lxc-test-unpriv revision e2ef635e682cef87b234d27e0b41923db857efa3
7d238ed0c71ca817fd1582295c6027c6b925af51Mark Andrews#!/bin/bash
7d238ed0c71ca817fd1582295c6027c6b925af51Mark Andrews
82a50a619afa73ae9a212399505b9f1b327128cdMark Andrews# lxc: linux Container library
82a50a619afa73ae9a212399505b9f1b327128cdMark Andrews
82a50a619afa73ae9a212399505b9f1b327128cdMark Andrews# Authors:
2f1c460beaa1e372255e7a1b8aad8996f011816dMark Andrews# Serge Hallyn <serge.hallyn@ubuntu.com>
2f1c460beaa1e372255e7a1b8aad8996f011816dMark Andrews#
9ee66e3a5b45654235472711439f9db1766c82caMark Andrews# This is a test script for unprivileged containers
9ee66e3a5b45654235472711439f9db1766c82caMark Andrews
9ee66e3a5b45654235472711439f9db1766c82caMark Andrews# This library is free software; you can redistribute it and/or
9ee66e3a5b45654235472711439f9db1766c82caMark Andrews# modify it under the terms of the GNU Lesser General Public
9ee66e3a5b45654235472711439f9db1766c82caMark Andrews# License as published by the Free Software Foundation; either
8b2b41ba4f8cabed897f2d852a6c07abfb23231eMark Andrews# version 2.1 of the License, or (at your option) any later version.
8b2b41ba4f8cabed897f2d852a6c07abfb23231eMark Andrews
47f8b47b8df05aade51e35b31c3df46fb121a098Mark Andrews# This library is distributed in the hope that it will be useful,
47f8b47b8df05aade51e35b31c3df46fb121a098Mark Andrews# but WITHOUT ANY WARRANTY; without even the implied warranty of
fcadf0b3205be950da14c80fedbf088fc8fd2190Evan Hunt# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
fcadf0b3205be950da14c80fedbf088fc8fd2190Evan Hunt# Lesser General Public License for more details.
fcadf0b3205be950da14c80fedbf088fc8fd2190Evan Hunt
fcadf0b3205be950da14c80fedbf088fc8fd2190Evan Hunt# You should have received a copy of the GNU Lesser General Public
fcadf0b3205be950da14c80fedbf088fc8fd2190Evan Hunt# License along with this library; if not, write to the Free Software
47f8b47b8df05aade51e35b31c3df46fb121a098Mark Andrews# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
47f8b47b8df05aade51e35b31c3df46fb121a098Mark Andrews
47f8b47b8df05aade51e35b31c3df46fb121a098Mark Andrews# This test assumes an Ubuntu host
d9a713819621972af4f90dfaa9e2bc72aad54d48Mark Andrews
8269f06a0fdaf5f4f03ffb20a3c0effd557c794cMark Andrewsif [ $(id -u) -ne 0 ]; then
31c7bf574e6e1b296c5cfa5699e4f2007fbd61cdMark Andrews echo "ERROR: Must run as root."
31c7bf574e6e1b296c5cfa5699e4f2007fbd61cdMark Andrews exit 1
6f2752da7a1036cd59be17236ca66630d00f11cdMukund Sivaramanfi
6f2752da7a1036cd59be17236ca66630d00f11cdMukund Sivaramanwhich newuidmap >/dev/null 2>&1 || { echo "'newuidmap' command is missing" >&2; exit 1; }
700d3cb7895b5da2543282d18735d2176d1aff86Mark Andrews
f0244761611dc4d0f80b36c0c0ccdb26fa6cf830Mark AndrewsDONE=0
f0244761611dc4d0f80b36c0c0ccdb26fa6cf830Mark Andrewscleanup() {
f0244761611dc4d0f80b36c0c0ccdb26fa6cf830Mark Andrews cd /
48ec547968d7da5b1240222c53a90efce25157a2Mark Andrews
48ec547968d7da5b1240222c53a90efce25157a2Mark Andrews run_cmd lxc-stop -n c2 -k || true
48ec547968d7da5b1240222c53a90efce25157a2Mark Andrews run_cmd lxc-stop -n c1 -k || true
095c47be5456c17087d7b39dfc97ebee65e0dfbbMark Andrews pkill -u $(id -u $TUSER) -9
095c47be5456c17087d7b39dfc97ebee65e0dfbbMark Andrews
