lxc-test-apparmor-mount revision 7aff4f43fd84b021db12b2ffed1a4aa1b4cf65ef
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# apparmor_mount: test proper handling of apparmor in kernels
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# without mount features
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# These require the ubuntu lxc package to be installed.
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# This program is free software; you can redistribute it and/or
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# modify it under the terms of the GNU Lesser General Public
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# License as published by the Free Software Foundation; either
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# version 2.1 of the License, or (at your option) any later version.
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# This library is distributed in the hope that it will be useful,
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# but WITHOUT ANY WARRANTY; without even the implied warranty of
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# Lesser General Public License for more details.
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# You should have received a copy of the GNU Lesser General Public
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# License along with this library; if not, write to the Free Software
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# This test assumes an Ubuntu host
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn env http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge HallynMOUNTSR=/sys/kernel/security/apparmor/features/mount
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn sed -i '/lxcunpriv/d' /run/lxc/nics /etc/lxc/lxc-usernet
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn if [ $DONE -eq 0 ]; then
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# Only run on a normally configured ubuntu lxc system
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn echo "lxcbr0 is not configured."
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn echo "ERROR: Must run as root."
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# This would be much simpler if we could run it as
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# root. However, in order to not have the bind mount
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# of an empty directory over the securitfs 'mount' directory
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# be removed, we need to do this as non-root.
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynwhich newuidmap >/dev/null 2>&1 || { echo "'newuidmap' command is missing" >&2; exit 1; }
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn# create a test user
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynecho "$TUSER veth lxcbr0 2" > /etc/lxc/lxc-usernet
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynusermod -v 910000-919999 -w 910000-919999 $TUSER
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynlxc.network.type = veth
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynlxc.network.link = lxcbr0
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynlxc.id_map = u 0 910000 9999
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynlxc.id_map = g 0 910000 9999
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyncgm chown all $TUSER $(id -u $TUSER) $(id -g $TUSER)
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn cp -R /var/cache/lxc/download $HDIR/.cache/lxc && \
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynrun_cmd lxc-create -t download -n $cname -- -d ubuntu -r trusty -a $ARCH
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynecho "test default confined container"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynif [ "x$profile" != "xlxc-container-default (enforce)" ]; then
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn echo "FAIL: confined container was in profile $profile"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynecho "test regular unconfined container"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynecho "lxc.aa_profile = unconfined" >> $HDIR/.local/share/lxc/$cname/config
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn echo "FAIL: unconfined container was in profile $profile"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynecho "masking $MOUNTSR"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynecho "test default confined container"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynsed -i '/aa_profile/d' $HDIR/.local/share/lxc/$cname/config
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn echo "FAIL: confined container started without mount restrictions"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn echo "pid was $pid"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynecho "test regular unconfined container"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynecho "lxc.aa_profile = unconfined" >> $HDIR/.local/share/lxc/$cname/config
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn echo "FAIL: unconfined container failed to start without mount restrictions"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn echo "FAIL: confined container was in profile $profile"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynecho "testing override"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynsed -i '/aa_profile/d' $HDIR/.local/share/lxc/$cname/config
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynecho "lxc.aa_allow_incomplete = 1" >> $HDIR/.local/share/lxc/$cname/config
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn echo "FAIL: excepted container failed to start without mount restrictions"
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallynif [ "x$profile" != "xlxc-container-default (enforce)" ]; then
7aff4f43fd84b021db12b2ffed1a4aa1b4cf65efSerge Hallyn echo "FAIL: confined container was in profile $profile"