test: reproduce incorrect host-path attribution through container aliases

[robbycochran]

Goal: reproduce incorrect host-path attribution caused by aliasing

The main purpose of this PR is to capture an aliasing layout in which Fact reports a nonempty host_path that identifies the wrong backing file, then add a regression that fails until that attribution is corrected. Related: #2130.

Status: incomplete. The current 16 tests pass on main; they do not yet reproduce the incorrect attribution. This PR must not be considered complete until the failing case and its raw event evidence are included.

Real-world example: a container's /etc is backed by scratch storage

An OpenShift node has a file-monitoring policy for host /etc. A workload bind-mounts a scratch directory into its container at /etc, for example:

Host source                 Container destination
/var/tmp/workload-config -> /etc

The application updates /etc/app.conf inside the container. The backing file is /var/tmp/workload-config/app.conf on the node; the node's /etc/app.conf was not changed.

The regression must reject this incorrect Fact event:

path:      /etc/app.conf
host_path: /etc/app.conf       # WRONG: identifies an unrelated host location

The expected output preserves the observed container path and either reports the correctly established backing path or leaves it unresolved:

path:      /etc/app.conf
host_path: /var/tmp/workload-config/app.conf
           # An empty host_path is acceptable if backing identity is unresolved.

This example explains the intended failure, not an already reproduced result. The simple scratch-to-watched-path layout in the current tests correctly emits an empty host_path. We still need to identify and preserve the directory-aliasing conditions that cause the erroneous nonempty value.

Positive controls must also remain: host /etc mounted at either container /etc or /host-config must retain its genuine host attribution. This guards against hiding the bug by dropping events or clearing all host paths. Tests use disposable directories as stand-ins; they never modify the real host /etc.

Completion criteria

• Reproduce the incorrect nonempty host_path on an unfixed revision and retain the exact mount/alias setup plus raw event.
• Add a deterministic assertion that fails specifically on the incorrect attribution, not a setup error or unrelated timeout.
• Keep genuine-host-write controls passing and cover both existing-file OPEN and new-file CREATE where relevant.
• Run the reproducer through gRPC and OTEL. If temporarily marked expected-failure, constrain it to the demonstrated failure and use strict XPASS handling.

The primary regression belongs at Fact's emitted-path boundary. Sensor policy matching is a separate follow-up; it must not substitute for demonstrating the incorrect Fact host_path.

Related ROX work

The Atlassian connector is disabled by administrator policy in this session, so these relationships are verified from GitHub references, not a direct Jira search. Jira status and full issue scope have not been verified.

Reference	Relationship to this regression
ROX-36834, Fact #1692	Closest alias/inode-tracking lead: track multiple monitored paths per inode and preserve references through partial scans and unlink/rename events. Its documented failure is lost tracking, not yet the incorrect host_path targeted here.
ROX-36737, PR #1641	Related relative-symlink discovery regression modeling RHCOS /root -> var/roothome; currently documented as a missing-event timeout.
ROX-35830, Mauro's PR #1900	Container-awareness infrastructure that can supply the shared runtime metadata/mount lookup.
Fact #1595, PR #1655	Absolute symlink resolution under FACT_HOST_MOUNT; issue explicitly describes the possibility of selecting a file inside Fact's container instead of the host. No ROX reference was found in that issue body.

None of these has been established as a duplicate of the incorrect-attribution regression. ROX-36834 and #1595 are useful starting points for reproducing the precise aliasing failure.

Existing supporting coverage

A temporary watched directory models host /etc; no real host /etc files are modified. Four mount layouts are tested:

Layout	Expected attribution
Unwatched scratch directory mounted at the watched pathname	Never claim the watched host path
Watched directory mounted at the same pathname	Report the watched host path
Watched directory mounted at a different container alias	Preserve the alias as observed path and report the watched host path
Scratch directory mounted below a watched parent mount	Do not inherit the parent's host-path attribution across the nested override

Each layout exercises existing-file writable OPEN and new-file CREATE through both gRPC and OTEL: 16 cases. Existing files are seeded before Fact's initial scan, so OPEN coverage cannot accidentally depend on a preceding creation event. The assertions check container identity, operation, observed path, and host path. Unwatched sources may remain unresolved or report their correct backing path; they may never claim the unrelated watched directory. Writer mount inspection is saved beside the existing Fact logs.

