src/tests/lxc-test-apparmor-mount

   1 #!/bin/sh
   2
   3 # apparmor_mount: test proper handling of apparmor in kernels
   4 # without mount features
   5
   6 # These require the ubuntu lxc package to be installed.
   7
   8 # This program is free software; you can redistribute it and/or
   9 # modify it under the terms of the GNU Lesser General Public
  10 # License as published by the Free Software Foundation; either
  11 # version 2.1 of the License, or (at your option) any later version.
  12
  13 # This library is distributed in the hope that it will be useful,
  14 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16 # Lesser General Public License for more details.
  17
  18 # You should have received a copy of the GNU Lesser General Public
  19 # License along with this library; if not, write to the Free Software
  20 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  21
  22 # This test assumes an Ubuntu host
  23
  24 set -e
  25
  26 # Only run on a normally configured ubuntu lxc system
  27 if [ ! -d /sys/class/net/lxcbr0 ]; then
  28         echo "lxcbr0 is not configured."
  29         exit 1
  30 fi
  31 if [ "$(id -u)" != "0" ]; then
  32         echo "ERROR: Must run as root."
  33         exit 1
  34 fi
  35
  36 if [ -f /proc/self/ns/cgroup ]; then
  37         default_profile="lxc-container-default-cgns (enforce)"
  38 else
  39         default_profile="lxc-container-default (enforce)"
  40 fi
  41
  42 FAIL() {
  43         echo -n "Failed " >&2
  44         echo "$*" >&2
  45         exit 1
  46 }
  47
  48 run_cmd() {
  49         sudo -i -u $TUSER \
  50             env http_proxy=${http_proxy:-} https_proxy=${https_proxy:-} \
  51                 XDG_RUNTIME_DIR=/run/user/$(id -u $TUSER) $*
  52 }
  53
  54 DONE=0
  55 KNOWN_RELEASES="precise trusty xenial yakkety zesty"
  56 MOUNTSR=/sys/kernel/security/apparmor/features/mount
  57 dnam=`mktemp -d`
  58 logfile=`mktemp`
  59 cname=`basename $dnam`
  60 cleanup() {
  61         run_cmd lxc-destroy -f -n $cname || true
  62         umount -l $MOUNTSR || true
  63         rmdir $dnam || true
  64         pkill -u $(id -u $TUSER) -9 || true
  65         sed -i '/lxcunpriv/d' /run/lxc/nics /etc/lxc/lxc-usernet
  66         sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
  67         rm -Rf $HDIR /run/user/$(id -u $TUSER)
  68         deluser $TUSER
  69         if [ $DONE -eq 0 ]; then
  70                 echo 'Failed container log:' >&2
  71                 cat "$logfile" >&2
  72                 echo 'End log' >&2
  73                 rm -f "$logfile"
  74                 echo "FAIL"
  75                 exit 1
  76         fi
  77         rm -f "$logfile"
  78         echo "PASS"
  79 }
  80
  81 clear_log() {
  82         truncate -s0 "$logfile"
  83 }
  84
  85 trap cleanup exit
  86
  87 chmod 0666 "$logfile"
  88
  89 # This would be much simpler if we could run it as
  90 # root.  However, in order to not have the bind mount
  91 # of an empty directory over the securitfs 'mount' directory
  92 # be removed, we need to do this as non-root.
  93
  94 which newuidmap >/dev/null 2>&1 || { echo "'newuidmap' command is missing" >&2; exit 1; }
  95 # create a test user
  96 TUSER=lxcunpriv
  97 HDIR=/home/$TUSER
  98
  99 ARCH=i386
 100 if type dpkg >/dev/null 2>&1; then
 101         ARCH=$(dpkg --print-architecture)
 102 fi
 103
 104 deluser $TUSER && rm -Rf $HDIR || true
 105 useradd $TUSER
 106
 107 mkdir -p $HDIR
 108 echo "$TUSER veth lxcbr0 2" >> /etc/lxc/lxc-usernet
 109 sed -i '/^lxcunpriv:/d' /etc/subuid /etc/subgid
 110
 111 usermod -v 910000-919999 -w 910000-919999 $TUSER
 112
 113 mkdir -p $HDIR/.config/lxc/
 114 cat > $HDIR/.config/lxc/default.conf << EOF
 115 lxc.net.0.type = veth
 116 lxc.net.0.link = lxcbr0
 117 lxc.idmap = u 0 910000 9999
 118 lxc.idmap = g 0 910000 9999
 119 EOF
 120 chown -R $TUSER: $HDIR
 121
 122 mkdir -p /run/user/$(id -u $TUSER)
 123 chown -R $TUSER: /run/user/$(id -u $TUSER)
 124
 125 cd $HDIR
 126
 127 if which cgm >/dev/null 2>&1; then
 128         cgm create all $TUSER
 129         cgm chown all $TUSER $(id -u $TUSER) $(id -g $TUSER)
 130         cgm movepid all $TUSER $$
 131 elif [ -e /sys/fs/cgroup/cgmanager/sock ]; then
 132         for d in $(cut -d : -f 2 /proc/self/cgroup); do
 133                 dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
 134                         --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.Create \
 135                         string:$d string:$TUSER >/dev/null
