lxc-test-unpriv revision 7059802cf0653d94236a78793a407cf02ff378a9
f743002678eb67b99bbc29fee116b65d9530fec0wrowe#!/bin/bash
80833bb9a1bf25dcf19e814438a4b311d2e1f4cffuankg
a34684a59b60a4173c25035d0c627ef17e6dc215rpluem# lxc: linux Container library
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic# Authors:
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic# Serge Hallyn <serge.hallyn@ubuntu.com>
1337c7673efc1f80f634139fbad7cbb98a0dc657ylavic#
4da61833a1cbbca94094f9653fd970582b97a72etrawick# This is a test script for unprivileged containers
4da61833a1cbbca94094f9653fd970582b97a72etrawick
4da61833a1cbbca94094f9653fd970582b97a72etrawick# This library is free software; you can redistribute it and/or
4da61833a1cbbca94094f9653fd970582b97a72etrawick# modify it under the terms of the GNU Lesser General Public
4da61833a1cbbca94094f9653fd970582b97a72etrawick# License as published by the Free Software Foundation; either
4789804be088bcd86ae637a29cdb7fda25169521jailletc# version 2.1 of the License, or (at your option) any later version.
4789804be088bcd86ae637a29cdb7fda25169521jailletc
4789804be088bcd86ae637a29cdb7fda25169521jailletc# This library is distributed in the hope that it will be useful,
4789804be088bcd86ae637a29cdb7fda25169521jailletc# but WITHOUT ANY WARRANTY; without even the implied warranty of
e50c3026198fd496f183cda4c32a202925476778covener# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
e50c3026198fd496f183cda4c32a202925476778covener# Lesser General Public License for more details.
e50c3026198fd496f183cda4c32a202925476778covener
5b88c8507d5ef6d0c4cfbc78230294968175b638minfrin# You should have received a copy of the GNU Lesser General Public
5b88c8507d5ef6d0c4cfbc78230294968175b638minfrin# License along with this library; if not, write to the Free Software
6c3b9cebb551140fbb25d58bae08b539b3802133ylavic# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
6c3b9cebb551140fbb25d58bae08b539b3802133ylavic
6c3b9cebb551140fbb25d58bae08b539b3802133ylavicif [ $(id -u) -ne 0 ]; then
4f29b65ab4b547ad5dbe506e2d0ff5d12ead9247ylavic echo 'run as root'
4f29b65ab4b547ad5dbe506e2d0ff5d12ead9247ylavic exit 1
0a0df13b7f1f4f1a74fe295253d89ca3911b301aylavicfi
0a0df13b7f1f4f1a74fe295253d89ca3911b301aylavicwhich newuidmap >/dev/null 2>&1 || { echo "'newuidmap' command is missing" >&2; exit 1; }
0a0df13b7f1f4f1a74fe295253d89ca3911b301aylavic
0a0df13b7f1f4f1a74fe295253d89ca3911b301aylavicDONE=0
69301145375a889e7e37caf7cc7321ac0f91801erpluemcleanup() {
69301145375a889e7e37caf7cc7321ac0f91801erpluem cd
69301145375a889e7e37caf7cc7321ac0f91801erpluem
506bfe33206b2fece40ef25f695af39dd4130facjkaluza run_cmd lxc-stop -n c1 -k
506bfe33206b2fece40ef25f695af39dd4130facjkaluza pkill -u $(id -u $TUSER) -9
506bfe33206b2fece40ef25f695af39dd4130facjkaluza
506bfe33206b2fece40ef25f695af39dd4130facjkaluza sed -i '/lxcunpriv/d' /var/run/lxc/nics /etc/lxc/lxc-usernet
d58a848a016d401b965111e50ef829e1641f7834minfrin sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
d58a848a016d401b965111e50ef829e1641f7834minfrin
d58a848a016d401b965111e50ef829e1641f7834minfrin rm -Rf $HDIR /run/user/$(id -u $TUSER)
2e6f4d654c96c98b761fb012fd25c5d5b1558c44sf
2e6f4d654c96c98b761fb012fd25c5d5b1558c44sf deluser $TUSER
2e6f4d654c96c98b761fb012fd25c5d5b1558c44sf
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic if [ $DONE -eq 0 ]; then
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic echo "FAIL"
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic exit 1
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic fi
17e6c95f3b22d18acdf8380fb26a8d0e10c80767ylavic echo "PASS"