178dc0e1d617a6ef6387e9942ba9cdb370d1bde2Mark Andrews sed -i '/lxcunpriv/d' /run/lxc/nics /etc/lxc/lxc-usernet
178dc0e1d617a6ef6387e9942ba9cdb370d1bde2Mark Andrews sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
178dc0e1d617a6ef6387e9942ba9cdb370d1bde2Mark Andrews
6aaf3d01a1a9829802498c5772b22d649d012181Mark Andrews rm -Rf $HDIR /run/user/$(id -u $TUSER)
6aaf3d01a1a9829802498c5772b22d649d012181Mark Andrews
6aaf3d01a1a9829802498c5772b22d649d012181Mark Andrews deluser $TUSER
e51ba2650025460b26092fb2500e0b6dfbf6d548Mark Andrews
e51ba2650025460b26092fb2500e0b6dfbf6d548Mark Andrews if [ $DONE -eq 0 ]; then
e51ba2650025460b26092fb2500e0b6dfbf6d548Mark Andrews echo "FAIL"
143526179e5965921e1bd17a4759c3993854b4f4Mark Andrews exit 1
143526179e5965921e1bd17a4759c3993854b4f4Mark Andrews fi
15bee593e70faca91a00331184fbbbc66080d422Mark Andrews echo "PASS"
15bee593e70faca91a00331184fbbbc66080d422Mark Andrews}
15bee593e70faca91a00331184fbbbc66080d422Mark Andrews
af326c2e3f90d86a8966a1298d7aa157667f97cdEvan Huntrun_cmd() {
af326c2e3f90d86a8966a1298d7aa157667f97cdEvan Hunt sudo -i -u $TUSER \
af326c2e3f90d86a8966a1298d7aa157667f97cdEvan Hunt env http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
af326c2e3f90d86a8966a1298d7aa157667f97cdEvan Hunt XDG_RUNTIME_DIR=/run/user/$(id -u $TUSER) $*
ce786900292468e465fb74df8712a625ce10e103Mukund Sivaraman}
ce786900292468e465fb74df8712a625ce10e103Mukund Sivaraman
ce786900292468e465fb74df8712a625ce10e103Mukund Sivaraman# create a test user
d102ab1b847716b045640faebf074a8092e0b023Mark AndrewsTUSER=lxcunpriv
d102ab1b847716b045640faebf074a8092e0b023Mark AndrewsHDIR=/home/$TUSER
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrews
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark AndrewsARCH=i386
d6fa26d0adaec6c910115be34fe7a5a5f402c14fMark Andrewsif type dpkg >/dev/null 2>&1; then
f503aa345b451f94875a5bab637223bcbbd93b6dEvan Hunt ARCH=$(dpkg --print-architecture)
f503aa345b451f94875a5bab637223bcbbd93b6dEvan Huntfi
f503aa345b451f94875a5bab637223bcbbd93b6dEvan Hunt
f503aa345b451f94875a5bab637223bcbbd93b6dEvan Hunttrap cleanup EXIT SIGHUP SIGINT SIGTERM
7df3f06c0bf0b78a88221348d6af6704d9ece7efMark Andrewsset -eu
7df3f06c0bf0b78a88221348d6af6704d9ece7efMark Andrews
a3253fb44c15a52bbb19bb38592b4dc02a004527Tinderbox Userdeluser $TUSER && rm -Rf $HDIR || true
d1cacbb37474b0cbee6c1ddd05d27f731b2b43baMark Andrewsuseradd $TUSER
d1cacbb37474b0cbee6c1ddd05d27f731b2b43baMark Andrews
2be9d18ee9bd1b4eec4720218e4f43352603291fMark Andrewsmkdir -p $HDIR
2be9d18ee9bd1b4eec4720218e4f43352603291fMark Andrewsecho "$TUSER veth lxcbr0 2" >> /etc/lxc/lxc-usernet
2be9d18ee9bd1b4eec4720218e4f43352603291fMark Andrewssed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
2be9d18ee9bd1b4eec4720218e4f43352603291fMark Andrews
4d506ae0d1671e5a1272ef1ef13986af01616ac4Mark Andrewsusermod -v 910000-919999 -w 910000-919999 $TUSER
65a3f6329735860093004f6b0fe69d6be886417bTinderbox User
8b82b4982c21dfeb164f04700c7204f6541a7856Evan Huntmkdir -p $HDIR/.config/lxc/
c40906dfad6dd6e3a3e3c94b8c8847bc9bc064e5Mark Andrewscat > $HDIR/.config/lxc/default.conf << EOF
c40906dfad6dd6e3a3e3c94b8c8847bc9bc064e5Mark Andrewslxc.network.type = veth
c40906dfad6dd6e3a3e3c94b8c8847bc9bc064e5Mark Andrewslxc.network.link = lxcbr0
