mirror of
https://github.com/systemd/systemd
synced 2024-10-14 12:04:49 +00:00
test: add a couple of tests for machinectl
This commit is contained in:
parent
efdaa92ecb
commit
378db9e2b9
|
@ -5,6 +5,11 @@ set -e
|
||||||
TEST_DESCRIPTION="systemd-nspawn smoke test"
|
TEST_DESCRIPTION="systemd-nspawn smoke test"
|
||||||
IMAGE_NAME="nspawn"
|
IMAGE_NAME="nspawn"
|
||||||
TEST_NO_NSPAWN=1
|
TEST_NO_NSPAWN=1
|
||||||
|
# The test containers are missing the $BUILD_DIR with the necessary note files
|
||||||
|
# which generates lots of errors regarding missing coverage. Since fixing this
|
||||||
|
# would make the test code unnecessarily messy, let's just ignore them, at least
|
||||||
|
# for now.
|
||||||
|
IGNORE_MISSING_COVERAGE=yes
|
||||||
|
|
||||||
# shellcheck source=test/test-functions
|
# shellcheck source=test/test-functions
|
||||||
. "${TEST_BASE_DIR:?}/test-functions"
|
. "${TEST_BASE_DIR:?}/test-functions"
|
||||||
|
|
|
@ -193,6 +193,7 @@ BASICTOOLS=(
|
||||||
loadkeys
|
loadkeys
|
||||||
login
|
login
|
||||||
losetup
|
losetup
|
||||||
|
lsattr
|
||||||
lz4cat
|
lz4cat
|
||||||
mkfifo
|
mkfifo
|
||||||
mknod
|
mknod
|
||||||
|
|
197
test/units/testsuite-13.machinectl.sh
Executable file
197
test/units/testsuite-13.machinectl.sh
Executable file
|
@ -0,0 +1,197 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
||||||
|
# shellcheck disable=SC2016
|
||||||
|
set -eux
|
||||||
|
set -o pipefail
|
||||||
|
|
||||||
|
export PAGER=
|
||||||
|
|
||||||
|
CREATE_BB_CONTAINER="/usr/lib/systemd/tests/testdata/create-busybox-container"
|
||||||
|
|
||||||
|
at_exit() {
|
||||||
|
set +e
|
||||||
|
|
||||||
|
machinectl status long-running >/dev/null && machinectl kill --signal=KILL long-running
|
||||||
|
mountpoint -q /var/lib/machines && timeout 10 sh -c "while ! umount /var/lib/machines; do sleep .5; done"
|
||||||
|
}
|
||||||
|
|
||||||
|
trap at_exit EXIT
|
||||||
|
|
||||||
|
# Mount tmpfs over /var/lib/machines to not pollute the image
|
||||||
|
mkdir -p /var/lib/machines
|
||||||
|
mount -t tmpfs tmpfs /var/lib/machines
|
||||||
|
|
||||||
|
# Create a couple of containers we can refer to in tests
|
||||||
|
for i in {0..4}; do
|
||||||
|
"$CREATE_BB_CONTAINER" "/var/lib/machines/container$i"
|
||||||
|
machinectl start "container$i"
|
||||||
|
done
|
||||||
|
# Create one "long running" container with some basic signal handling
|
||||||
|
"$CREATE_BB_CONTAINER" /var/lib/machines/long-running
|
||||||
|
cat >/var/lib/machines/long-running/sbin/init <<\EOF
|
||||||
|
#!/bin/sh -x
|
||||||
|
#
|
||||||
|
PID=0
|
||||||
|
|
||||||
|
# sh doesn't recognize RTMIN+4, so we have to use the signal number directly
|
||||||
|
trap "touch /poweroff" 38
|
||||||
|
trap "touch /reboot" INT
|
||||||
|
trap "touch /trap" TRAP
|
||||||
|
trap 'kill $PID' EXIT
|
||||||
|
|
||||||
|
# We need to wait for the sleep process asynchronously in order to allow
|
||||||
|
# bash to process signals
|
||||||
|
sleep infinity &
|
||||||
|
PID=$!
|
||||||
|
while :; do
|
||||||
|
wait || :
|
||||||
|
done
|
||||||
|
EOF
|
||||||
|
machinectl start long-running
|
||||||
|
|
||||||
|
machinectl
|
||||||
|
machinectl --no-pager --help
|
||||||
|
machinectl --version
|
||||||
|
machinectl list
|
||||||
|
machinectl list --no-legend --no-ask-password
|
||||||
|
|
||||||
|
machinectl status long-running long-running long-running
|
||||||
|
machinectl status --full long-running
|
||||||
|
machinectl status --quiet --lines=1 long-running
|
||||||
|
machinectl status --lines=0 --max-addresses=0 long-running
|
||||||
|
machinectl status --machine=testuser@.host long-running
|
||||||
|
machinectl status --output=help long-running
|
||||||
|
while read -r output; do
|
||||||
|
machinectl status --output="$output" long-running
|
||||||
|
done < <(machinectl --output=help)
|
||||||
|
|
||||||
|
machinectl show
|
||||||
|
machinectl show --all
|
||||||
|
machinectl show --all --machine=root@
|
||||||
|
machinectl show --all --machine=testuser@
|
||||||
|
[[ "$(machinectl show --property=PoolPath --value)" == "/var/lib/machines" ]]
|
||||||
|
machinectl show long-running
|
||||||
|
machinectl show long-running long-running long-running --all
|
||||||
|
[[ "$(machinectl show --property=RootDirectory --value long-running)" == "/var/lib/machines/long-running" ]]
|
||||||
|
|
||||||
|
machinectl enable long-running
|
||||||
|
test -L /etc/systemd/system/machines.target.wants/systemd-nspawn@long-running.service
|
||||||
|
machinectl enable long-running long-running long-running container1
|
||||||
