src/tests/lxc-test-unpriv

   1 #!/bin/bash
   2
   3 # lxc: linux Container library
   4
   5 # Authors:
   6 # Serge Hallyn <serge.hallyn@ubuntu.com>
   7 #
   8 # This is a test script for unprivileged containers
   9
  10 # This library is free software; you can redistribute it and/or
  11 # modify it under the terms of the GNU Lesser General Public
  12 # License as published by the Free Software Foundation; either
  13 # version 2.1 of the License, or (at your option) any later version.
  14
  15 # This library is distributed in the hope that it will be useful,
  16 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18 # Lesser General Public License for more details.
  19
  20 # You should have received a copy of the GNU Lesser General Public
  21 # License along with this library; if not, write to the Free Software
  22 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  23
  24 # This test assumes an Ubuntu host
  25
  26 if [ $(id -u) -ne 0 ]; then
  27         echo "ERROR: Must run as root."
  28         exit 1
  29 fi
  30 which newuidmap >/dev/null 2>&1 || { echo "'newuidmap' command is missing" >&2; exit 1; }
  31
  32 DONE=0
  33 KNOWN_RELEASES="precise trusty xenial yakkety zesty"
  34 cleanup() {
  35         cd /
  36
  37         run_cmd lxc-stop -n c2 -k || true
  38         run_cmd lxc-stop -n c1 -k || true
  39         pkill -u $(id -u $TUSER) -9
  40
  41         sed -i '/lxcunpriv/d' /run/lxc/nics /etc/lxc/lxc-usernet
  42         sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
  43
  44         rm -Rf $HDIR /run/user/$(id -u $TUSER)
  45
  46         deluser $TUSER
  47
  48         if [ $DONE -eq 0 ]; then
  49                 echo "FAIL"
  50                 exit 1
  51         fi
  52         echo "PASS"
  53 }
  54
  55 run_cmd() {
  56         sudo -i -u $TUSER \
  57             env http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
  58                 XDG_RUNTIME_DIR=/run/user/$(id -u $TUSER) $*
  59 }
  60
  61 # create a test user
  62 TUSER=lxcunpriv
  63 HDIR=/home/$TUSER
  64
  65 ARCH=i386
  66 if type dpkg >/dev/null 2>&1; then
  67         ARCH=$(dpkg --print-architecture)
  68 fi
  69
  70 trap cleanup EXIT SIGHUP SIGINT SIGTERM
  71 set -eu
  72
  73 deluser $TUSER && rm -Rf $HDIR || true
  74 useradd $TUSER
  75
  76 mkdir -p $HDIR
  77 echo "$TUSER veth lxcbr0 2" >> /etc/lxc/lxc-usernet
  78 sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
  79
  80 usermod -v 910000-919999 -w 910000-919999 $TUSER
  81
  82 mkdir -p $HDIR/.config/lxc/
  83 cat > $HDIR/.config/lxc/default.conf << EOF
  84 lxc.network.type = veth
  85 lxc.network.link = lxcbr0
  86 lxc.id_map = u 0 910000 9999
  87 lxc.id_map = g 0 910000 9999
  88 EOF
  89 chown -R $TUSER: $HDIR
  90
  91 mkdir -p /run/user/$(id -u $TUSER)
  92 chown -R $TUSER: /run/user/$(id -u $TUSER)
  93
  94 cd $HDIR
  95
  96 if which cgm >/dev/null 2>&1; then
  97         cgm create all $TUSER
  98         cgm chown all $TUSER $(id -u $TUSER) $(id -g $TUSER)
  99         cgm movepid all $TUSER $$
 100 elif [ -e /sys/fs/cgroup/cgmanager/sock ]; then
 101         for d in $(cut -d : -f 2 /proc/self/cgroup); do
 102                 dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
 103                         --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.Create \
 104                         string:$d string:$TUSER >/dev/null
 105
 106                 dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
 107                         --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.Chown \
 108                         string:$d string:$TUSER int32:$(id -u $TUSER) int32:$(id -g $TUSER) >/dev/null
 109
 110                 dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
 111                         --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.MovePid \
 112                         string:$d string:$TUSER int32:$$ >/dev/null
 113         done
 114 else
 115         for d in /sys/fs/cgroup/*; do
 116                 [ -f $d/cgroup.clone_children ] && echo 1 > $d/cgroup.clone_children
 117                 [ ! -d $d/lxctest ] && mkdir $d/lxctest
 118                 chown -R $TUSER: $d/lxctest
 119                 echo $$ > $d/lxctest/tasks
 120         done
 121 fi
 122
 123 # default release is trusty, or the systems release if recognized
 124 release=trusty
 125 if [ -f /etc/lsb-release ]; then
 126     . /etc/lsb-release
 127     rels=$(ubuntu-distro-info --supported 2>/dev/null) ||
 128         rels="$KNOWN_RELEASES"
 129     for r in $rels; do
 130         [ "$DISTRIB_CODENAME" = "$r" ] && release="$r"
 131     done
 132 fi
 133
 134 # Copy the download template cache if available
 135 run_cmd mkdir -p $HDIR/.cache/lxc
 136 [ -d /var/cache/lxc/download ] && \
 137     cp -R /var/cache/lxc/download $HDIR/.cache/lxc && \
 138     chown -R $TUSER: $HDIR/.cache/lxc
 139
 140 run_cmd lxc-create -t download -n c1 -- -d ubuntu -r $release -a $ARCH
 141
 142 # Make sure we can start it - twice
 143
 144 for count in `seq 1 2`; do
 145     run_cmd lxc-start -n c1 -d
 146
 147     p1=$(run_cmd lxc-info -n c1 -p -H)
 148     [ "$p1" != "-1" ] || { echo "Failed to start container c1 (run $count)"; false; }
 149
 150     run_cmd lxc-info -n c1
 151     run_cmd lxc-attach -n c1 -- /bin/true
 152
 153     run_cmd lxc-stop -n c1
 154 done
 155
 156 run_cmd lxc-copy -s -n c1 -N c2
 157 run_cmd lxc-start -n c2 -d
 158 p1=$(run_cmd lxc-info -n c2 -p -H)
 159 [ "$p1" != "-1" ] || { echo "Failed to start container c2"; false; }
 160
 161 run_cmd lxc-stop -n c2
 162
 163 if which cgm >/dev/null 2>&1; then
 164     echo "Testing containers under different cgroups per subsystem"
 165     run_cmd cgm create freezer x1/x2
 166     cgm movepid freezer x1 $$
 167     run_cmd lxc-start -n c1 -d
 168     p1=$(run_cmd lxc-info -n c1 -p -H)
 169     [ "$p1" != "-1" ] || { echo "Failed to start container c1"; false; }
 170     run_cmd lxc-info -n c1
 171     run_cmd lxc-attach -n c1 -- /bin/true
 172     run_cmd lxc-cgroup -n c1 freezer.state
 173
 174     echo "Testing lxc-attach and lxc-cgroup from different cgroup"
 175     cgm movepid freezer x2 $$
 176     run_cmd lxc-attach -n c1 -- /bin/true
 177     run_cmd lxc-cgroup -n c1 freezer.state
 178     run_cmd lxc-cgroup -n c1 memory.limit_in_bytes
 179 fi
 180
 181 DONE=1