f9e49fd80e2ac4fce0fef11d330b88ff3693ad99Witold Krecickilxc.id_map = u 0 910000 9999
f9e49fd80e2ac4fce0fef11d330b88ff3693ad99Witold Krecickilxc.id_map = g 0 910000 9999
e8c70b0c35c27a28ea2e0cafb252e1774ccc1727Mark AndrewsEOF
e8c70b0c35c27a28ea2e0cafb252e1774ccc1727Mark Andrewschown -R $TUSER: $HDIR
e8c70b0c35c27a28ea2e0cafb252e1774ccc1727Mark Andrews
7204d08a319cf590ae4280b8cc20999320398574Mark Andrewsmkdir -p /run/user/$(id -u $TUSER)
7204d08a319cf590ae4280b8cc20999320398574Mark Andrewschown -R $TUSER: /run/user/$(id -u $TUSER)
7204d08a319cf590ae4280b8cc20999320398574Mark Andrews
7204d08a319cf590ae4280b8cc20999320398574Mark Andrewscd $HDIR
6ce5279d0f30c8c760e27baf92bb44b3f4962354Evan Hunt
6ce5279d0f30c8c760e27baf92bb44b3f4962354Evan Huntif which cgm >/dev/null 2>&1; then
6ce5279d0f30c8c760e27baf92bb44b3f4962354Evan Hunt cgm create all $TUSER
6ce5279d0f30c8c760e27baf92bb44b3f4962354Evan Hunt cgm chown all $TUSER $(id -u $TUSER) $(id -g $TUSER)
f5898cf3484b1588d5239faa4062a2b2b606ce91Evan Hunt cgm movepid all $TUSER $$
f5898cf3484b1588d5239faa4062a2b2b606ce91Evan Huntelif [ -e /sys/fs/cgroup/cgmanager/sock ]; then
f5898cf3484b1588d5239faa4062a2b2b606ce91Evan Hunt for d in $(cut -d : -f 2 /proc/self/cgroup); do
f5898cf3484b1588d5239faa4062a2b2b606ce91Evan Hunt dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
f5898cf3484b1588d5239faa4062a2b2b606ce91Evan Hunt --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.Create \
f5898cf3484b1588d5239faa4062a2b2b606ce91Evan Hunt string:$d string:$TUSER >/dev/null
f5898cf3484b1588d5239faa4062a2b2b606ce91Evan Hunt
f5898cf3484b1588d5239faa4062a2b2b606ce91Evan Hunt dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
f5898cf3484b1588d5239faa4062a2b2b606ce91Evan Hunt --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.Chown \
c27c710939766a7bb315bde1f12ab18d93c77cc8Mark Andrews string:$d string:$TUSER int32:$(id -u $TUSER) int32:$(id -g $TUSER) >/dev/null
c27c710939766a7bb315bde1f12ab18d93c77cc8Mark Andrews
c27c710939766a7bb315bde1f12ab18d93c77cc8Mark Andrews dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
4e9a1ad22618a46dab82eeb2d030190cec0afbc6Mukund Sivaraman --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.MovePid \
4e9a1ad22618a46dab82eeb2d030190cec0afbc6Mukund Sivaraman string:$d string:$TUSER int32:$$ >/dev/null
4e9a1ad22618a46dab82eeb2d030190cec0afbc6Mukund Sivaraman done
4e9a1ad22618a46dab82eeb2d030190cec0afbc6Mukund Sivaramanelse
4e9a1ad22618a46dab82eeb2d030190cec0afbc6Mukund Sivaraman for d in /sys/fs/cgroup/*; do
555469af35c12189525921abbc3de3cefb5f9f0fMark Andrews [ ! -d $d/lxctest ] && mkdir $d/lxctest
555469af35c12189525921abbc3de3cefb5f9f0fMark Andrews chown -R $TUSER: $d/lxctest
c5342425ea5568af04f4b87d5d9690453b21c9f1Mark Andrews echo $$ > $d/lxctest/tasks
c5342425ea5568af04f4b87d5d9690453b21c9f1Mark Andrews done
c5342425ea5568af04f4b87d5d9690453b21c9f1Mark Andrewsfi
b4bbf494183e4158b417d9200297ff0764af2f9dMark Andrews
b4bbf494183e4158b417d9200297ff0764af2f9dMark Andrews# Copy the download template cache if available
b4bbf494183e4158b417d9200297ff0764af2f9dMark Andrewsrun_cmd mkdir -p $HDIR/.cache/lxc
f3a4a5f8db3d9fd352a3e2eb6be779a78da03f52Mark Andrews[ -d /var/cache/lxc/download ] && \
