summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--Makefile.am4
-rw-r--r--test/TEST-13-NSPAWN-SMOKE/Makefile11
-rwxr-xr-xtest/TEST-13-NSPAWN-SMOKE/create-busybox-container53
-rw-r--r--test/TEST-13-NSPAWN-SMOKE/has-overflow.c143
-rwxr-xr-xtest/TEST-13-NSPAWN-SMOKE/test.sh138
5 files changed, 349 insertions, 0 deletions
diff --git a/Makefile.am b/Makefile.am
index a0c17db179..00124a29f8 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -6030,6 +6030,10 @@ EXTRA_DIST += \
test/TEST-11-ISSUE-3166/test.sh \
test/TEST-12-ISSUE-3171/Makefile \
test/TEST-12-ISSUE-3171/test.sh \
+ test/TEST-13-NSPAWN-SMOKE/Makefile \
+ test/TEST-13-NSPAWN-SMOKE/has-overflow.c \
+ test/TEST-13-NSPAWN-SMOKE/create-busybox-container \
+ test/TEST-13-NSPAWN-SMOKE/test.sh \
test/test-functions
EXTRA_DIST += \
diff --git a/test/TEST-13-NSPAWN-SMOKE/Makefile b/test/TEST-13-NSPAWN-SMOKE/Makefile
new file mode 100644
index 0000000000..2ca5b12cf3
--- /dev/null
+++ b/test/TEST-13-NSPAWN-SMOKE/Makefile
@@ -0,0 +1,11 @@
+all: has-overflow
+ @make -s --no-print-directory -C ../.. all
+ @basedir=../.. TEST_BASE_DIR=../ ./test.sh --all
+setup: has-overflow
+ @make --no-print-directory -C ../.. all
+ @basedir=../.. TEST_BASE_DIR=../ ./test.sh --setup
+clean:
+ @basedir=../.. TEST_BASE_DIR=../ ./test.sh --clean
+ @rm -f has-overflow
+run:
+ @basedir=../.. TEST_BASE_DIR=../ ./test.sh --run
diff --git a/test/TEST-13-NSPAWN-SMOKE/create-busybox-container b/test/TEST-13-NSPAWN-SMOKE/create-busybox-container
new file mode 100755
index 0000000000..868dfd852a
--- /dev/null
+++ b/test/TEST-13-NSPAWN-SMOKE/create-busybox-container
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+set -e
+set -u
+set -o pipefail
+
+root="${1:?Usage $0 container-root}"
+mkdir -p "$root"
+mkdir "$root/bin"
+cp $(type -P busybox) "$root/bin"
+
+mkdir -p "$root/usr/lib"
+touch "$root/usr/lib/os-release"
+
+ln -s busybox "$root/bin/sh"
+ln -s busybox "$root/bin/cat"
+ln -s busybox "$root/bin/tr"
+ln -s busybox "$root/bin/ps"
+ln -s busybox "$root/bin/ip"
+
+mkdir -p "$root/sbin"
+cat <<'EOF' >"$root/sbin/init"
+#!/bin/sh
+
+printf "ps aufx:\n"
+ps aufx
+
+printf "/proc/1/cmdline:\n"
+printf "%s\n\n" "$(tr '\0' ' ' </proc/1/cmdline)"
+
+printf "/proc/1/environ:\n"
+printf "%s\n\n" "$(tr '\0' '\n' </proc/1/environ)"
+
+printf "/proc/1/mountinfo:\n"
+cat /proc/self/mountinfo
+printf "\n"
+
+printf "/proc/1/cgroup:\n"
+printf "%s\n\n" "$(cat /proc/1/cgroup)"
+
+printf "/proc/1/uid_map:\n"
+printf "%s\n\n" "$(cat /proc/1/uid_map)"
+
+printf "/proc/1/setgroups:\n"
+printf "%s\n\n" "$(cat /proc/1/setgroups)"
+
+printf "/proc/1/gid_map:\n"
+printf "%s\n\n" "$(cat /proc/1/gid_map)"
+
+printf "ip link:\n"
+ip link
+EOF
+chmod +x "$root/sbin/init"
diff --git a/test/TEST-13-NSPAWN-SMOKE/has-overflow.c b/test/TEST-13-NSPAWN-SMOKE/has-overflow.c
new file mode 100644
index 0000000000..1b3331fad7
--- /dev/null
+++ b/test/TEST-13-NSPAWN-SMOKE/has-overflow.c
@@ -0,0 +1,143 @@
+#define _GNU_SOURCE
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/mount.h>
+#include <sched.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <sys/wait.h>
+#include <signal.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <string.h>
+#include <limits.h>
+#include <errno.h>
+#include <grp.h>
+
+#define errExit(msg) do { perror(msg); exit(EXIT_FAILURE); } while (0)
+
+struct child_args {
