Cross Reference: /lxc/src/tests/lxc-test-unpriv
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
#!/bin/bash
# lxc: linux Container library
# Authors:
# Serge Hallyn <serge.hallyn@ubuntu.com>
#
# This is a test script for unprivileged containers
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
# This library is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
# This test assumes an Ubuntu host
if [ $(id -u) -ne 0 ]; then
echo "ERROR: Must run as root."
exit 1
fi
# Test if we're using an overlayfs module that handles symlinks correctly. If
# not, we skip these tests since overlay clones will not work correctly.
if modprobe -q overlayfs; then
TMPDIR=$(mktemp -d)
MOUNTDIR="${TMPDIR}/ovl_symlink_test"
mkdir ${MOUNTDIR}
mount -t tmpfs none ${MOUNTDIR}
mkdir "${MOUNTDIR}/lowerdir" "${MOUNTDIR}/upperdir" "${MOUNTDIR}/overlayfs"
mount -t overlayfs -o lowerdir="${MOUNTDIR}/lowerdir",upperdir="${MOUNTDIR}/upperdir" none "${MOUNTDIR}/overlayfs"
CORRECT_LINK_TARGET="${MOUNTDIR}/overlayfs/dummy_file"
exec 9> "${CORRECT_LINK_TARGET}"
DETECTED_LINK_TARGET=$(readlink -q /proc/$$/fd/9)
# cleanup
exec 9>&-
umount "${MOUNTDIR}/overlayfs"
umount ${MOUNTDIR}
rmdir ${MOUNTDIR}
# This overlay module does not correctly handle symlinks, so skip the
# tests.
if [ "${DETECTED_LINK_TARGET}" != "${CORRECT_LINK_TARGET}" ]; then
exit 0
fi
fi
which newuidmap >/dev/null 2>&1 || { echo "'newuidmap' command is missing" >&2; exit 1; }
DONE=0
KNOWN_RELEASES="precise trusty xenial yakkety zesty"
cleanup() {
cd /
run_cmd lxc-stop -n c2 -k || true
run_cmd lxc-stop -n c1 -k || true
pkill -u $(id -u $TUSER) -9
sed -i '/lxcunpriv/d' /run/lxc/nics /etc/lxc/lxc-usernet
sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
rm -Rf $HDIR /run/user/$(id -u $TUSER)
deluser $TUSER
if [ $DONE -eq 0 ]; then
echo "FAIL"
exit 1
fi
echo "PASS"
}
run_cmd() {
sudo -i -u $TUSER \
env http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
XDG_RUNTIME_DIR=/run/user/$(id -u $TUSER) $*
}
# create a test user
TUSER=lxcunpriv
HDIR=/home/$TUSER
ARCH=i386
if type dpkg >/dev/null 2>&1; then
ARCH=$(dpkg --print-architecture)
fi
trap cleanup EXIT SIGHUP SIGINT SIGTERM
set -eu
deluser $TUSER && rm -Rf $HDIR || true
useradd $TUSER
mkdir -p $HDIR
echo "$TUSER veth lxcbr0 2" >> /etc/lxc/lxc-usernet
sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
usermod -v 910000-919999 -w 910000-919999 $TUSER
mkdir -p $HDIR/.config/lxc/
cat > $HDIR/.config/lxc/default.conf << EOF
lxc.network.type = veth
lxc.network.link = lxcbr0
lxc.id_map = u 0 910000 9999
lxc.id_map = g 0 910000 9999
EOF
chown -R $TUSER: $HDIR
mkdir -p /run/user/$(id -u $TUSER)
chown -R $TUSER: /run/user/$(id -u $TUSER)
cd $HDIR
if which cgm >/dev/null 2>&1; then
cgm create all $TUSER
cgm chown all $TUSER $(id -u $TUSER) $(id -g $TUSER)
cgm movepid all $TUSER $$
elif [ -e /sys/fs/cgroup/cgmanager/sock ]; then
for d in $(cut -d : -f 2 /proc/self/cgroup); do
dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
--type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.Create \
string:$d string:$TUSER >/dev/null
dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
--type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.Chown \
string:$d string:$TUSER int32:$(id -u $TUSER) int32:$(id -g $TUSER) >/dev/null
dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
--type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.MovePid \
string:$d string:$TUSER int32:$$ >/dev/null
done
else
for d in /sys/fs/cgroup/*; do
[ -f $d/cgroup.clone_children ] && echo 1 > $d/cgroup.clone_children
[ ! -d $d/lxctest ] && mkdir $d/lxctest
chown -R $TUSER: $d/lxctest
echo $$ > $d/lxctest/tasks
done
fi
# default release is trusty, or the systems release if recognized
release=trusty
if [ -f /etc/lsb-release ]; then
. /etc/lsb-release
rels=$(ubuntu-distro-info --supported 2>/dev/null) ||
rels="$KNOWN_RELEASES"
for r in $rels; do
[ "$DISTRIB_CODENAME" = "$r" ] && release="$r"
done
fi
# Copy the download template cache if available
run_cmd mkdir -p $HDIR/.cache/lxc
[ -d /var/cache/lxc/download ] && \
cp -R /var/cache/lxc/download $HDIR/.cache/lxc && \
chown -R $TUSER: $HDIR/.cache/lxc
run_cmd lxc-create -t download -n c1 -- -d ubuntu -r $release -a $ARCH
# Make sure we can start it - twice
for count in `seq 1 2`; do
run_cmd lxc-start -n c1 -d
p1=$(run_cmd lxc-info -n c1 -p -H)
[ "$p1" != "-1" ] || { echo "Failed to start container c1 (run $count)"; false; }
run_cmd lxc-info -n c1
run_cmd lxc-attach -n c1 -- /bin/true
run_cmd lxc-stop -n c1 -k
done
run_cmd lxc-copy -s -n c1 -N c2
run_cmd lxc-start -n c2 -d
p1=$(run_cmd lxc-info -n c2 -p -H)
[ "$p1" != "-1" ] || { echo "Failed to start container c2"; false; }
run_cmd lxc-stop -n c2 -k
if which cgm >/dev/null 2>&1; then
echo "Testing containers under different cgroups per subsystem"
run_cmd cgm create freezer x1/x2
cgm movepid freezer x1 $$
run_cmd lxc-start -n c1 -d
p1=$(run_cmd lxc-info -n c1 -p -H)
[ "$p1" != "-1" ] || { echo "Failed to start container c1"; false; }
run_cmd lxc-info -n c1
run_cmd lxc-attach -n c1 -- /bin/true
run_cmd lxc-cgroup -n c1 freezer.state
echo "Testing lxc-attach and lxc-cgroup from different cgroup"
cgm movepid freezer x2 $$
run_cmd lxc-attach -n c1 -- /bin/true
run_cmd lxc-cgroup -n c1 freezer.state
run_cmd lxc-cgroup -n c1 memory.limit_in_bytes
fi
DONE=1