PVF: Add Secure Validator Mode (#2486)

Co-authored-by: Javier Viola <javier@parity.io>

polkadot/node/core/pvf/tests/it/main.rs

@@ -39,6 +39,7 @@ const TEST_EXECUTION_TIMEOUT: Duration = Duration::from_secs(6);
 const TEST_PREPARATION_TIMEOUT: Duration = Duration::from_secs(6);
 
 struct TestHost {
+	// Keep a reference to the tempdir as it gets deleted on drop.
 	cache_dir: tempfile::TempDir,
 	host: Mutex<ValidationHost>,
 }
@@ -58,6 +59,7 @@ impl TestHost {
 		let mut config = Config::new(
 			cache_dir.path().to_owned(),
 			None,
+			false,
 			prepare_worker_path,
 			execute_worker_path,
 		);
@@ -415,19 +417,28 @@ async fn prepare_can_run_serially() {
 #[tokio::test]
 async fn all_security_features_work() {
 	// Landlock is only available starting Linux 5.13, and we may be testing on an old kernel.
-	let sysinfo = sc_sysinfo::gather_sysinfo();
-	// The version will look something like "5.15.0-87-generic".
-	let version = sysinfo.linux_kernel.unwrap();
-	let version_split: Vec<&str> = version.split(".").collect();
-	let major: u32 = version_split[0].parse().unwrap();
-	let minor: u32 = version_split[1].parse().unwrap();
-	let can_enable_landlock = if major >= 6 { true } else { minor >= 13 };
+	let can_enable_landlock = {
+		let sysinfo = sc_sysinfo::gather_sysinfo();
+		// The version will look something like "5.15.0-87-generic".
+		let version = sysinfo.linux_kernel.unwrap();
+		let version_split: Vec<&str> = version.split(".").collect();
+		let major: u32 = version_split[0].parse().unwrap();
+		let minor: u32 = version_split[1].parse().unwrap();
+		if major >= 6 {
+			true
+		} else if major == 5 {
+			minor >= 13
+		} else {
+			false
+		}
+	};
 
 	let host = TestHost::new().await;
 
 	assert_eq!(
 		host.security_status().await,
 		SecurityStatus {
+			secure_validator_mode: false,
 			can_enable_landlock,
 			can_enable_seccomp: true,
 			can_unshare_user_namespace_and_change_root: true,

polkadot/node/core/pvf/tests/it/worker_common.rs

@@ -27,6 +27,7 @@ async fn spawn_immediate_exit() {
 
 	// There's no explicit `exit` subcommand in the worker; it will panic on an unknown
 	// subcommand anyway
+	let spawn_timeout = Duration::from_secs(2);
 	let result = spawn_with_program_path(
 		"integration-test",
 		prepare_worker_path,
@@ -36,23 +37,28 @@ async fn spawn_immediate_exit() {
 		SecurityStatus::default(),
 	)
 	.await;
-	assert!(matches!(result, Err(SpawnErr::AcceptTimeout)));
+	assert!(
+		matches!(result, Err(SpawnErr::AcceptTimeout { spawn_timeout: s }) if s == spawn_timeout)
+	);
 }
 
 #[tokio::test]
 async fn spawn_timeout() {
 	let (_, execute_worker_path) = build_workers_and_get_paths();
 
+	let spawn_timeout = Duration::from_secs(2);
 	let result = spawn_with_program_path(
 		"integration-test",
 		execute_worker_path,
 		&env::temp_dir(),
 		&["test-sleep"],
-		Duration::from_secs(2),
+		spawn_timeout,
 		SecurityStatus::default(),
 	)
 	.await;
-	assert!(matches!(result, Err(SpawnErr::AcceptTimeout)));
+	assert!(
+		matches!(result, Err(SpawnErr::AcceptTimeout { spawn_timeout: s }) if s == spawn_timeout)
+	);
 }
 
 #[tokio::test]