|
machinectl disable long-running
|
||||||
|
test ! -L /etc/systemd/system/machines.target.wants/systemd-nspawn@long-running.service
|
||||||
|
machinectl disable long-running long-running long-running container1
|
||||||
|
|
||||||
|
[[ "$(machinectl shell testuser@ /bin/sh -c 'echo -ne $FOO')" == "" ]]
|
||||||
|
[[ "$(machinectl shell --setenv=FOO=bar testuser@ /bin/sh -c 'echo -ne $FOO')" == "bar" ]]
|
||||||
|
|
||||||
|
[[ "$(machinectl show --property=State --value long-running)" == "running" ]]
|
||||||
|
# Equivalent to machinectl kill --signal=SIGRTMIN+4 --kill-whom=leader
|
||||||
|
rm -f /var/lib/machines/long-running/poweroff
|
||||||
|
machinectl poweroff long-running
|
||||||
|
test -e /var/lib/machines/long-running/poweroff
|
||||||
|
machinectl poweroff long-running long-running long-running
|
||||||
|
# Equivalent to machinectl kill --signal=SIGINT --kill-whom=leader
|
||||||
|
rm -f /var/lib/machines/long-running/reboot
|
||||||
|
machinectl reboot long-running
|
||||||
|
test -e /var/lib/machines/long-running/reboot
|
||||||
|
machinectl reboot long-running long-running long-running
|
||||||
|
# Skip machinectl terminate for now, as it doesn't play well with our "init"
|
||||||
|
rm -f /var/lib/machines/long-running/trap
|
||||||
|
machinectl kill --signal=SIGTRAP --kill-whom=leader long-running
|
||||||
|
test -e /var/lib/machines/long-running/trap
|
||||||
|
machinectl kill --signal=SIGTRAP --kill-whom=leader long-running long-running long-running
|
||||||
|
# All used signals should've been caught by a handler
|
||||||
|
[[ "$(machinectl show --property=State --value long-running)" == "running" ]]
|
||||||
|
|
||||||
|
cp /etc/machine-id /tmp/foo
|
||||||
|
machinectl copy-to long-running /tmp/foo /root/foo
|
||||||
|
test -f /var/lib/machines/long-running/root/foo
|
||||||
|
machinectl copy-from long-running /root/foo /tmp/bar
|
||||||
|
diff /tmp/foo /tmp/bar
|
||||||
|
rm -f /tmp/{foo,bar}
|
||||||
|
|
||||||
|
# machinectl bind is covered by testcase_check_machinectl_bind() in nspawn tests
|
||||||
|
|
||||||
|
machinectl list-images
|
||||||
|
machinectl list-images --no-legend
|
||||||
|
machinectl image-status
|
||||||
|
machinectl image-status container1
|
||||||
|
machinectl image-status container1 container1 container{0..4}
|
||||||
|
machinectl show-image
|
||||||
|
machinectl show-image container1
|
||||||
|
machinectl show-image container1 container1 container{0..4}
|
||||||
|
|
||||||
|
machinectl clone container1 clone1
|
||||||
|
machinectl show-image clone1
|
||||||
|
machinectl rename clone1 clone2
|
||||||
|
(! machinectl show-image clone1)
|
||||||
|
machinectl show-image clone2
|
||||||
|
if lsattr -d /var/lib/machines >/dev/null; then
|
||||||
|
[[ "$(machinectl show-image --property=ReadOnly --value clone2)" == no ]]
|
||||||
|
machinectl read-only clone2 yes
|
||||||
|
[[ "$(machinectl show-image --property=ReadOnly --value clone2)" == yes ]]
|
||||||
|
machinectl read-only clone2 no
|
||||||
|
[[ "$(machinectl show-image --property=ReadOnly --value clone2)" == no ]]
|
||||||
|
fi
|
||||||
|
machinectl remove clone2
|
||||||
|
for i in {0..4}; do
|
||||||
|
machinectl clone container1 "clone$i"
|
||||||
|
done
|
||||||
|
machinectl remove clone{0..4}
|
||||||
|
for i in {0..4}; do
|
||||||
|
machinectl clone container1 ".hidden$i"
|
||||||
|
done
|
||||||
|
machinectl list-images --all
|
||||||
|
test -d /var/lib/machines/.hidden1
|
||||||
|
machinectl clean
|
||||||
|
test ! -d /var/lib/machines/.hidden1
|
||||||
|
|
||||||
|
# Prepare a simple raw container
|
||||||
|
mkdir -p /tmp/mnt
|
||||||
|
dd if=/dev/zero of=/tmp/container.raw bs=1M count=32
|
||||||
|
mkfs.ext4 /tmp/container.raw
|
||||||
|
mount -o loop /tmp/container.raw /tmp/mnt
|
||||||
|
cp -r /var/lib/machines/container1/* /tmp/mnt
|
||||||
|
umount /tmp/mnt
|
||||||
|
# Try to import it, run it, export it, and re-import it
|
||||||
|
machinectl import-raw /tmp/container.raw container-raw
|
||||||
|
[[ "$(machinectl show-image --property=Type --value container-raw)" == "raw" ]]
|
||||||
|
machinectl start container-raw
|
||||||
|
machinectl export-raw container-raw /tmp/container-export.raw
|
||||||
|
machinectl import-raw /tmp/container-export.raw container-raw-reimport
|
||||||
|
[[ "$(machinectl show-image --property=Type --value container-raw-reimport)" == "raw" ]]
|
||||||
|
rm -f /tmp/container{,-export}.raw
|
||||||
|
|
||||||
|
# Prepare a simple tar.gz container
|
||||||
|
tar -pczf /tmp/container.tar.gz -C /var/lib/machines/container1 .
