From c2df08b5b815a1368e979a4ac9585e2fb1408d9f Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 12 May 2023 10:14:06 +0200 Subject: [PATCH 1/7] test: clean up the nspawn tests a bit --- test/TEST-13-NSPAWN-SMOKE/test.sh | 23 +- test/create-busybox-container | 16 +- test/test-functions | 3 +- test/units/testsuite-13.sh | 370 +++++++++++++++++++----------- 4 files changed, 259 insertions(+), 153 deletions(-) diff --git a/test/TEST-13-NSPAWN-SMOKE/test.sh b/test/TEST-13-NSPAWN-SMOKE/test.sh index 65c1e9be3d..8352541b17 100755 --- a/test/TEST-13-NSPAWN-SMOKE/test.sh +++ b/test/TEST-13-NSPAWN-SMOKE/test.sh @@ -10,21 +10,20 @@ TEST_NO_NSPAWN=1 . "${TEST_BASE_DIR:?}/test-functions" test_append_files() { - ( - local workspace="${1:?}" + local workspace="${1:?}" - # On openSUSE the static linked version of busybox is named "busybox-static". - busybox="$(type -P busybox-static || type -P busybox)" - inst_simple "$busybox" "$(dirname "$busybox")/busybox" + # On openSUSE the static linked version of busybox is named "busybox-static". + busybox="$(type -P busybox-static || type -P busybox)" + inst_simple "$busybox" "$(dirname "$busybox")/busybox" - if command -v selinuxenabled >/dev/null && selinuxenabled; then - image_install selinuxenabled - cp -ar /etc/selinux "$workspace/etc/selinux" - fi + if command -v selinuxenabled >/dev/null && selinuxenabled; then + image_install chcon selinuxenabled + cp -ar /etc/selinux "$workspace/etc/selinux" + sed -i "s/^SELINUX=.*$/SELINUX=permissive/" "$workspace/etc/selinux/config" + fi - "$TEST_BASE_DIR/create-busybox-container" "$workspace/testsuite-13.nc-container" - initdir="$workspace/testsuite-13.nc-container" image_install nc ip md5sum - ) + "$TEST_BASE_DIR/create-busybox-container" "$workspace/testsuite-13.nc-container" + initdir="$workspace/testsuite-13.nc-container" image_install nc ip md5sum } do_test "$@" diff --git a/test/create-busybox-container b/test/create-busybox-container index fca9d6150a..73d8066cc6 100755 --- a/test/create-busybox-container +++ b/test/create-busybox-container @@ -1,11 +1,10 @@ #!/usr/bin/env bash # SPDX-License-Identifier: LGPL-2.1-or-later -set -e -set -u +set -eu set -o pipefail -root="${1:?Usage $0 container-root}" +root="${1:?Usage: $0 container-root}" mkdir -p "$root" mkdir "$root/bin" @@ -16,17 +15,18 @@ cp "$busybox" "$root/bin/busybox" mkdir -p "$root/usr/lib" touch "$root/usr/lib/os-release" -ln -s busybox "$root/bin/sh" ln -s busybox "$root/bin/cat" -ln -s busybox "$root/bin/tr" -ln -s busybox "$root/bin/ps" ln -s busybox "$root/bin/ip" +ln -s busybox "$root/bin/md5sum" +ln -s busybox "$root/bin/ps" ln -s busybox "$root/bin/seq" +ln -s busybox "$root/bin/sh" ln -s busybox "$root/bin/sleep" -ln -s busybox "$root/bin/usleep" -ln -s busybox "$root/bin/test" ln -s busybox "$root/bin/stat" +ln -s busybox "$root/bin/test" ln -s busybox "$root/bin/touch" +ln -s busybox "$root/bin/tr" +ln -s busybox "$root/bin/usleep" mkdir -p "$root/sbin" cat <<'EOF' >"$root/sbin/init" diff --git a/test/test-functions b/test/test-functions index 2d303f4799..d59ac29382 100644 --- a/test/test-functions +++ b/test/test-functions @@ -808,8 +808,7 @@ setup_selinux() { ln -sf ../autorelabel.service "$initdir/usr/lib/systemd/tests/testdata/units/basic.target.wants/" image_install "${fixfiles_tools[@]}" - image_install fixfiles - image_install sestatus + image_install