f3a4a5f8db3d9fd352a3e2eb6be779a78da03f52Mark Andrews cp -R /var/cache/lxc/download $HDIR/.cache/lxc && \
f3a4a5f8db3d9fd352a3e2eb6be779a78da03f52Mark Andrews chown -R $TUSER: $HDIR/.cache/lxc
2fb6d3782b548ba678cfb8ff09e0d1e49fafb84dMark Andrews
2fb6d3782b548ba678cfb8ff09e0d1e49fafb84dMark Andrewsrun_cmd lxc-create -t download -n c1 -- -d ubuntu -r trusty -a $ARCH
2fb6d3782b548ba678cfb8ff09e0d1e49fafb84dMark Andrewsrun_cmd lxc-start -n c1 -d
2fb6d3782b548ba678cfb8ff09e0d1e49fafb84dMark Andrews
2fb6d3782b548ba678cfb8ff09e0d1e49fafb84dMark Andrewsp1=$(run_cmd lxc-info -n c1 -p -H)
2fb6d3782b548ba678cfb8ff09e0d1e49fafb84dMark Andrews[ "$p1" != "-1" ] || { echo "Failed to start container c1"; false; }
bc09fd1365d1a48972fa99cd6ed2aa788a28ef33Mark Andrews
bc09fd1365d1a48972fa99cd6ed2aa788a28ef33Mark Andrewsrun_cmd lxc-info -n c1
bc09fd1365d1a48972fa99cd6ed2aa788a28ef33Mark Andrewsrun_cmd lxc-attach -n c1 -- /bin/true
36be0aad8ec241987e1866a547372eb28ee7dc09Mark Andrews
36be0aad8ec241987e1866a547372eb28ee7dc09Mark Andrewsrun_cmd lxc-stop -n c1
36be0aad8ec241987e1866a547372eb28ee7dc09Mark Andrewsrun_cmd lxc-clone -s -o c1 -n c2
36be0aad8ec241987e1866a547372eb28ee7dc09Mark Andrewsrun_cmd lxc-start -n c2 -d
36be0aad8ec241987e1866a547372eb28ee7dc09Mark Andrewsp1=$(run_cmd lxc-info -n c2 -p -H)
33f91e248b67afa96c5b855ba3ace20b5d89dbd0Mark Andrews[ "$p1" != "-1" ] || { echo "Failed to start container c2"; false; }
33f91e248b67afa96c5b855ba3ace20b5d89dbd0Mark Andrews
33f91e248b67afa96c5b855ba3ace20b5d89dbd0Mark Andrewsrun_cmd lxc-stop -n c2
51227d6f16840ae359701b5d56970a5f3860db5aEvan Hunt
51227d6f16840ae359701b5d56970a5f3860db5aEvan Huntif which cgm >/dev/null 2>&1; then
51227d6f16840ae359701b5d56970a5f3860db5aEvan Hunt echo "Testing containers under different cgroups per subsystem"
175a8414a785689cb028e6e133385dba9e1b9a95Evan Hunt run_cmd cgm create freezer x1/x2
9e4811dc90cca1f6f2d1ef86182f9613add06df3Mark Andrews cgm movepid freezer x1 $$
9e4811dc90cca1f6f2d1ef86182f9613add06df3Mark Andrews run_cmd lxc-start -n c1 -d
12b791ae2018561482f3b68dd6658c2ad1a4d934Mark Andrews p1=$(run_cmd lxc-info -n c1 -p -H)
12b791ae2018561482f3b68dd6658c2ad1a4d934Mark Andrews [ "$p1" != "-1" ] || { echo "Failed to start container c1"; false; }
12b791ae2018561482f3b68dd6658c2ad1a4d934Mark Andrews run_cmd lxc-info -n c1
080582dc4739cabf0170b54e9a453785d577e364Mark Andrews run_cmd lxc-attach -n c1 -- /bin/true
080582dc4739cabf0170b54e9a453785d577e364Mark Andrews run_cmd lxc-cgroup -n c1 freezer.state
080582dc4739cabf0170b54e9a453785d577e364Mark Andrews
3a71cd8ca3c4970b71ef503553eda2666ce3d2b1Mark Andrews echo "Testing lxc-attach and lxc-cgroup from different cgroup"
3a71cd8ca3c4970b71ef503553eda2666ce3d2b1Mark Andrews cgm movepid freezer x2 $$
3a71cd8ca3c4970b71ef503553eda2666ce3d2b1Mark Andrews run_cmd lxc-attach -n c1 -- /bin/true
02ceed9f83f82f0de35c7bd73c27a33d4f0fe9cbMark Andrews run_cmd lxc-cgroup -n c1 freezer.state
02ceed9f83f82f0de35c7bd73c27a33d4f0fe9cbMark Andrews run_cmd lxc-cgroup -n c1 memory.limit_in_bytes
02ceed9f83f82f0de35c7bd73c27a33d4f0fe9cbMark Andrewsfi
32431c79c76257130e1b31223e59a614e19bea1bEvan Hunt
32431c79c76257130e1b31223e59a614e19bea1bEvan HuntDONE=1
32431c79c76257130e1b31223e59a614e19bea1bEvan Hunt