Add sandboxed e2e tests for host resources.

e2etests/MODULE.bazel

@@ -20,3 +20,14 @@ local_path_override(
     module_name = "com_github_google_android_cuttlefish_frontend",
     path = "../frontend",
 )
+
+# Expose the cuttlefish-host-resources init script (which lives in
+# ../base/debian, outside this Bazel module) as a data dependency for the
+# host_resources e2e tests.
+new_local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")
+
+new_local_repository(
+    name = "cuttlefish_debian",
+    build_file_content = 'exports_files(glob(["**"]))\n',
+    path = "../base/debian",
+)

e2etests/host_resources/common/BUILD.bazel

@@ -0,0 +1,33 @@
+# Copyright (C) 2026 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+load("@rules_go//go:def.bzl", "go_library")
+
+go_library(
+    name = "common",
+    srcs = [
+        "filesystem_ns.go",
+        "ip.go",
+        "network_ns.go",
+        "nft.go",
+        "sandbox.go",
+        "state.go",
+    ],
+    importpath = "github.com/google/android-cuttlefish/e2etests/host_resources/common",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@com_github_google_go_cmp//cmp",
+        "@rules_go//go/runfiles",
+    ],
+)

e2etests/host_resources/common/filesystem_ns.go

@@ -0,0 +1,79 @@
+// Copyright (C) 2026 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package common
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+func (s *Sandbox) setupFilesystem() error {
+	nsPath := filepath.Join(s.tempdir, "nsswitch.conf")
+	if err := os.WriteFile(nsPath, []byte(constructSandboxNsswitch()), 0644); err != nil {
+		return fmt.Errorf("writing nsswitch override: %w", err)
+	}
+	grpPath := filepath.Join(s.tempdir, "group")
+	if err := os.WriteFile(grpPath, []byte(constructSandboxGroupFile()), 0644); err != nil {
+		return fmt.Errorf("writing group override: %w", err)
+	}
+	script := fmt.Sprintf(
+		"set -e; "+
+			"mount --bind %q /etc/nsswitch.conf; "+
+			"mount --bind %q /etc/group; "+
+			"mount -t tmpfs tmpfs /etc/default; "+
+			": > /etc/default/cuttlefish-host-resources; "+
+			"mount -t tmpfs tmpfs /run",
+		nsPath, grpPath)
+	_, err := s.Run("sh", "-c", script)
+	return err
+}
+
+// reconstruct the host's nsswitch file to use only the group file
+func constructSandboxNsswitch() string {
+	b, err := os.ReadFile("/etc/nsswitch.conf")
+	if err != nil {
+		return "passwd: files\ngroup: files\n"
+	}
+	lines := strings.Split(string(b), "\n")
+	found := false
+	for i, l := range lines {
+		if strings.HasPrefix(strings.TrimSpace(l), "group:") {
+			lines[i] = "group: files"
+			found = true
+		}
+	}
+	if !found {
+		lines = append(lines, "group: files")
+	}
+	return strings.Join(lines, "\n") + "\n"
+}
+
+
+// reconstruct the host's group file, but with cvdnetwork as gid 0,
+// mostly for convenience
+func constructSandboxGroupFile() string {
+	b, _ := os.ReadFile("/etc/group")
+	var out []string
+	for _, l := range strings.Split(string(b), "\n") {
+		if l == "" || strings.HasPrefix(l, "cvdnetwork:") {
+			continue
+		}
+		out = append(out, l)
+	}
+	out = append(out, "cvdnetwork:x:0:")
+	return strings.Join(out, "\n") + "\n"
+}

e2etests/host_resources/common/ip.go

@@ -0,0 +1,102 @@
+// Copyright (C) 2026 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package common
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+// derived from `ip -details -json link`
+type Link struct {
+	Ifindex   int       `json:"ifindex"`
+	Ifname    string    `json:"ifname"`
+	Flags     []string  `json:"flags"`
+	Operstate string    `json:"operstate"`
+	Master    string    `json:"master"`
+	Address   string    `json:"address"`
+	LinkInfo  *LinkInfo `json:"linkinfo"`
+}
+
+type LinkInfo struct {
+	InfoKind string   `json:"info_kind"`
+	InfoData *TunData `json:"info_data"`
+}
+
+type TunData struct {
+	Type    string `json:"type"`
+	VnetHdr bool   `json:"vnet_hdr"`
+	Group   string `json:"group"`
+}
+
+func (l Link) Kind() string {
+	if l.LinkInfo != nil {
+		return l.LinkInfo.InfoKind
+	}
+	return ""
+}
+
+func (l Link) IsUp() bool {
+	for _, f := range l.Flags {
+		if f == "UP" {
+			return true
+		}
+	}
+	return false
+}
+
+func (l Link) VnetHdr() bool {
+	return l.LinkInfo != nil && l.LinkInfo.InfoData != nil && l.LinkInfo.InfoData.VnetHdr
+}
+
+// derived from `ip -json addr`.
+type Addr struct {
+	Ifname   string     `json:"ifname"`
+	AddrInfo []AddrInfo `json:"addr_info"`
+}
+
+type AddrInfo struct {
+	Family    string `json:"family"`
+	Local     string `json:"local"`
+	Prefixlen int    `json:"prefixlen"`
+	Scope     string `json:"scope"`
+}
+
+func parseLinks(s string) []Link {
+	var links []Link
+	json.Unmarshal([]byte(s), &links)
+	return links
+}
+
+func parseAddrs(s string) []Addr {
+	var addrs []Addr
+	json.Unmarshal([]byte(s), &addrs)
+	return addrs
+}
+
+// the first non-link-local IPv4 CIDR on the interface, or ""
+func (hs HostState) PrimaryIPv4(ifname string) string {
+	for _, a := range hs.Addrs {
+		if a.Ifname != ifname {
+			continue
+		}
+		for _, ai := range a.AddrInfo {
+			if ai.Family == "inet" {
+				return fmt.Sprintf("%s/%d", ai.Local, ai.Prefixlen)
+			}
+		}
+	}
+	return ""
+}

e2etests/host_resources/common/network_ns.go

@@ -0,0 +1,55 @@
+// Copyright (C) 2026 The Android Open Source Project
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package common
+
+import (
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+)
+
+func checkNetworkPrereqs(t *testing.T) {
+	t.Helper()
+	ensurePath()
+	for _, bin := range []string{"ip", "nft"} {
+		if _, err := exec.LookPath(bin); err != nil {
+			t.Fatalf("required binary %q not found on PATH: %v", bin, err)
+		}
+	}
+	if _, err := os.Stat("/dev/net/tun"); err != nil {
+		t.Fatalf("/dev/net/tun is not available: %v", err)
+	}
+}
+
+// make sure the sbin directories that hold ip and nft are on PATH
+func ensurePath() {
+	parts := strings.Split(os.Getenv("PATH"), ":")
+	have := map[string]bool{}
+	for _, p := range parts {
+		have[p] = true
+	}
+	for _, e := range []string{"/usr/sbin", "/usr/bin", "/sbin", "/bin"} {
+		if !have[e] {
+			parts = append(parts, e)
+		}
+	}
+	os.Setenv("PATH", strings.Join(parts, ":"))
+}
+
+func (s *Sandbox) setupNetwork() error {
+	_, err := s.Run("ip", "link", "set", "lo", "up")
+	return err
+}