fixfiles sestatus } install_valgrind() { diff --git a/test/units/testsuite-13.sh b/test/units/testsuite-13.sh index 4ad7431e42..0a4b102f03 100755 --- a/test/units/testsuite-13.sh +++ b/test/units/testsuite-13.sh @@ -6,74 +6,109 @@ set -o pipefail export SYSTEMD_LOG_LEVEL=debug export SYSTEMD_LOG_TARGET=journal +CREATE_BB_CONTAINER="/usr/lib/systemd/tests/testdata/create-busybox-container" + +at_exit() { + set +e + + mountpoint -q /var/lib/machines && umount /var/lib/machines +} + +trap at_exit EXIT # check cgroup-v2 -is_v2_supported=no +IS_CGROUPSV2_SUPPORTED=no mkdir -p /tmp/cgroup2 if mount -t cgroup2 cgroup2 /tmp/cgroup2; then - is_v2_supported=yes + IS_CGROUPSV2_SUPPORTED=yes umount /tmp/cgroup2 fi rmdir /tmp/cgroup2 # check cgroup namespaces -is_cgns_supported=no +IS_CGNS_SUPPORTED=no if [[ -f /proc/1/ns/cgroup ]]; then - is_cgns_supported=yes + IS_CGNS_SUPPORTED=yes fi -is_user_ns_supported=no +IS_USERNS_SUPPORTED=no # On some systems (e.g. CentOS 7) the default limit for user namespaces # is set to 0, which causes the following unshare syscall to fail, even # with enabled user namespaces support. By setting this value explicitly # we can ensure the user namespaces support to be detected correctly. sysctl -w user.max_user_namespaces=10000 if unshare -U sh -c :; then - is_user_ns_supported=yes + IS_USERNS_SUPPORTED=yes fi -function check_bind_tmp_path { +# Mount tmpfs over /var/lib/machines to not pollute the image +mkdir -p /var/lib/machines +mount -t tmpfs tmpfs /var/lib/machines + +testcase_check_bind_tmp_path() { # https://github.com/systemd/systemd/issues/4789 - local _root="/var/lib/machines/testsuite-13.bind-tmp-path" - rm -rf "$_root" - /usr/lib/systemd/tests/testdata/create-busybox-container "$_root" + local root + + root="$(mktemp -d /var/lib/machines/testsuite-13.bind-tmp-path.XXX)" + "$CREATE_BB_CONTAINER" "$root" : >/tmp/bind - systemd-nspawn --register=no -D "$_root" --bind=/tmp/bind /bin/sh -c 'test -e /tmp/bind' + systemd-nspawn --register=no \ + --directory="$root" \ + --bind=/tmp/bind \ + /bin/sh -c 'test -e /tmp/bind' + + rm -fr "$root" /tmp/bind } -function check_norbind { +testcase_check_norbind() { # https://github.com/systemd/systemd/issues/13170 - local _root="/var/lib/machines/testsuite-13.norbind-path" - rm -rf "$_root" + local root + + root="$(mktemp -d /var/lib/machines/testsuite-13.norbind-path.XXX)" mkdir -p /tmp/binddir/subdir echo -n "outer" >/tmp/binddir/subdir/file mount -t tmpfs tmpfs /tmp/binddir/subdir echo -n "inner" >/tmp/binddir/subdir/file - /usr/lib/systemd/tests/testdata/create-busybox-container "$_root" - systemd-nspawn --register=no -D "$_root" --bind=/tmp/binddir:/mnt:norbind /bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi' + "$CREATE_BB_CONTAINER" "$root" + + systemd-nspawn --register=no \ + --directory="$root" \ + --bind=/tmp/binddir:/mnt:norbind \ + /bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi' + + umount /tmp/binddir/subdir + rm -fr "$root" /tmp/binddir/ } -function check_rootidmap { - local _owner=1000 - local _root="/var/lib/machines/testsuite-13.rootidmap-path" - local _command - rm -rf "$_root" +check_rootidmap_cleanup() { + local dir="${1:?