|
||||||
|
# Try to import it, run it, export it, and re-import it
|
||||||
|
machinectl import-tar /tmp/container.tar.gz container-tar
|
||||||
|
[[ "$(machinectl show-image --property=Type --value container-tar)" == "directory" ]]
|
||||||
|
machinectl start container-tar
|
||||||
|
machinectl export-tar container-tar /tmp/container-export.tar.gz
|
||||||
|
machinectl import-tar /tmp/container-export.tar.gz container-tar-reimport
|
||||||
|
[[ "$(machinectl show-image --property=Type --value container-tar-reimport)" == "directory" ]]
|
||||||
|
rm -f /tmp/container{,-export}.tar.gz
|
||||||
|
|
||||||
|
# Try to import a container directory & run it
|
||||||
|
cp -r /var/lib/machines/container1 /tmp/container.dir
|
||||||
|
machinectl import-fs /tmp/container.dir container-dir
|
||||||
|
[[ "$(machinectl show-image --property=Type --value container-dir)" == "directory" ]]
|
||||||
|
machinectl start container-dir
|
||||||
|
rm -fr /tmp/container.dir
|
||||||
|
|
||||||
|
timeout 10 sh -c "while ! machinectl clean --all; do sleep .5; done"
|
||||||
|
|
||||||
|
for opt in format lines machine max-addresses output setenv verify; do
|
||||||
|
(! machinectl status "--$opt=" long-running)
|
||||||
|
(! machinectl status "--$opt=-1" long-running)
|
||||||
|
(! machinectl status "--$opt=''" long-running)
|
||||||
|
done
|
||||||
|
(! machinectl show "")
|
||||||
|
(! machinectl enable)
|
||||||
|
(! machinectl enable "")
|
||||||
|
(! machinectl disable)
|
||||||
|
(! machinectl disable "")
|
||||||
|
(! machinectl read-only container1 "")
|
||||||
|
(! machinectl read-only container1 foo)
|
||||||
|
(! machinectl read-only container1 -- -1)
|
374
test/units/testsuite-13.nspawn.sh
Executable file
374
test/units/testsuite-13.nspawn.sh
Executable file
|
@ -0,0 +1,374 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
||||||
|
# shellcheck disable=SC2016
|
||||||
|
set -eux
|
||||||
|
set -o pipefail
|
||||||
|
|
||||||
|
export SYSTEMD_LOG_LEVEL=debug
|
||||||
|
export SYSTEMD_LOG_TARGET=journal
|
||||||
|
CREATE_BB_CONTAINER="/usr/lib/systemd/tests/testdata/create-busybox-container"
|
||||||
|
|
||||||
|
at_exit() {
|
||||||
|
set +e
|
||||||
|
|
||||||
|
mountpoint -q /var/lib/machines && umount /var/lib/machines
|
||||||
|
}
|
||||||
|
|
||||||
|
trap at_exit EXIT
|
||||||
|
|
||||||
|
# check cgroup-v2
|
||||||
|
IS_CGROUPSV2_SUPPORTED=no
|
||||||
|
mkdir -p /tmp/cgroup2
|
||||||
|
if mount -t cgroup2 cgroup2 /tmp/cgroup2; then
|
||||||
|
IS_CGROUPSV2_SUPPORTED=yes
|
||||||
|
umount /tmp/cgroup2
|
||||||
|
fi
|
||||||
|
rmdir /tmp/cgroup2
|
||||||
|
|
||||||
|
# check cgroup namespaces
|
||||||
|
IS_CGNS_SUPPORTED=no
|
||||||
|
if [[ -f /proc/1/ns/cgroup ]]; then
|
||||||
|
IS_CGNS_SUPPORTED=yes
|
||||||
|
fi
|
||||||
|
|
||||||
|
IS_USERNS_SUPPORTED=no
|
||||||
|
# On some systems (e.g. CentOS 7) the default limit for user namespaces
|
||||||
|
# is set to 0, which causes the following unshare syscall to fail, even
|
||||||
|
# with enabled user namespaces support. By setting this value explicitly
|
||||||
|
# we can ensure the user namespaces support to be detected correctly.
|
||||||
|
sysctl -w user.max_user_namespaces=10000
|
||||||
|
if unshare -U sh -c :; then
|
||||||
|
IS_USERNS_SUPPORTED=yes
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Mount tmpfs over /var/lib/machines to not pollute the image
|
||||||
|
mkdir -p /var/lib/machines
|
||||||
|
mount -t tmpfs tmpfs /var/lib/machines
|
||||||
|
|
||||||
|
testcase_check_bind_tmp_path() {
|
||||||
|
# https://github.com/systemd/systemd/issues/4789
|
||||||
|
local root
|
||||||
|
|
||||||
|
root="$(mktemp -d /var/lib/machines/testsuite-13.bind-tmp-path.XXX)"
|
||||||
|
"$CREATE_BB_CONTAINER" "$root"
|
||||||
|
: >/tmp/bind
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--bind=/tmp/bind \
|
||||||
|
/bin/sh -c 'test -e /tmp/bind'
|
||||||
|
|
||||||
|
rm -fr "$root" /tmp/bind
|
||||||
|
}
|
||||||
|
|
||||||
|
testcase_check_norbind() {
|
||||||
|
# https://github.com/systemd/systemd/issues/13170
|
||||||
|
local root
|
||||||
|
|
||||||
|
root="$(mktemp -d /var/lib/machines/testsuite-13.norbind-path.XXX)"
|
||||||
|
mkdir -p /tmp/binddir/subdir
|
||||||
|
echo -n "outer" >/tmp/binddir/subdir/file
|
||||||
|
mount -t tmpfs tmpfs /tmp/binddir/subdir
|
||||||
|
echo -n "inner" >/tmp/binddir/subdir/file
|
||||||
|
"$CREATE_BB_CONTAINER" "$root"
|
||||||
|
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--bind=/tmp/binddir:/mnt:norbind \
|
||||||
|
/bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi'
|
||||||
|
|
||||||
|
umount /tmp/binddir/subdir
|
||||||
|
rm -fr "$root" /tmp/binddir/
|
||||||
|
}
|
||||||
|
|
||||||
|
check_rootidmap_cleanup() {
|
||||||
|
local dir="${1:?}"
|
||||||
|
|
||||||
|
mountpoint -q "$dir/bind" && umount "$dir/bind"
|
||||||
|
rm -fr "$dir"
|
||||||
|
}
|
||||||
|
|
||||||
|
testcase_check_rootidmap() {
|
||||||
|
local root cmd permissions
|
||||||
|
local owner=1000
|
||||||
|
|
||||||
|
root="$(mktemp -d /var/lib/machines/testsuite-13.rootidmap-path.XXX)"