This is a test-only PR on main and does not depend on either runtime-metadata PR. These 16 cases already pass on main and are supporting controls, not the required failing reproducer. The primary regression remains to be implemented. #2130 tracks the wider solution building blocks.

Checklist

• Patch has a change log entry OR does not need one: test-only coverage.
• Investigated and inspected CI test results: format-check passed; build, lint, and integration jobs are still pending/in progress. The initial checklist failure was the unchecked review item, now updated.
• Updated documentation accordingly: test docstring and Disambiguate node file paths from container mount aliases #2130 explain scope and acceptance criteria.

Automated testing

• Added integration tests
• Added the primary failing regression for incorrect host_path attribution; current tests are passing controls
• Unit tests are not applicable to this container/kernel event scenario.

Testing Performed

Live run on a privileged Podman Fedora CoreOS arm64 VM, kernel 6.11.3-200.fc40.aarch64, with BPF LSM enabled:

pytest test_mount_paths.py --output=all \
  --image=quay.io/stackrox-io/fact:0.4.x-81-g661acec004-otel \
  -v --junit-xml=mount-paths.xml

• 16 cases passed against main 661acec004, repeated successfully after the final assertion update (72.39 seconds).
• Image digest: sha256:955550e7587a936d3488162404cd90bb2d9b026a18f18c1b7ff4df4c1e6f06fd.
• Ruff lint/format, Pyright with Linux target, pytest collection (16 cases), and git diff --check passed.
• Actual OpenShift node-policy alert validation is a separate acceptance step in Disambiguate node file paths from container mount aliases #2130; this run tests emitted Fact events using Podman's Docker-compatible API.

Summary by CodeRabbit

• Tests
  • Added coverage for container file-event paths across shadowed, same-path, aliased, and nested mount layouts. Tests exercise opening existing files and creating new ones, verify that writes reach the selected source, and check reported container and host paths. For shadowed mounts, events may report no host path or the actual source path, but must not incorrectly attribute the event to the watched host directory.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T16:29:16.136405Z	53ae525	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: stackrox/fact/.coderabbit.yml
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 2f20a8d0-6fef-463f-ad10-aaf8fd2b494c

📥 Commits

Reviewing files that changed from the base of the PR and between 53ae525 and 508a328.

📒 Files selected for processing: 1

• tests/test_mount_paths.py

🚧 Files skipped from review as they are similar to previous changes: 1

• tests/test_mount_paths.py

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

📝 Walkthrough

Adds Docker-backed tests for file-event paths across four mount layouts. The tests check OPEN and CREATE events, including container paths and host-path attribution.

Changes: Container mount path tests

Layer / File(s)	Summary
Mount layouts and event assertions tests/test_mount_paths.py	Fixtures set up shadow, same-path, alias, and nested-shadow mounts, then start a Fedora container. Tests check file writes and matching OPEN or CREATE events, including expected container paths and host-path attribution.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Suggested reviewers: erthalion

Merge Risk: ⚪ Minimal · up to 508a3

The new tests cover host-path attribution through both event outputs. No issue identified here needs resolution before merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly describes the added regression-test coverage for incorrect host-path attribution through container aliases. Although the reproducer is not yet complete, the title remains directly re…
Description check		The description is detailed and follows the repository template. It explains the scope, current limitation, test coverage, checklist status, and testing performed. It also clearly states that the prim…

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 33.45%. Comparing base (661acec) to head (7fc12ba).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2131   +/-   ##
=======================================
  Coverage   33.45%   33.45%           
=======================================
  Files          22       22           
  Lines        3623     3623           
  Branches     3623     3623           
=======================================
  Hits         1212     1212           
  Misses       2402     2402           
  Partials        9        9           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.