src/tests/lxc-test-unpriv

   1 #!/bin/bash
   2
   3 # lxc: linux Container library
   4
   5 # Authors:
   6 # Serge Hallyn <serge.hallyn@ubuntu.com>
   7 #
   8 # This is a test script for unprivileged containers
   9
  10 # This library is free software; you can redistribute it and/or
  11 # modify it under the terms of the GNU Lesser General Public
  12 # License as published by the Free Software Foundation; either
  13 # version 2.1 of the License, or (at your option) any later version.
  14
  15 # This library is distributed in the hope that it will be useful,
  16 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18 # Lesser General Public License for more details.
  19
  20 # You should have received a copy of the GNU Lesser General Public
  21 # License along with this library; if not, write to the Free Software
  22 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  23
  24 # This test assumes an Ubuntu host
  25
  26 if [ $(id -u) -ne 0 ]; then
  27         echo "ERROR: Must run as root."
  28         exit 1
  29 fi
  30
  31 # Test if we're using an overlayfs module that handles symlinks correctly. If
  32 # not, we skip these tests since overlay clones will not work correctly.
  33 if modprobe -q overlayfs; then
  34         TMPDIR=$(mktemp -d)
  35
  36         MOUNTDIR="${TMPDIR}/ovl_symlink_test"
  37
  38         mkdir ${MOUNTDIR}
  39
  40         mount -t tmpfs none ${MOUNTDIR}
  41
  42         mkdir ${MOUNTDIR}/{lowerdir,upperdir,workdir,overlayfs}
  43         mount -t overlayfs -o lowerdir="${MOUNTDIR}/lowerdir",upperdir="${MOUNTDIR}/upperdir",workdir="${MOUNTDIR}/workdir" none "${MOUNTDIR}/overlayfs"
  44
  45         CORRECT_LINK_TARGET="${MOUNTDIR}/overlayfs/placeholder_file"
  46         exec 9> "${CORRECT_LINK_TARGET}"
  47
  48         DETECTED_LINK_TARGET=$(readlink -q /proc/$$/fd/9)
  49
  50         # cleanup
  51         exec 9>&-
  52
  53         umount "${MOUNTDIR}/overlayfs"
  54         umount ${MOUNTDIR}
  55
  56         rmdir ${MOUNTDIR}
  57
  58         # This overlay module does not correctly handle symlinks, so skip the
  59         # tests.
  60         if [ "${DETECTED_LINK_TARGET}" != "${CORRECT_LINK_TARGET}" ]; then
  61                 exit 0
  62         fi
  63 fi
  64
  65 command -v newuidmap >/dev/null 2>&1 || { echo "'newuidmap' command is missing" >&2; exit 1; }
  66
  67 DONE=0
  68 UNPRIV_LOG=$(mktemp --dry-run)
  69 cleanup() {
  70         cd /
  71
  72         if [ $DONE -eq 0 ]; then
  73                 cat "${UNPRIV_LOG}"
  74         fi
  75         rm -f "${UNPRIV_LOG}" || true
  76
  77         run_cmd lxc-stop -n c2 -k -l trace -o "${UNPRIV_LOG}" || true
  78         run_cmd lxc-stop -n c1 -k -l trace -o "${UNPRIV_LOG}" || true
  79         pkill -u $(id -u $TUSER) -9 || true
  80
  81         sed -i '/lxcunpriv/d' /run/lxc/nics /etc/lxc/lxc-usernet
  82         sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
  83
  84         rm -Rf $HDIR /run/user/$(id -u $TUSER)
  85
  86         deluser $TUSER
  87
  88         if [ $DONE -eq 0 ]; then
  89                 echo "FAIL"
  90                 exit 1
  91         fi
  92
  93         echo "PASS"
  94 }
  95
  96 run_cmd() {
  97         sudo -i -u $TUSER \
  98             env http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
  99                 XDG_RUNTIME_DIR=/run/user/$(id -u $TUSER) ASAN_OPTIONS=${ASAN_OPTIONS:-} \
 100                 UBSAN_OPTIONS=${UBSAN_OPTIONS:-} $*
 101 }
 102
 103 # create a test user
 104 TUSER=lxcunpriv
 105 HDIR=/home/$TUSER
 106
 107 trap cleanup EXIT SIGHUP SIGINT SIGTERM
 108 set -eu
 109
 110 id $TUSER &> /dev/null && deluser -q --remove-home $TUSER
 111 useradd $TUSER
 112
 113 mkdir -p $HDIR
 114 echo "$TUSER veth lxcbr0 2" >> /etc/lxc/lxc-usernet
 115 sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