|
||||||
|
# Create ext4 image, as ext4 supports idmapped-mounts.
|
||||||
|
mkdir -p /tmp/rootidmap/bind
|
||||||
|
dd if=/dev/zero of=/tmp/rootidmap/ext4.img bs=4k count=2048
|
||||||
|
mkfs.ext4 /tmp/rootidmap/ext4.img
|
||||||
|
mount /tmp/rootidmap/ext4.img /tmp/rootidmap/bind
|
||||||
|
trap "check_rootidmap_cleanup /tmp/rootidmap/" RETURN
|
||||||
|
|
||||||
|
touch /tmp/rootidmap/bind/file
|
||||||
|
chown -R "$owner:$owner" /tmp/rootidmap/bind
|
||||||
|
|
||||||
|
"$CREATE_BB_CONTAINER" "$root"
|
||||||
|
cmd='PERMISSIONS=$(stat -c "%u:%g" /mnt/file); if [[ $PERMISSIONS != "0:0" ]]; then echo "*** wrong permissions: $PERMISSIONS"; return 1; fi; touch /mnt/other_file'
|
||||||
|
if ! SYSTEMD_LOG_TARGET=console \
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--bind=/tmp/rootidmap/bind:/mnt:rootidmap \
|
||||||
|
/bin/sh -c "$cmd" |& tee nspawn.out; then
|
||||||
|
if grep -q "Failed to map ids for bind mount.*: Function not implemented" nspawn.out; then
|
||||||
|
echo "idmapped mounts are not supported, skipping the test..."
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
permissions=$(stat -c "%u:%g" /tmp/rootidmap/bind/other_file)
|
||||||
|
if [[ $permissions != "$owner:$owner" ]]; then
|
||||||
|
echo "*** wrong permissions: $permissions"
|
||||||
|
[[ "$IS_USERNS_SUPPORTED" == "yes" ]] && return 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
testcase_check_notification_socket() {
|
||||||
|
# https://github.com/systemd/systemd/issues/4944
|
||||||
|
local cmd='echo a | $(busybox which nc) -U -u -w 1 /run/host/notify'
|
||||||
|
|
||||||
|
# /testsuite-13.nc-container is prepared by test.sh
|
||||||
|
systemd-nspawn --register=no --directory=/testsuite-13.nc-container /bin/sh -x -c "$cmd"
|
||||||
|
systemd-nspawn --register=no --directory=/testsuite-13.nc-container -U /bin/sh -x -c "$cmd"
|
||||||
|
}
|
||||||
|
|
||||||
|
testcase_check_os_release() {
|
||||||
|
local root entrypoint os_release_source
|
||||||
|
|
||||||
|
root="$(mktemp -d /var/lib/machines/testsuite-13.check-os-release.XXX)"
|
||||||
|
"$CREATE_BB_CONTAINER" "$root"
|
||||||
|
entrypoint="$root/entrypoint.sh"
|
||||||
|
cat >"$entrypoint" <<\EOF
|
||||||
|
#!/bin/sh -ex
|
||||||
|
|
||||||
|
. /tmp/os-release
|
||||||
|
[[ -n "${ID:-}" && "$ID" != "$container_host_id" ]] && exit 1
|
||||||
|
[[ -n "${VERSION_ID:-}" && "$VERSION_ID" != "$container_host_version_id" ]] && exit 1
|
||||||
|
[[ -n "${BUILD_ID:-}" && "$BUILD_ID" != "$container_host_build_id" ]] && exit 1
|
||||||
|
[[ -n "${VARIANT_ID:-}" && "$VARIANT_ID" != "$container_host_variant_id" ]] && exit 1
|
||||||
|
|
||||||
|
cd /tmp
|
||||||
|
(cd /run/host && md5sum os-release) | md5sum -c
|
||||||
|
EOF
|
||||||
|
chmod +x "$entrypoint"
|
||||||
|
|
||||||
|
os_release_source="/etc/os-release"
|
||||||
|
if [[ ! -r "$os_release_source" ]]; then
|
||||||
|
os_release_source="/usr/lib/os-release"
|
||||||
|
elif [[ -L "$os_release_source" ]]; then
|
||||||
|
# Ensure that /etc always wins if available
|
||||||
|
cp --remove-destination -fv /usr/lib/os-release /etc/os-release
|
||||||
|
echo MARKER=1 >>/etc/os-release
|
||||||
|
fi
|
||||||
|
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--bind="$os_release_source:/tmp/os-release" \
|
||||||
|
"${entrypoint##"$root"}"
|
||||||
|
|
||||||
|
if grep -q MARKER /etc/os-release; then
|
||||||
|
ln -svrf /usr/lib/os-release /etc/os-release
|
||||||
|
fi
|
||||||
|
|
||||||
|
rm -fr "$root"
|
||||||
|
}
|
||||||
|
|
||||||
|
testcase_check_machinectl_bind() {
|
||||||
|
local service_path service_name root container_name ec
|
||||||
|
local cmd='for i in $(seq 1 20); do if test -f /tmp/marker; then exit 0; fi; usleep 500000; done; exit 1;'
|
||||||
|
|
||||||
|
root="$(mktemp -d /var/lib/machines/testsuite-13.check-machinectl-bind.XXX)"
|
||||||
|
"$CREATE_BB_CONTAINER" "$root"
|
||||||
|
container_name="${root##*/}"
|
||||||
|
|
||||||
|
service_path="$(mktemp /run/systemd/system/nspawn-machinectl-bind-XXX.service)"
|
||||||
|
service_name="${service_path##*/}"
|
||||||
|
cat >"$service_path" <<EOF
|
||||||
|
[Service]
|
||||||
|
Type=notify
|
||||||
|
ExecStart=systemd-nspawn --directory="$root" --notify-ready=no /bin/sh -xec "$cmd"
|
||||||
|
EOF
|
||||||
|
|
||||||
|
systemctl daemon-reload
|
||||||
|
systemctl start "$service_name"
|
||||||
|
touch /tmp/marker
|
||||||
|
machinectl bind --mkdir "$container_name" /tmp/marker
|
||||||
|
|
||||||
|
timeout 10 bash -c "while [[ '\$(systemctl show -P SubState $service_name)' == running ]]; do sleep .2; done"
|
||||||
|
ec="$(systemctl show -P ExecMainStatus "$service_name")"
|
||||||
|
|
||||||
|
rm -fr "$root" "$service_path"
|
||||||
|
|
||||||
|
return "$ec"
|
||||||
|
}
|
||||||
|
|
||||||
|
testcase_check_selinux() {
|
||||||
|
# Basic test coverage to avoid issues like https://github.com/systemd/systemd/issues/19976
|
||||||
|
if ! command -v selinuxenabled >/dev/null || ! selinuxenabled; then
|
||||||
|