}" + mountpoint -q "$dir/bind" && umount "$dir/bind" + rm -fr "$dir" +} + +testcase_check_rootidmap() { + local root cmd permissions + local owner=1000 + + root="$(mktemp -d /var/lib/machines/testsuite-13.rootidmap-path.XXX)" # Create ext4 image, as ext4 supports idmapped-mounts. - dd if=/dev/zero of=/tmp/ext4.img bs=4k count=2048 - mkfs.ext4 /tmp/ext4.img - mkdir -p /tmp/rootidmapdir - mount /tmp/ext4.img /tmp/rootidmapdir + mkdir -p /tmp/rootidmap/bind + dd if=/dev/zero of=/tmp/rootidmap/ext4.img bs=4k count=2048 + mkfs.ext4 /tmp/rootidmap/ext4.img + mount /tmp/rootidmap/ext4.img /tmp/rootidmap/bind + trap "check_rootidmap_cleanup /tmp/rootidmap/" RETURN - touch /tmp/rootidmapdir/file - chown -R $_owner:$_owner /tmp/rootidmapdir + touch /tmp/rootidmap/bind/file + chown -R "$owner:$owner" /tmp/rootidmap/bind - /usr/lib/systemd/tests/testdata/create-busybox-container "$_root" - _command='PERMISSIONS=$(stat -c "%u:%g" /mnt/file); if [[ $PERMISSIONS != "0:0" ]]; then echo "*** wrong permissions: $PERMISSIONS"; return 1; fi; touch /mnt/other_file' - if ! SYSTEMD_LOG_TARGET=console systemd-nspawn \ - --register=no -D "$_root" \ - --bind=/tmp/rootidmapdir:/mnt:rootidmap \ - /bin/sh -c "$_command" |& tee nspawn.out; then + "$CREATE_BB_CONTAINER" "$root" + cmd='PERMISSIONS=$(stat -c "%u:%g" /mnt/file); if [[ $PERMISSIONS != "0:0" ]]; then echo "*** wrong permissions: $PERMISSIONS"; return 1; fi; touch /mnt/other_file' + if ! SYSTEMD_LOG_TARGET=console \ + systemd-nspawn --register=no \ + --directory="$root" \ + --bind=/tmp/rootidmap/bind:/mnt:rootidmap \ + /bin/sh -c "$cmd" |& tee nspawn.out; then if grep -q "Failed to map ids for bind mount.*: Function not implemented" nspawn.out; then echo "idmapped mounts are not supported, skipping the test..." return 0 @@ -82,129 +117,197 @@ function check_rootidmap { return 1 fi - PERMISSIONS=$(stat -c "%u:%g" /tmp/rootidmapdir/other_file) - if [[ $PERMISSIONS != "$_owner:$_owner" ]]; then - echo "*** wrong permissions: $PERMISSIONS" - [[ "$is_user_ns_supported" = "yes" ]] && return 1 + permissions=$(stat -c "%u:%g" /tmp/rootidmap/bind/other_file) + if [[ $permissions != "$owner:$owner" ]]; then + echo "*** wrong permissions: $permissions" + [[ "$IS_USERNS_SUPPORTED" == "yes" ]] && return 1 fi } -function check_notification_socket { +testcase_check_notification_socket() { # https://github.com/systemd/systemd/issues/4944 - local _cmd='echo a | $(busybox which nc) -U -u -w 1 /run/host/notify' + local cmd='echo a | $(busybox which nc) -U -u -w 1 /run/host/notify' + # /testsuite-13.nc-container is prepared by test.sh - systemd-nspawn --register=no -D /testsuite-13.nc-container /bin/sh -x -c "$_cmd" - systemd-nspawn --register=no -D /testsuite-13.nc-container -U /bin/sh -x -c "$_cmd" + systemd-nspawn --register=no --directory=/testsuite-13.nc-container /bin/sh -x -c "$cmd" + systemd-nspawn --register=no --directory=/testsuite-13.nc-container -U /bin/sh -x -c "$cmd" } -function check_os_release { - local _cmd='. /tmp/os-release -if [ -n "${ID:+set}" ] && [ "${ID}" != "${container_host_id}" ]; then exit 1; fi -if [ -n "${VERSION_ID:+set}" ] && [ "${VERSION_ID}" != "${container_host_version_id}" ]; then exit 1; fi -if [ -n "${BUILD_ID:+set}" ] && [ "${BUILD_ID}" != "${container_host_build_id}" ]; then exit 1; fi -if [ -n "${VARIANT_ID:+set}" ] && [ "${VARIANT_ID}" != "${container_host_variant_id}" ]; then exit 1; fi -cd /tmp; (cd /run/host; md5sum os-release) | md5sum -c -if echo test >>/run/host/os-release; then exit 1; fi -' +testcase_check_os_release() { + local root entrypoint os_release_source - local _os_release_source="/etc/os-release" - if [[ ! -r "${_os_release_source}" ]]; then - _os_release_source="/usr/lib/os-release" - elif [[ -L "${_os_release_source}" ]] && rm /etc/os-release; then + root="$(mktemp -d /var/lib/machines/testsuite-13.check-os-release.XXX)" + "$CREATE_BB_CONTAINER" "$root" + entrypoint="$root/entrypoint.sh" + cat >"$entrypoint" <<\EOF +#!