
   prefix_length = 0
   for prefix, resolved in commands:
     if (len(argv) >= len(prefix) and
-        argv[0] in (prefix[0], resolved) and
+        _names_program(argv[0], prefix[0], resolved) and
         tuple(argv[1:len(prefix)]) == prefix[1:]):
       program = resolved
       prefix_length = len(prefix)

dev_tools/services/acknowledg-forge/tests/test_runner.py

@@ -106,8 +106,13 @@ def _check(root: Path, **request: object) -> object:
 def test_only_allowed_commands_run(tmp_path: Path) -> None:
   sh = shutil.which('sh')
   assert sh is not None
-  # By name or by the path it resolves to; the resolved one runs.
-  for name in ('sh', os.path.abspath(sh)):
+  # Another path to the same program, as the client may find it on its own
+  # search path (Fedora's /usr/sbin links to /usr/bin).
+  linked_dir = tmp_path / 'sbin'
+  linked_dir.symlink_to(os.path.dirname(os.path.abspath(sh)))
+  # By name, by the path it resolves to, or by any other path to it; the
+  # resolved one runs.
+  for name in ('sh', os.path.abspath(sh), str(linked_dir / 'sh')):
     job = _check(tmp_path, argv = [name, '-c', 'true'])
     assert job.argv[0] == os.path.abspath(sh)  # type: ignore[attr-defined]
   refused = [