echo >&2 "SELinux is not enabled, skipping SELinux-related tests"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
local root
|
||||||
|
|
||||||
|
root="$(mktemp -d /var/lib/machines/testsuite-13.check-selinux.XXX)"
|
||||||
|
"$CREATE_BB_CONTAINER" "$root"
|
||||||
|
chcon -R -t container_t "$root"
|
||||||
|
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--boot \
|
||||||
|
--directory="$root" \
|
||||||
|
--selinux-apifs-context=system_u:object_r:container_file_t:s0:c0,c1 \
|
||||||
|
--selinux-context=system_u:system_r:container_t:s0:c0,c1
|
||||||
|
|
||||||
|
rm -fr "$root"
|
||||||
|
}
|
||||||
|
|
||||||
|
testcase_check_ephemeral_config() {
|
||||||
|
# https://github.com/systemd/systemd/issues/13297
|
||||||
|
local root container_name
|
||||||
|
|
||||||
|
root="$(mktemp -d /var/lib/machines/testsuite-13.check-ephemeral-config.XXX)"
|
||||||
|
"$CREATE_BB_CONTAINER" "$root"
|
||||||
|
container_name="${root##*/}"
|
||||||
|
|
||||||
|
mkdir -p /run/systemd/nspawn/
|
||||||
|
cat >"/run/systemd/nspawn/$container_name.nspawn" <<EOF
|
||||||
|
[Files]
|
||||||
|
BindReadOnly=/tmp/ephemeral-config
|
||||||
|
EOF
|
||||||
|
touch /tmp/ephemeral-config
|
||||||
|
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--ephemeral \
|
||||||
|
/bin/sh -x -c "test -f /tmp/ephemeral-config"
|
||||||
|
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--ephemeral \
|
||||||
|
--machine=foobar \
|
||||||
|
/bin/sh -x -c "! test -f /tmp/ephemeral-config"
|
||||||
|
|
||||||
|
rm -fr "$root" "/run/systemd/nspawn/$container_name"
|
||||||
|
}
|
||||||
|
|
||||||
|
matrix_run_one() {
|
||||||
|
local cgroupsv2="${1:?}"
|
||||||
|
local use_cgns="${2:?}"
|
||||||
|
local api_vfs_writable="${3:?}"
|
||||||
|
local root
|
||||||
|
|
||||||
|
if [[ "$cgroupsv2" == "yes" && "$IS_CGROUPSV2_SUPPORTED" == "no" ]]; then
|
||||||
|
echo >&2 "Unified cgroup hierarchy is not supported, skipping..."
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "$use_cgns" == "yes" && "$IS_CGNS_SUPPORTED" == "no" ]]; then
|
||||||
|
echo >&2 "CGroup namespaces are not supported, skipping..."
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
root="$(mktemp -d "/var/lib/machines/testsuite-13.unified-$1-cgns-$2-api-vfs-writable-$3.XXX")"
|
||||||
|
"$CREATE_BB_CONTAINER" "$root"
|
||||||
|
|
||||||
|
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--boot
|
||||||
|
|
||||||
|
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--private-network \
|
||||||
|
--boot
|
||||||
|
|
||||||
|
if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--private-users=pick \
|
||||||
|
--boot; then
|
||||||
|
[[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "network" ]] && return 1
|
||||||
|
else
|
||||||
|
[[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "network" ]] && return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--private-network \
|
||||||
|
--private-users=pick \
|
||||||
|
--boot; then
|
||||||
|
[[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "yes" ]] && return 1
|
||||||
|
else
|
||||||
|
[[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "yes" ]] && return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local netns_opt="--network-namespace-path=/proc/self/ns/net"
|
||||||
|
local net_opt
|
||||||
|
local net_opts=(
|
||||||
|
"--network-bridge=lo"
|
||||||
|
"--network-interface=lo"
|
||||||
|
"--network-ipvlan=lo"
|
||||||
|
"--network-macvlan=lo"
|
||||||
|
"--network-veth"
|
||||||
|
"--network-veth-extra=lo"
|
||||||
|
"--network-zone=zone"
|
||||||
|
)
|
||||||
|
|
||||||
|
# --network-namespace-path and network-related options cannot be used together
|
||||||
|
for net_opt in "${net_opts[@]}"; do
|
||||||
|
echo "$netns_opt in combination with $net_opt should fail"
|
||||||
|
if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--boot \
|
||||||
|
"$netns_opt" \
|
||||||
|
"$net_opt"; then
|
||||||
|
echo >&2 "unexpected pass"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
# allow combination of --network-namespace-path and --private-network
|
||||||
|
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--boot \
|
||||||
|
--private-network \
|
||||||
|
"$netns_opt"
|
||||||
|
|
||||||
|
# test --network-namespace-path works with a network namespace created by "ip netns"
|
||||||
|
ip netns add nspawn_test
|
||||||
|
netns_opt="--network-namespace-path=/run/netns/nspawn_test"
|
||||||
|
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
||||||
|
systemd-nspawn --register=no \
|
||||||
|
--directory="$root" \
|
||||||
|
--network-namespace-path=/run/netns/nspawn_test \
|
||||||
|
/bin/ip a | grep -v -E '^1: lo.*UP'
|
||||||
|
ip netns del nspawn_test
|
||||||
|
|
||||||
|
rm -fr "$root"
|
||||||
|
|
||||||
|
return 0
|
||||||
|
}
|
||||||
|
|
||||||
|
# Create a list of all functions prefixed with testcase_
|
||||||
|
mapfile -t TESTCASES < <(declare -F | awk '$3 ~ /^testcase_/ {print $3;}')
|
||||||
|
|
||||||
|
if [[ "${#TESTCASES[@]}" -eq 0 ]]; then
|
||||||
|