/bin/sh -ex + +. /tmp/os-release +[[ -n "${ID:-}" && "$ID" != "$container_host_id" ]] && exit 1 +[[ -n "${VERSION_ID:-}" && "$VERSION_ID" != "$container_host_version_id" ]] && exit 1 +[[ -n "${BUILD_ID:-}" && "$BUILD_ID" != "$container_host_build_id" ]] && exit 1 +[[ -n "${VARIANT_ID:-}" && "$VARIANT_ID" != "$container_host_variant_id" ]] && exit 1 + +cd /tmp +(cd /run/host && md5sum os-release) | md5sum -c +EOF + chmod +x "$entrypoint" + + os_release_source="/etc/os-release" + if [[ ! -r "$os_release_source" ]]; then + os_release_source="/usr/lib/os-release" + elif [[ -L "$os_release_source" ]]; then # Ensure that /etc always wins if available - cp /usr/lib/os-release /etc + cp --remove-destination -fv /usr/lib/os-release /etc/os-release echo MARKER=1 >>/etc/os-release fi - systemd-nspawn --register=no -D /testsuite-13.nc-container --bind="${_os_release_source}":/tmp/os-release /bin/sh -x -e -c "$_cmd" + systemd-nspawn --register=no \ + --directory="$root" \ + --bind="$os_release_source:/tmp/os-release" \ + "${entrypoint##"$root"}" if grep -q MARKER /etc/os-release; then - rm /etc/os-release - ln -s ../usr/lib/os-release /etc/os-release + ln -svrf /usr/lib/os-release /etc/os-release fi + + rm -fr "$root" } -function check_machinectl_bind { - local _cmd='for i in $(seq 1 20); do if test -f /tmp/marker; then exit 0; fi; usleep 500000; done; exit 1;' +testcase_check_machinectl_bind() { + local service_path service_name root container_name ec + local cmd='for i in $(seq 1 20); do if test -f /tmp/marker; then exit 0; fi; usleep 500000; done; exit 1;' - cat >/run/systemd/system/nspawn_machinectl_bind.service <"$service_path" </dev/null || ! selinuxenabled; then echo >&2 "SELinux is not enabled, skipping SELinux-related tests" return 0 fi - # Basic test coverage to avoid issues like https://github.com/systemd/systemd/issues/19976 - systemd-nspawn "${SUSE_OPTS[@]}" --register=no -b -D /testsuite-13.nc-container --selinux-apifs-context=system_u:object_r:container_file_t:s0:c0,c1 --selinux-context=system_u:system_r:container_t:s0:c0,c1 + local root + + root="$(mktemp -d /var/lib/machines/testsuite-13.check-selinux.XXX)" + "$CREATE_BB_CONTAINER" "$root" + chcon -R -t container_t "$root" + + systemd-nspawn --register=no \ + --boot \ + --directory="$root" \ + --selinux-apifs-context=system_u:object_r:container_file_t:s0:c0,c1 \ + --selinux-context=system_u:system_r:container_t:s0:c0,c1 + + rm -fr "$root" } -function check_ephemeral_config { +testcase_check_ephemeral_config() { # https://github.com/systemd/systemd/issues/13297 + local root container_name + + root="$(mktemp -d /var/lib/machines/testsuite-13.check-ephemeral-config.XXX)" + "$CREATE_BB_CONTAINER" "$root" + container_name="${root##*/}" mkdir -p /run/systemd/nspawn/ - cat >/run/systemd/nspawn/testsuite-13.nc-container.nspawn <"/run/systemd/nspawn/$container_name.nspawn" <&2 - return 0 - fi - if [[ "$2" = "yes" && "$is_cgns_supported" = "no" ]]; then - printf "CGroup namespaces are not supported. Skipping.