 116
 117 usermod -v 910000-919999 -w 910000-919999 $TUSER
 118
 119 mkdir -p $HDIR/.config/lxc/
 120 cat > $HDIR/.config/lxc/default.conf << EOF
 121 lxc.net.0.type = veth
 122 lxc.net.0.link = lxcbr0
 123 lxc.idmap = u 0 910000 9999
 124 lxc.idmap = g 0 910000 9999
 125 EOF
 126 chown -R $TUSER: $HDIR
 127
 128 mkdir -p /run/user/$(id -u $TUSER)
 129 chown -R $TUSER: /run/user/$(id -u $TUSER)
 130
 131 cd $HDIR
 132
 133 if command -v cgm >/dev/null 2>&1; then
 134         cgm create all $TUSER
 135         cgm chown all $TUSER $(id -u $TUSER) $(id -g $TUSER)
 136         cgm movepid all $TUSER $$
 137 elif [ -e /sys/fs/cgroup/cgmanager/sock ]; then
 138         for d in $(cut -d : -f 2 /proc/self/cgroup); do
 139                 dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
 140                         --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.Create \
 141                         string:$d string:$TUSER >/dev/null
 142
 143                 dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
 144                         --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.Chown \
 145                         string:$d string:$TUSER int32:$(id -u $TUSER) int32:$(id -g $TUSER) >/dev/null
 146
 147                 dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
 148                         --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.MovePid \
 149                         string:$d string:$TUSER int32:$$ >/dev/null
 150         done
 151 else
 152         for d in /sys/fs/cgroup/*; do
 153                 [ "$d" = "/sys/fs/cgroup/unified" ] && continue
 154                 [ -f $d/cgroup.clone_children ] && echo 1 > $d/cgroup.clone_children
 155                 [ ! -d $d/lxctest ] && mkdir $d/lxctest
 156                 chown -R $TUSER: $d/lxctest
 157                 echo $$ > $d/lxctest/tasks
 158         done
 159 fi
 160
 161 run_cmd lxc-create -t busybox -n c1 -l trace -o "${UNPRIV_LOG}"
 162
 163 # Make sure we can start it - twice
 164
 165 for count in $(seq 1 2); do
 166     run_cmd lxc-start -n c1 -d -l trace -o "${UNPRIV_LOG}"
 167
 168     p1=$(run_cmd lxc-info -n c1 -p -H -l trace -o "${UNPRIV_LOG}")
 169     [ "$p1" != "-1" ] || { echo "Failed to start container c1 (run $count)"; false; }
 170
 171     run_cmd lxc-info -n c1 -l trace -o "${UNPRIV_LOG}"
 172     run_cmd lxc-attach -n c1 -l trace -o "${UNPRIV_LOG}" -- /bin/true
 173
 174     run_cmd lxc-stop -n c1 -k -l trace -o "${UNPRIV_LOG}"
 175 done
 176
 177 run_cmd lxc-copy -s -n c1 -N c2 -l trace -o "${UNPRIV_LOG}"
 178 run_cmd lxc-start -n c2 -d -l trace -o "${UNPRIV_LOG}"
 179 p1=$(run_cmd lxc-info -n c2 -p -H -l trace -o "${UNPRIV_LOG}")
 180 [ "$p1" != "-1" ] || { echo "Failed to start container c2"; false; }
 181
 182 run_cmd lxc-stop -n c2 -k -l trace -o "${UNPRIV_LOG}"
 183
 184 if command -v cgm >/dev/null 2>&1; then
 185     echo "Testing containers under different cgroups per subsystem"
 186     run_cmd cgm create freezer x1/x2
 187     cgm movepid freezer x1 $$
 188     run_cmd lxc-start -n c1 -d -l trace -o "${UNPRIV_LOG}"
 189     p1=$(run_cmd lxc-info -n c1 -p -H -l trace -o "${UNPRIV_LOG}")
 190     [ "$p1" != "-1" ] || { echo "Failed to start container c1"; false; }
 191     run_cmd lxc-info -n c1 -l trace -o "${UNPRIV_LOG}"
 192     run_cmd lxc-attach -n c1 -l trace -o "${UNPRIV_LOG}" -- /bin/true
 193     run_cmd lxc-cgroup -n c1 freezer.state -l trace -o "${UNPRIV_LOG}"
 194
 195     echo "Testing lxc-attach and lxc-cgroup from different cgroup"
 196     cgm movepid freezer x2 $$
 197     run_cmd lxc-attach -n c1 -l trace -o "${UNPRIV_LOG}" -- /bin/true
 198     run_cmd lxc-cgroup -n c1 -l trace -o "${UNPRIV_LOG}" freezer.state
 199     run_cmd lxc-cgroup -n c1 -l trace -o "${UNPRIV_LOG}" memory.limit_in_bytes
 200 fi
 201
 202 DONE=1