echo >&2 "No test cases found, this is most likely an error"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
for testcase in "${TESTCASES[@]}"; do
|
||||||
|
"$testcase"
|
||||||
|
done
|
||||||
|
|
||||||
|
for api_vfs_writable in yes no network; do
|
||||||
|
matrix_run_one no no $api_vfs_writable
|
||||||
|
matrix_run_one yes no $api_vfs_writable
|
||||||
|
matrix_run_one no yes $api_vfs_writable
|
||||||
|
matrix_run_one yes yes $api_vfs_writable
|
||||||
|
done
|
|
@ -1,376 +1,14 @@
|
||||||
#!/usr/bin/env bash
|
#!/usr/bin/env bash
|
||||||
# SPDX-License-Identifier: LGPL-2.1-or-later
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
||||||
# shellcheck disable=SC2016
|
|
||||||
set -eux
|
set -eux
|
||||||
set -o pipefail
|
set -o pipefail
|
||||||
|
|
||||||
export SYSTEMD_LOG_LEVEL=debug
|
# shellcheck source=test/units/test-control.sh
|
||||||
export SYSTEMD_LOG_TARGET=journal
|
. "$(dirname "$0")"/test-control.sh
|
||||||
CREATE_BB_CONTAINER="/usr/lib/systemd/tests/testdata/create-busybox-container"
|
|
||||||
|
|
||||||
at_exit() {
|
: >/failed
|
||||||
set +e
|
|
||||||
|
|
||||||
mountpoint -q /var/lib/machines && umount /var/lib/machines
|
run_subtests
|
||||||
}
|
|
||||||
|
|
||||||
trap at_exit EXIT
|
|
||||||
|
|
||||||
# check cgroup-v2
|
|
||||||
IS_CGROUPSV2_SUPPORTED=no
|
|
||||||
mkdir -p /tmp/cgroup2
|
|
||||||
if mount -t cgroup2 cgroup2 /tmp/cgroup2; then
|
|
||||||
IS_CGROUPSV2_SUPPORTED=yes
|
|
||||||
umount /tmp/cgroup2
|
|
||||||
fi
|
|
||||||
rmdir /tmp/cgroup2
|
|
||||||
|
|
||||||
# check cgroup namespaces
|
|
||||||
IS_CGNS_SUPPORTED=no
|
|
||||||
if [[ -f /proc/1/ns/cgroup ]]; then
|
|
||||||
IS_CGNS_SUPPORTED=yes
|
|
||||||
fi
|
|
||||||
|
|
||||||
IS_USERNS_SUPPORTED=no
|
|
||||||
# On some systems (e.g. CentOS 7) the default limit for user namespaces
|
|
||||||
# is set to 0, which causes the following unshare syscall to fail, even
|
|
||||||
# with enabled user namespaces support. By setting this value explicitly
|
|
||||||
# we can ensure the user namespaces support to be detected correctly.
|
|
||||||
sysctl -w user.max_user_namespaces=10000
|
|
||||||
if unshare -U sh -c :; then
|
|
||||||
IS_USERNS_SUPPORTED=yes
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Mount tmpfs over /var/lib/machines to not pollute the image
|
|
||||||
mkdir -p /var/lib/machines
|
|
||||||
mount -t tmpfs tmpfs /var/lib/machines
|
|
||||||
|
|
||||||
testcase_check_bind_tmp_path() {
|
|
||||||
# https://github.com/systemd/systemd/issues/4789
|
|
||||||
local root
|
|
||||||
|
|
||||||
root="$(mktemp -d /var/lib/machines/testsuite-13.bind-tmp-path.XXX)"
|
|
||||||
"$CREATE_BB_CONTAINER" "$root"
|
|
||||||
: >/tmp/bind
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--bind=/tmp/bind \
|
|
||||||
/bin/sh -c 'test -e /tmp/bind'
|
|
||||||
|
|
||||||
rm -fr "$root" /tmp/bind
|
|
||||||
}
|
|
||||||
|
|
||||||
testcase_check_norbind() {
|
|
||||||
# https://github.com/systemd/systemd/issues/13170
|
|
||||||
local root
|
|
||||||
|
|
||||||
root="$(mktemp -d /var/lib/machines/testsuite-13.norbind-path.XXX)"
|
|
||||||
mkdir -p /tmp/binddir/subdir
|
|
||||||
echo -n "outer" >/tmp/binddir/subdir/file
|
|
||||||
mount -t tmpfs tmpfs /tmp/binddir/subdir
|
|
||||||
echo -n "inner" >/tmp/binddir/subdir/file
|
|
||||||
"$CREATE_BB_CONTAINER" "$root"
|
|
||||||
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--bind=/tmp/binddir:/mnt:norbind \
|
|
||||||
/bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi'
|
|
||||||
|
|
||||||
umount /tmp/binddir/subdir
|
|
||||||
rm -fr "$root" /tmp/binddir/
|
|
||||||
}
|
|
||||||
|
|
||||||
check_rootidmap_cleanup() {
|
|
||||||
local dir="${1:?}"
|
|
||||||
|
|
||||||
mountpoint -q "$dir/bind" && umount "$dir/bind"
|
|
||||||
rm -fr "$dir"
|
|
||||||
}
|
|
||||||
|
|
||||||
testcase_check_rootidmap() {
|
|
||||||
local root cmd permissions
|
|
||||||
local owner=1000
|
|
||||||
|
|
||||||
root="$(mktemp -d /var/lib/machines/testsuite-13.rootidmap-path.XXX)"
|
|
||||||
# Create ext4 image, as ext4 supports idmapped-mounts.
|
|
||||||
mkdir -p /tmp/rootidmap/bind
|
|
||||||
dd if=/dev/zero of=/tmp/rootidmap/ext4.img bs=4k count=2048
|
|
||||||
mkfs.ext4 /tmp/rootidmap/ext4.img
|
|
||||||
mount /tmp/rootidmap/ext4.img /tmp/rootidmap/bind
|
|
||||||
trap "check_rootidmap_cleanup /tmp/rootidmap/" RETURN
|
|
||||||
|
|
||||||
touch /tmp/rootidmap/bind/file
|
|
||||||
chown -R "$owner:$owner" /tmp/rootidmap/bind
|
|
||||||
|
|
||||||
"$CREATE_BB_CONTAINER" "$root"
|
|
||||||
cmd='PERMISSIONS=$(stat -c "%u:%g" /mnt/file); if [[ $PERMISSIONS != "0:0" ]]; then echo "*** wrong permissions: $PERMISSIONS"; return 1; fi; touch /mnt/other_file'
|
|
||||||
if ! SYSTEMD_LOG_TARGET=console \
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--bind=/tmp/rootidmap/bind:/mnt:rootidmap \
|
|
||||||
/bin/sh -c "$cmd" |& tee nspawn.out; then
|
|
||||||
if grep -q "Failed to map ids for bind mount.*: Function not implemented" nspawn.out; then
|
|
||||||
echo "idmapped mounts are not supported, skipping the test..."