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavic}
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavic
e8bd80a4bb88199d2f9a24a50345688e52d9c116ylavicrun_cmd() {
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic sudo -i -u $TUSER env XDG_RUNTIME_DIR=/run/user/$(id -u $TUSER) $*
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic}
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic# create a test user
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavicTUSER=lxcunpriv
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavicHDIR=/home/$TUSER
330e16bea8fe9cace4de90c349750c03dfb1fe64ylavic
d7205b1a86c51c27b71a2c458dc453fd53a261c1covenertrap cleanup EXIT SIGHUP SIGINT SIGTERM
d7205b1a86c51c27b71a2c458dc453fd53a261c1covenerset -eu
d7205b1a86c51c27b71a2c458dc453fd53a261c1covener
d7205b1a86c51c27b71a2c458dc453fd53a261c1covenerdeluser $TUSER && rm -Rf $HDIR || true
d7205b1a86c51c27b71a2c458dc453fd53a261c1coveneruseradd $TUSER
44ff304057225e944e220e981d434a046d14cf06covener
44ff304057225e944e220e981d434a046d14cf06covenermkdir -p $HDIR
44ff304057225e944e220e981d434a046d14cf06covenerecho "$TUSER veth lxcbr0 2" > /etc/lxc/lxc-usernet
44ff304057225e944e220e981d434a046d14cf06covenersed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
5d1ba75b8794925e67591c209085a49279791de9covener
5d1ba75b8794925e67591c209085a49279791de9covenerusermod -v 910000-919999 -w 910000-919999 $TUSER
5d1ba75b8794925e67591c209085a49279791de9covener
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrandmkdir -p $HDIR/.config/lxc/
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrandcat > $HDIR/.config/lxc/default.conf << EOF
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrandlxc.network.type = veth
032982212dbcc7c3cce95bf89c503bb56e185ac7kbrandlxc.network.link = lxcbr0
caad2986f81ab263f7af41467dd622dc9add17f3ylaviclxc.id_map = u 0 910000 9999
caad2986f81ab263f7af41467dd622dc9add17f3ylaviclxc.id_map = g 0 910000 9999
caad2986f81ab263f7af41467dd622dc9add17f3ylavicEOF
caad2986f81ab263f7af41467dd622dc9add17f3ylavicchown -R $TUSER $HDIR
45a10d38e6051fd7bdf9d742aaae633d97ff02abjailletc
f7317ff316c2b141feea31bddb74d5d3fa1584edjortonmkdir -p /run/user/$(id -u $TUSER)
f7317ff316c2b141feea31bddb74d5d3fa1584edjortonchown -R $TUSER /run/user/$(id -u $TUSER)
2165214331e4afafca4048f66f303d0253d7b001covener
a34684a59b60a4173c25035d0c627ef17e6dc215rpluemcd $HDIR
a34684a59b60a4173c25035d0c627ef17e6dc215rpluem
1e2d421a36999d292042a5539971070d54aa6c63ylavicfor d in /sys/fs/cgroup/*; do
1e2d421a36999d292042a5539971070d54aa6c63ylavic [ ! -d $d/lxctest ] && mkdir $d/lxctest
1e2d421a36999d292042a5539971070d54aa6c63ylavic chown -R $TUSER $d/lxctest
fa7ed98b9dc94c5845cf845aea0a44ecacd290c9humbedooh echo $$ > $d/lxctest/tasks
fa7ed98b9dc94c5845cf845aea0a44ecacd290c9humbedoohdone
fa7ed98b9dc94c5845cf845aea0a44ecacd290c9humbedooh
0b67eb8568cd58bb77082703951679b42cf098actrawickrun_cmd lxc-create -t download -n c1 -- -d ubuntu -r trusty -a i386
0b67eb8568cd58bb77082703951679b42cf098actrawickrun_cmd lxc-start -n c1 -d
0b67eb8568cd58bb77082703951679b42cf098actrawick
0b67eb8568cd58bb77082703951679b42cf098actrawickp1=$(run_cmd lxc-info -n c1 -p -H)
5ef3c61605a3a021ff71f488983cb0065f8e1a79covener[ "$p1" != "-1" ] || { echo "Failed to start container c1"; false; }
fb1985a97912b25ec6564c73e610a31e5fc6e25fcovener
09c87c777bed1655621bb20e1c46cb6b1a63279dcovenerrun_cmd lxc-info -n c1
6502b7b32f980cc2093bb3ebce37e5e4dc68fba4ylavicrun_cmd lxc-attach -n c1 -- /bin/true
6502b7b32f980cc2093bb3ebce37e5e4dc68fba4ylavic
3060ce7f798fbda7999cd4ddf89b525d2b294185covenerDONE=1
c1a63b8fad09c419c1a64f75993feb8a343a6801ylavic