\n" >&2 +matrix_run_one() { + local cgroupsv2="${1:?}" + local use_cgns="${2:?}" + local api_vfs_writable="${3:?}" + local root + + if [[ "$cgroupsv2" == "yes" && "$IS_CGROUPSV2_SUPPORTED" == "no" ]]; then + echo >&2 "Unified cgroup hierarchy is not supported, skipping..." return 0 fi - local _root="/var/lib/machines/testsuite-13.unified-$1-cgns-$2-api-vfs-writable-$3" - rm -rf "$_root" - /usr/lib/systemd/tests/testdata/create-busybox-container "$_root" - SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" -b - SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" --private-network -b - - if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" -U -b; then - [[ "$is_user_ns_supported" = "yes" && "$3" = "network" ]] && return 1 - else - [[ "$is_user_ns_supported" = "no" && "$3" = "network" ]] && return 1 + if [[ "$use_cgns" == "yes" && "$IS_CGNS_SUPPORTED" == "no" ]]; then + echo >&2 "CGroup namespaces are not supported, skipping..." + return 0 fi - if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" --private-network -U -b; then - [[ "$is_user_ns_supported" = "yes" && "$3" = "yes" ]] && return 1 + root="$(mktemp -d "/var/lib/machines/testsuite-13.unified-$1-cgns-$2-api-vfs-writable-$3.XXX")" + "$CREATE_BB_CONTAINER" "$root" + + SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --boot + + SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --private-network \ + --boot + + if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --private-users=pick \ + --boot; then + [[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "network" ]] && return 1 else - [[ "$is_user_ns_supported" = "no" && "$3" = "yes" ]] && return 1 + [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "network" ]] && return 1 fi - local _netns_opt="--network-namespace-path=/proc/self/ns/net" - local _net_opts=( + if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --private-network \ + --private-users=pick \ + --boot; then + [[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "yes" ]] && return 1 + else + [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "yes" ]] && return 1 + fi + + local netns_opt="--network-namespace-path=/proc/self/ns/net" + local net_opt + local net_opts=( "--network-bridge=lo" "--network-interface=lo" "--network-ipvlan=lo" @@ -215,54 +318,59 @@ function run { ) # --network-namespace-path and network-related options cannot be used together - for netopt in "${_net_opts[@]}"; do - echo "$_netns_opt in combination with $netopt should fail" - if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" -b "$_netns_opt" "$netopt"; then + for net_opt in "${net_opts[@]}"; do + echo "$netns_opt in combination with $net_opt should fail" + if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --boot \ + "$netns_opt" \ + "$net_opt"; then echo >&2 "unexpected pass" return 1 fi done # allow combination of --network-namespace-path and --private-network - if ! SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" -b "$_netns_opt" --private-network; then - return 1 - fi + SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --boot \ + --private-network \ + "$netns_opt" # test --network-namespace-path works with a network namespace created by "ip netns" ip netns add nspawn_test - _netns_opt="--network-namespace-path=/run/netns/nspawn_test" - SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" /bin/ip a | grep -v -E '^1: lo.