+ int pipe_fd[2]; /* Pipe used to synchronize parent and child */
+};
+
+static void usage(char *pname) {
+ fprintf(stderr, "Options can be:\n");
+ fprintf(stderr, "\t-M uid_map Specify UID map for user namespace\n");
+ fprintf(stderr, "\t-G gid_map Specify GID map for user namespace\n");
+
+ exit(EXIT_FAILURE);
+}
+
+static void update_map(char *mapping, char *map_file) {
+ int fd, j;
+ size_t map_len;
+
+ map_len = strlen(mapping);
+
+ fd = open(map_file, O_RDWR);
+ if (fd == -1) {
+ fprintf(stderr, "ERROR: open %s: %s\n", map_file, strerror(errno));
+ exit(EXIT_FAILURE);
+ }
+
+ if (write(fd, mapping, map_len) != map_len) {
+ fprintf(stderr, "ERROR: write %s: %s\n", map_file, strerror(errno));
+ exit(EXIT_FAILURE);
+ }
+
+ close(fd);
+}
+
+static void proc_setgroups_write(pid_t child_pid, char *str) {
+ char setgroups_path[PATH_MAX];
+ int fd;
+
+ snprintf(setgroups_path, PATH_MAX, "/proc/%ld/setgroups", (long) child_pid);
+
+ fd = open(setgroups_path, O_RDWR);
+ if (fd == -1) {
+ if (errno != ENOENT)
+ fprintf(stderr, "ERROR: open %s: %s\n", setgroups_path, strerror(errno));
+ return;
+ }
+
+ if (write(fd, str, strlen(str)) == -1)
+ fprintf(stderr, "ERROR: write %s: %s\n", setgroups_path, strerror(errno));
+
+ close(fd);
+}
+
+static int child_func(void *arg) {
+ struct child_args *args = (struct child_args *) arg;
+ char ch;
+
+ close(args->pipe_fd[1]);
+ if (read(args->pipe_fd[0], &ch, 1) != 0) {
+ fprintf(stderr, "Failure in child: read from pipe returned != 0\n");
+ exit(EXIT_FAILURE);
+ }
+
+ mount("tmpfs", "/tmp", "tmpfs", MS_MGC_VAL, "mode=777,uid=0,gid=0");
+ if (mkdir("/tmp/hey", 0777) < 0)
+ exit(EXIT_FAILURE);
+
+ exit(EXIT_SUCCESS);
+}
+
+#define STACK_SIZE (1024 * 1024)
+
+static char child_stack[STACK_SIZE];
+
+int main(int argc, char *argv[]) {
+ int flags, opt;
+ pid_t child_pid;
+ struct child_args args;
+ char *uid_map, *gid_map;
+ const int MAP_BUF_SIZE = 100;
+ char map_buf[MAP_BUF_SIZE];
+ char map_path[PATH_MAX];
+ int status;
+
+ flags = 0;
+ gid_map = NULL;
+ uid_map = NULL;
+ while ((opt = getopt(argc, argv, "+M:G:")) != -1) {
+ switch (opt) {
+ case 'M':
+ uid_map = optarg;
+ break;
+ case 'G':
+ gid_map = optarg;
+ break;
+ default:
+ usage(argv[0]);
+ }
+ }
+
+ if (!uid_map || !gid_map)
+ usage(argv[0]);
+
+ flags |= CLONE_NEWNS;
+ flags |= CLONE_NEWUSER;
+
+ if (pipe(args.pipe_fd) == -1)
+ errExit("pipe");
+
+ child_pid = clone(child_func, child_stack + STACK_SIZE, flags | SIGCHLD, &args);
+ if (child_pid == -1)
+ errExit("clone");
+
+ snprintf(map_path, PATH_MAX, "/proc/%ld/uid_map", (long) child_pid);
+ update_map(uid_map, map_path);
+
+ proc_setgroups_write(child_pid, "allow");
+ snprintf(map_path, PATH_MAX, "/proc/%ld/gid_map", (long) child_pid);
+ update_map(gid_map, map_path);
+
+ close(args.pipe_fd[1]);
+
+ if (waitpid(child_pid, &status, 0) == -1)
+ errExit("waitpid");
+
+ exit(WIFEXITED(status) && WEXITSTATUS(status) == EXIT_SUCCESS ? EXIT_FAILURE : EXIT_SUCCESS);
+}
diff --git a/test/TEST-13-NSPAWN-SMOKE/test.sh b/test/TEST-13-NSPAWN-SMOKE/test.sh
new file mode 100755
index 0000000000..dfc437c0ee
--- /dev/null
+++ b/test/TEST-13-NSPAWN-SMOKE/test.sh
@@ -0,0 +1,138 @@
+#!/bin/bash
+# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
+# ex: ts=8 sw=4 sts=4 et filetype=sh
+TEST_DESCRIPTION="systemd-nspawn smoke test"
+SKIP_INITRD=yes
+. $TEST_BASE_DIR/test-functions
+
+check_result_qemu() {