 136
 137                 dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
 138                         --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.Chown \
 139                         string:$d string:$TUSER int32:$(id -u $TUSER) int32:$(id -g $TUSER) >/dev/null
 140
 141                 dbus-send --print-reply --address=unix:path=/sys/fs/cgroup/cgmanager/sock \
 142                         --type=method_call /org/linuxcontainers/cgmanager org.linuxcontainers.cgmanager0_0.MovePid \
 143                         string:$d string:$TUSER int32:$$ >/dev/null
 144         done
 145 else
 146         for d in /sys/fs/cgroup/*; do
 147                 [ "$d" = "/sys/fs/cgroup/unified" ] && continue
 148                 [ -f $d/cgroup.clone_children ] && echo 1 > $d/cgroup.clone_children
 149                 [ ! -d $d/lxctest ] && mkdir $d/lxctest
 150                 chown -R $TUSER: $d/lxctest
 151                 echo $$ > $d/lxctest/tasks
 152         done
 153 fi
 154
 155
 156 run_cmd mkdir -p $HDIR/.cache/lxc
 157 [ -d /var/cache/lxc/download ] && \
 158     cp -R /var/cache/lxc/download $HDIR/.cache/lxc && \
 159     chown -R $TUSER: $HDIR/.cache/lxc
 160
 161 # default release is trusty, or the systems release if recognized
 162 release=trusty
 163 if [ -f /etc/lsb-release ]; then
 164     . /etc/lsb-release
 165     rels=$(ubuntu-distro-info --supported 2>/dev/null) ||
 166         rels="$KNOWN_RELEASES"
 167     for r in $rels; do
 168         [ "$DISTRIB_CODENAME" = "$r" ] && release="$r"
 169     done
 170 fi
 171
 172 run_cmd lxc-create -t download -n $cname -- -d ubuntu -r $release -a $ARCH
 173
 174 echo "test default confined container"
 175 run_cmd lxc-start -n $cname -d -lDEBUG -o "$logfile"
 176 run_cmd lxc-wait -n $cname -s RUNNING
 177 pid=`run_cmd lxc-info -p -H -n $cname`
 178 profile=`cat /proc/$pid/attr/current`
 179 if [ "x$profile" != "x${default_profile}" ]; then
 180         echo "FAIL: confined container was in profile $profile"
 181         exit 1
 182 fi
 183 run_cmd lxc-stop -n $cname -k
 184 clear_log
 185
 186 echo "test regular unconfined container"
 187 echo "lxc.apparmor.profile = unconfined" >> $HDIR/.local/share/lxc/$cname/config
 188 run_cmd lxc-start -n $cname -d -lDEBUG -o "$logfile"
 189 run_cmd lxc-wait -n $cname -s RUNNING
 190 pid=`run_cmd lxc-info -p -H -n $cname`
 191 profile=`cat /proc/$pid/attr/current`
 192 if [ "x$profile" != "xunconfined" ]; then
 193         echo "FAIL: unconfined container was in profile $profile"
 194         exit 1
 195 fi
 196 run_cmd lxc-stop -n $cname -k
 197 clear_log
 198
 199 echo "masking $MOUNTSR"
 200 mount --bind $dnam $MOUNTSR
 201
 202 echo "test default confined container"
 203 sed -i '/apparmor.profile/d' $HDIR/.local/share/lxc/$cname/config
 204 run_cmd lxc-start -n $cname -d || true
 205 sleep 3
 206 pid=`run_cmd lxc-info -p -H -n $cname` || true
 207 if [ -n "$pid" -a "$pid" != "-1" ]; then
 208         echo "FAIL: confined container started without mount restrictions"
 209         echo "pid was $pid"
 210         exit 1
 211 fi
 212
 213 echo "test regular unconfined container"
 214 echo "lxc.apparmor.profile = unconfined" >> $HDIR/.local/share/lxc/$cname/config
 215 run_cmd lxc-start -n $cname -d -lDEBUG -o "$logfile"
 216 run_cmd lxc-wait -n $cname -s RUNNING
 217 pid=`run_cmd lxc-info -p -H -n $cname`
 218 if [ "$pid" = "-1" ]; then
 219         echo "FAIL: unconfined container failed to start without mount restrictions"
 220         exit 1
 221 fi
 222 profile=`cat /proc/$pid/attr/current`
 223 if [ "x$profile" != "xunconfined" ]; then
 224         echo "FAIL: confined container was in profile $profile"
 225         exit 1
 226 fi
 227 run_cmd lxc-stop -n $cname -k
 228 clear_log
 229
 230 echo "testing override"
 231 sed -i '/apparmor.profile/d' $HDIR/.local/share/lxc/$cname/config
 232 echo "lxc.apparmor.allow_incomplete = 1" >> $HDIR/.local/share/lxc/$cname/config
 233 run_cmd lxc-start -n $cname -d -lDEBUG -o "$logfile"
 234 run_cmd lxc-wait -n $cname -s RUNNING
 235 pid=`run_cmd lxc-info -p -H -n $cname`
 236 if [ "$pid" = "-1" ]; then
 237         echo "FAIL: excepted container failed to start without mount restrictions"
 238         exit 1
 239 fi
 240 profile=`cat /proc/$pid/attr/current`
 241 if [ "x$profile" != "x${default_profile}" ]; then
 242         echo "FAIL: confined container was in profile $profile"
 243         exit 1
 244 fi
 245 run_cmd lxc-stop -n $cname -k
 246 clear_log
 247
 248 DONE=1