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
permissions=$(stat -c "%u:%g" /tmp/rootidmap/bind/other_file)
|
|
||||||
if [[ $permissions != "$owner:$owner" ]]; then
|
|
||||||
echo "*** wrong permissions: $permissions"
|
|
||||||
[[ "$IS_USERNS_SUPPORTED" == "yes" ]] && return 1
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
testcase_check_notification_socket() {
|
|
||||||
# https://github.com/systemd/systemd/issues/4944
|
|
||||||
local cmd='echo a | $(busybox which nc) -U -u -w 1 /run/host/notify'
|
|
||||||
|
|
||||||
# /testsuite-13.nc-container is prepared by test.sh
|
|
||||||
systemd-nspawn --register=no --directory=/testsuite-13.nc-container /bin/sh -x -c "$cmd"
|
|
||||||
systemd-nspawn --register=no --directory=/testsuite-13.nc-container -U /bin/sh -x -c "$cmd"
|
|
||||||
}
|
|
||||||
|
|
||||||
testcase_check_os_release() {
|
|
||||||
local root entrypoint os_release_source
|
|
||||||
|
|
||||||
root="$(mktemp -d /var/lib/machines/testsuite-13.check-os-release.XXX)"
|
|
||||||
"$CREATE_BB_CONTAINER" "$root"
|
|
||||||
entrypoint="$root/entrypoint.sh"
|
|
||||||
cat >"$entrypoint" <<\EOF
|
|
||||||
#!/bin/sh -ex
|
|
||||||
|
|
||||||
. /tmp/os-release
|
|
||||||
[[ -n "${ID:-}" && "$ID" != "$container_host_id" ]] && exit 1
|
|
||||||
[[ -n "${VERSION_ID:-}" && "$VERSION_ID" != "$container_host_version_id" ]] && exit 1
|
|
||||||
[[ -n "${BUILD_ID:-}" && "$BUILD_ID" != "$container_host_build_id" ]] && exit 1
|
|
||||||
[[ -n "${VARIANT_ID:-}" && "$VARIANT_ID" != "$container_host_variant_id" ]] && exit 1
|
|
||||||
|
|
||||||
cd /tmp
|
|
||||||
(cd /run/host && md5sum os-release) | md5sum -c
|
|
||||||
EOF
|
|
||||||
chmod +x "$entrypoint"
|
|
||||||
|
|
||||||
os_release_source="/etc/os-release"
|
|
||||||
if [[ ! -r "$os_release_source" ]]; then
|
|
||||||
os_release_source="/usr/lib/os-release"
|
|
||||||
elif [[ -L "$os_release_source" ]]; then
|
|
||||||
# Ensure that /etc always wins if available
|
|
||||||
cp --remove-destination -fv /usr/lib/os-release /etc/os-release
|
|
||||||
echo MARKER=1 >>/etc/os-release
|
|
||||||
fi
|
|
||||||
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--bind="$os_release_source:/tmp/os-release" \
|
|
||||||
"${entrypoint##"$root"}"
|
|
||||||
|
|
||||||
if grep -q MARKER /etc/os-release; then
|
|
||||||
ln -svrf /usr/lib/os-release /etc/os-release
|
|
||||||
fi
|
|
||||||
|
|
||||||
rm -fr "$root"
|
|
||||||
}
|
|
||||||
|
|
||||||
testcase_check_machinectl_bind() {
|
|
||||||
local service_path service_name root container_name ec
|
|
||||||
local cmd='for i in $(seq 1 20); do if test -f /tmp/marker; then exit 0; fi; usleep 500000; done; exit 1;'
|
|
||||||
|
|
||||||
root="$(mktemp -d /var/lib/machines/testsuite-13.check-machinectl-bind.XXX)"
|
|
||||||
"$CREATE_BB_CONTAINER" "$root"
|
|
||||||
container_name="${root##*/}"
|
|
||||||
|
|
||||||
service_path="$(mktemp /run/systemd/system/nspawn-machinectl-bind-XXX.service)"
|
|
||||||
service_name="${service_path##*/}"
|
|
||||||
cat >"$service_path" <<EOF
|
|
||||||
[Service]
|
|
||||||
Type=notify
|
|
||||||
ExecStart=systemd-nspawn --directory="$root" --notify-ready=no /bin/sh -xec "$cmd"
|
|
||||||
EOF
|
|
||||||
|
|
||||||
systemctl daemon-reload
|
|
||||||
systemctl start "$service_name"
|
|
||||||
touch /tmp/marker
|
|
||||||
machinectl bind --mkdir "$container_name" /tmp/marker
|
|
||||||
|
|
||||||
timeout 10 bash -c "while [[ '\$(systemctl show -P SubState $service_name)' == running ]]; do sleep .2; done"
|
|
||||||
ec="$(systemctl show -P ExecMainStatus "$service_name")"
|
|
||||||
|
|
||||||
rm -fr "$root" "$service_path"
|
|
||||||
|
|
||||||
return "$ec"
|
|
||||||
}
|
|
||||||
|
|
||||||
testcase_check_selinux() {
|
|
||||||
# Basic test coverage to avoid issues like https://github.com/systemd/systemd/issues/19976
|
|
||||||
if ! command -v selinuxenabled >/dev/null || ! selinuxenabled; then
|
|
||||||
echo >&2 "SELinux is not enabled, skipping SELinux-related tests"
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
local root
|
|
||||||
|
|
||||||
root="$(mktemp -d /var/lib/machines/testsuite-13.check-selinux.XXX)"
|
|
||||||
"$CREATE_BB_CONTAINER" "$root"
|
|
||||||
chcon -R -t container_t "$root"
|
|
||||||
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--boot \
|
|
||||||
--directory="$root" \
|
|
||||||
--selinux-apifs-context=system_u:object_r:container_file_t:s0:c0,c1 \
|
|
||||||
--selinux-context=system_u:system_r:container_t:s0:c0,c1
|
|
||||||
|
|
||||||
rm -fr "$root"
|
|
||||||
}
|
|
||||||
|
|
||||||
testcase_check_ephemeral_config() {
|
|
||||||
# https://github.com/systemd/systemd/issues/13297
|
|
||||||
local root container_name
|
|
||||||
|
|
||||||
root="$(mktemp -d /var/lib/machines/testsuite-13.check-ephemeral-config.XXX)"