+ ret=1
+ mkdir -p $TESTDIR/root
+ mount ${LOOPDEV}p1 $TESTDIR/root
+ [[ -e $TESTDIR/root/testok ]] && ret=0
+ [[ -f $TESTDIR/root/failed ]] && cp -a $TESTDIR/root/failed $TESTDIR
+ cp -a $TESTDIR/root/var/log/journal $TESTDIR
+ umount $TESTDIR/root
+ [[ -f $TESTDIR/failed ]] && cat $TESTDIR/failed
+ ls -l $TESTDIR/journal/*/*.journal
+ test -s $TESTDIR/failed && ret=$(($ret+1))
+ return $ret
+}
+
+test_run() {
+ if run_qemu; then
+ check_result_qemu || return 1
+ else
+ dwarn "can't run QEMU, skipping"
+ fi
+ return 0
+}
+
+test_setup() {
+ create_empty_image
+ mkdir -p $TESTDIR/root
+ mount ${LOOPDEV}p1 $TESTDIR/root
+
+ # Create what will eventually be our root filesystem onto an overlay
+ (
+ LOG_LEVEL=5
+ eval $(udevadm info --export --query=env --name=${LOOPDEV}p2)
+
+ setup_basic_environment
+ dracut_install busybox chmod rmdir
+ dracut_install ./has-overflow
+
+ cp create-busybox-container $initdir/
+
+ # setup the testsuite service
+ cat >$initdir/etc/systemd/system/testsuite.service <<EOF
+[Unit]
+Description=Testsuite service
+After=multi-user.target
+
+[Service]
+ExecStart=/test-nspawn.sh
+Type=oneshot
+EOF
+
+ cat >$initdir/test-nspawn.sh <<'EOF'
+#!/bin/bash
+set -x
+set -e
+set -u
+set -o pipefail
+
+export SYSTEMD_LOG_LEVEL=debug
+
+# check cgroup-v2
+is_v2_supported=no
+mkdir -p /tmp/cgroup2
+if mount -t cgroup2 cgroup2 /tmp/cgroup2; then
+ is_v2_supported=yes
+ umount /tmp/cgroup2
+fi
+rmdir /tmp/cgroup2
+
+# check cgroup namespaces
+is_cgns_supported=no
+if [[ -f /proc/1/ns/cgroup ]]; then
+ is_cgns_supported=yes
+fi
+
+function run {
+ if [[ "$1" = "yes" && "$is_v2_supported" = "no" ]]; then
+ printf "Unified cgroup hierarchy is not supported. Skipping.\n" >&2
+ return 0
+ fi
+ if [[ "$2" = "yes" && "$is_cgns_supported" = "no" ]]; then
+ printf "Cgroup namespaces are not supported. Skipping.\n" >&2
+ return 0
+ fi
+
+ local _root="/var/lib/machines/unified-$1-cgns-$2"
+ /create-busybox-container "$_root"
+ UNIFIED_CGROUP_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" systemd-nspawn --register=no -D "$_root" -b
+ UNIFIED_CGROUP_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" systemd-nspawn --register=no -D "$_root" --private-network -b
+
+ if ! UNIFIED_CGROUP_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" systemd-nspawn --register=no -D "$_root" -U -b; then
+ if [[ "$1" = "no" && "$2" = "yes" ]] && /has-overflow -M '0 1073283072 65536' -G '0 1073283072 65536'; then
+ printf "Failure expected, ignoring (see https://github.com/systemd/systemd/issues/4352)\n" >&2
+ else
+ return 1
+ fi
+ fi
+
+ if ! UNIFIED_CGROUP_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" systemd-nspawn --register=no -D "$_root" --private-network -U -b; then
+ if [[ "$1" = "no" && "$2" = "yes" ]] && /has-overflow -M '0 1073283072 65536' -G '0 1073283072 65536'; then
+ printf "Failure expected, ignoring (see https://github.com/systemd/systemd/issues/4352)\n" >&2
+ else
+ return 1
+ fi
+ fi
+
+ return 0
+}
+
+run no no
+run yes no
+run no yes
+run yes yes
+
+touch /testok
+EOF
+
+ chmod 0755 $initdir/test-nspawn.sh
+ setup_testsuite
+ ) || return 1
+
+ ddebug "umount $TESTDIR/root"
+ umount $TESTDIR/root
+}
+
+test_cleanup() {
+ umount $TESTDIR/root 2>/dev/null
+ [[ $LOOPDEV ]] && losetup -d $LOOPDEV
+ return 0
+}
+
+do_test "$@"
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-12-01 19:09:25 +0000