|
|
||||||
"$CREATE_BB_CONTAINER" "$root"
|
|
||||||
container_name="${root##*/}"
|
|
||||||
|
|
||||||
mkdir -p /run/systemd/nspawn/
|
|
||||||
cat >"/run/systemd/nspawn/$container_name.nspawn" <<EOF
|
|
||||||
[Files]
|
|
||||||
BindReadOnly=/tmp/ephemeral-config
|
|
||||||
EOF
|
|
||||||
touch /tmp/ephemeral-config
|
|
||||||
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--ephemeral \
|
|
||||||
/bin/sh -x -c "test -f /tmp/ephemeral-config"
|
|
||||||
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--ephemeral \
|
|
||||||
--machine=foobar \
|
|
||||||
/bin/sh -x -c "! test -f /tmp/ephemeral-config"
|
|
||||||
|
|
||||||
rm -fr "$root" "/run/systemd/nspawn/$container_name"
|
|
||||||
}
|
|
||||||
|
|
||||||
matrix_run_one() {
|
|
||||||
local cgroupsv2="${1:?}"
|
|
||||||
local use_cgns="${2:?}"
|
|
||||||
local api_vfs_writable="${3:?}"
|
|
||||||
local root
|
|
||||||
|
|
||||||
if [[ "$cgroupsv2" == "yes" && "$IS_CGROUPSV2_SUPPORTED" == "no" ]]; then
|
|
||||||
echo >&2 "Unified cgroup hierarchy is not supported, skipping..."
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [[ "$use_cgns" == "yes" && "$IS_CGNS_SUPPORTED" == "no" ]]; then
|
|
||||||
echo >&2 "CGroup namespaces are not supported, skipping..."
|
|
||||||
return 0
|
|
||||||
fi
|
|
||||||
|
|
||||||
root="$(mktemp -d "/var/lib/machines/testsuite-13.unified-$1-cgns-$2-api-vfs-writable-$3.XXX")"
|
|
||||||
"$CREATE_BB_CONTAINER" "$root"
|
|
||||||
|
|
||||||
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--boot
|
|
||||||
|
|
||||||
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--private-network \
|
|
||||||
--boot
|
|
||||||
|
|
||||||
if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--private-users=pick \
|
|
||||||
--boot; then
|
|
||||||
[[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "network" ]] && return 1
|
|
||||||
else
|
|
||||||
[[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "network" ]] && return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--private-network \
|
|
||||||
--private-users=pick \
|
|
||||||
--boot; then
|
|
||||||
[[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "yes" ]] && return 1
|
|
||||||
else
|
|
||||||
[[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "yes" ]] && return 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
local netns_opt="--network-namespace-path=/proc/self/ns/net"
|
|
||||||
local net_opt
|
|
||||||
local net_opts=(
|
|
||||||
"--network-bridge=lo"
|
|
||||||
"--network-interface=lo"
|
|
||||||
"--network-ipvlan=lo"
|
|
||||||
"--network-macvlan=lo"
|
|
||||||
"--network-veth"
|
|
||||||
"--network-veth-extra=lo"
|
|
||||||
"--network-zone=zone"
|
|
||||||
)
|
|
||||||
|
|
||||||
# --network-namespace-path and network-related options cannot be used together
|
|
||||||
for net_opt in "${net_opts[@]}"; do
|
|
||||||
echo "$netns_opt in combination with $net_opt should fail"
|
|
||||||
if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--boot \
|
|
||||||
"$netns_opt" \
|
|
||||||
"$net_opt"; then
|
|
||||||
echo >&2 "unexpected pass"
|
|
||||||
return 1
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
|
|
||||||
# allow combination of --network-namespace-path and --private-network
|
|
||||||
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--boot \
|
|
||||||
--private-network \
|
|
||||||
"$netns_opt"
|
|
||||||
|
|
||||||
# test --network-namespace-path works with a network namespace created by "ip netns"
|
|
||||||
ip netns add nspawn_test
|
|
||||||
netns_opt="--network-namespace-path=/run/netns/nspawn_test"
|
|
||||||
SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \
|
|
||||||
systemd-nspawn --register=no \
|
|
||||||
--directory="$root" \
|
|
||||||
--network-namespace-path=/run/netns/nspawn_test \
|
|
||||||
/bin/ip a | grep -v -E '^1: lo.*UP'
|
|
||||||
ip netns del nspawn_test
|
|
||||||
|
|
||||||
rm -fr "$root"
|
|
||||||
|
|
||||||
return 0
|
|
||||||
}
|
|
||||||
|
|
||||||
# Create a list of all functions prefixed with testcase_
|
|
||||||
mapfile -t TESTCASES < <(declare -F | awk '$3 ~ /^testcase_/ {print $3;}')
|
|
||||||
|
|
||||||
if [[ "${#TESTCASES[@]}" -eq 0 ]]; then
|
|
||||||
echo >&2 "No test cases found, this is most likely an error"
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
for testcase in "${TESTCASES[@]}"; do
|
|
||||||
"$testcase"
|
|
||||||
done
|
|
||||||
|
|
||||||
for api_vfs_writable in yes no network; do
|
|
||||||
matrix_run_one no no $api_vfs_writable
|
|
||||||
matrix_run_one yes no $api_vfs_writable
|
|
||||||
matrix_run_one no yes $api_vfs_writable
|
|
||||||
matrix_run_one yes yes $api_vfs_writable
|
|
||||||
done
|
|
||||||
|
|
||||||
touch /testok
|
touch /testok
|
||||||
|
rm /failed
|
||||||
|
|
Loading…
Reference in a new issue