*UP' - local r=$? + netns_opt="--network-namespace-path=/run/netns/nspawn_test" + SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --network-namespace-path=/run/netns/nspawn_test \ + /bin/ip a | grep -v -E '^1: lo.*UP' ip netns del nspawn_test - if [[ $r -ne 0 ]]; then - return 1 - fi + rm -fr "$root" return 0 } -check_bind_tmp_path +# Create a list of all functions prefixed with testcase_ +mapfile -t TESTCASES < <(declare -F | awk '$3 ~ /^testcase_/ {print $3;}') -check_norbind +if [[ "${#TESTCASES[@]}" -eq 0 ]]; then + echo >&2 "No test cases found, this is most likely an error" + exit 1 +fi -check_rootidmap - -check_notification_socket - -check_os_release - -for api_vfs_writable in yes no network; do - run no no $api_vfs_writable - run yes no $api_vfs_writable - run no yes $api_vfs_writable - run yes yes $api_vfs_writable +for testcase in "${TESTCASES[@]}"; do + "$testcase" done -check_machinectl_bind - -check_selinux - -check_ephemeral_config +for api_vfs_writable in yes no network; do + matrix_run_one no no $api_vfs_writable + matrix_run_one yes no $api_vfs_writable + matrix_run_one no yes $api_vfs_writable + matrix_run_one yes yes $api_vfs_writable +done touch /testok From 4b6ce580eee3f70412637c1df4239e448995535f Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 12 May 2023 14:43:23 +0200 Subject: [PATCH 2/7] machine: fix a memory leak when showing multiple images + machinectl image-status container1 container1 container0 container1 container2 container3 container4 ================================================================= ==1354==ERROR: LeakSanitizer: detected memory leaks Direct leak of 4704 byte(s) in 6 object(s) allocated from: #0 0x7fc3670ba097 in calloc (/lib64/libasan.so.8+0xba097) #1 0x7fc365e91e8e in message_from_header ../src/libsystemd/sd-bus/bus-message.c:372 #2 0x7fc365e92dfd in bus_message_from_malloc ../src/libsystemd/sd-bus/bus-message.c:421 #3 0x7fc365f089a8 in bus_socket_make_message ../src/libsystemd/sd-bus/bus-socket.c:1165 #4 0x7fc365f0affe in bus_socket_read_message ../src/libsystemd/sd-bus/bus-socket.c:1294 #5 0x7fc365f2db71 in bus_read_message ../src/libsystemd/sd-bus/sd-bus.c:2082 #6 0x7fc365f33352 in sd_bus_call ../src/libsystemd/sd-bus/sd-bus.c:2483 #7 0x7fc365e4da61 in sd_bus_call_methodv ../src/libsystemd/sd-bus/bus-convenience.c:183 #8 0x7fc3658789e8 in bus_call_method ../src/shared/bus-locator.c:109 #9 0x413b76 in show_image ../src/machine/machinectl.c:1014 #10 0x7fc365c5c8cf in dispatch_verb ../src/shared/verbs.c:103 #11 0x42e992 in machinectl_main ../src/machine/machinectl.c:2981 #12 0x42ebbd in run ../src/machine/machinectl.c:3006 #13 0x42ece3 in main ../src/machine/machinectl.c:3009 #14 0x7fc36444a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) Indirect leak of 666 byte(s) in 6 object(s) allocated from: #0 0x7fc3670b95b5 in __interceptor_realloc.part.0 (/lib64/libasan.so.8+0xb95b5) #1 0x7fc365f09822 in bus_socket_read_message ../src/libsystemd/sd-bus/bus-socket.c:1214 #2 0x7fc365f2db71 in bus_read_message ../src/libsystemd/sd-bus/sd-bus.c:2082 #3 0x7fc365f33352 in sd_bus_call ../src/libsystemd/sd-bus/sd-bus.c:2483 #4 0x7fc365e4da61 in sd_bus_call_methodv ../src/libsystemd/sd-bus/bus-convenience.c:183 #5 0x7fc3658789e8 in bus_call_method ../src/shared/bus-locator.c:109 #6 0x413b76 in show_image ../src/machine/machinectl.c:1014 #7 0x7fc365c5c8cf in dispatch_verb ../src/shared/verbs.c:103 #8 0x42e992 in machinectl_main ../src/machine/machinectl.c:2981 #9 0x42ebbd in run ../src/machine/machinectl.c:3006 #10 0x42ece3 in main ../src/machine/machinectl.c:3009 #11 0x7fc36444a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) Indirect leak of 12 byte(s) in 6 object(s) allocated from: #0 0x7fc36707243b in strdup (/lib64/libasan.so.8+0x7243b) #1 0x7fc365ec1543 in message_parse_fields ../src/libsystemd/sd-bus/bus-message.c:4125 #2 0x7fc365e93586 in bus_message_from_malloc ../src/libsystemd/sd-bus/bus-message.c:443 #3 0x7fc365f089a8 in bus_socket_make_message ../src/libsystemd/sd-bus/bus-socket.c:1165 #4 0x7fc365f0affe in bus_socket_read_message ../src/libsystemd/sd-bus/bus-socket.c:1294 #5 0x7fc365f2db71 in bus_read_message ../src/libsystemd/sd-bus/sd-bus.c:2082 #6 0x7fc365f33352 in sd_bus_call ../src/libsystemd/sd-bus/sd-bus.c:2483 #7 0x7fc365e4da61 in sd_bus_call_methodv ../src/libsystemd/sd-bus/bus-convenience.c:183 #8 0x7fc3658789e8 in bus_call_method ../src/shared/bus-locator.c:109 #9 0x413b76 in show_image ../src/machine/machinectl.c:1014 #10 0x7fc365c5c8cf in dispatch_verb ../src/shared/verbs.c:103 #11 0x42e992 in machinectl_main ../src/machine/machinectl.c:2981 #12 0x42ebbd in run ../src/machine/machinectl.c:3006 #13 0x42ece3 in main ../src/machine/machinectl.c:3009 #14 0x7fc36444a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) SUMMARY: AddressSanitizer: 5382 byte(s) leaked in 18 allocation(s). --- src/machine/machinectl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c index 353b339494..9ed9af08cd 100644 --- a/src/machine/machinectl.c +++ b/src/machine/machinectl.c @@ -984,9 +984,7 @@ static int show_image_properties(sd_bus *bus, const char *path, bool *new_line) } static int show_image(int argc, char *argv[], void *userdata) { - _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL; - _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL; bool properties, new_line = false; sd_bus *bus = ASSERT_PTR(userdata); int r = 0; @@ -1009,6 +1007,7 @@ static int show_image(int argc, char *argv[], void *userdata) { } for (int i = 1; i < argc; i++) { + _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL; const char *path = NULL; r = bus_call_method(bus, bus_machine_mgr, "GetImage", &error, &reply, "s", argv[i]); From efdaa92ecb1b358e9f27f7d263bb3383f6ab69c9 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 12 May 2023 14:50:52 +0200 Subject: [PATCH 3/7] machine: fix a memory leak when showing multiple machines + machinectl status long-running long-running long-running ================================================================= ==986==ERROR: LeakSanitizer: detected memory leaks Direct leak of 1568 byte(s) in 2 object(s) allocated from: #0 0x7fe57caba097 in calloc (/lib64/libasan.so.8+0xba097) #1 0x7fe57b891e8e in message_from_header ../src/libsystemd/sd-bus/bus-message.c:372 #2 0x7fe57b892dfd in bus_message_from_malloc ../src/libsystemd/sd-bus/bus-message.c:421 #3 0x7fe57b9089a8 in bus_socket_make_message ../src/libsystemd/sd-bus/bus-socket.c:1165 #4 0x7fe57b90affe in bus_socket_read_message ../src/libsystemd/sd-bus/bus-socket.c:1294 #5 0x7fe57b92db71 in bus_read_message ../src/libsystemd/sd-bus/sd-bus.c:2082 #6 0x7fe57b933352 in sd_bus_call ../src/libsystemd/sd-bus/sd-bus.c:2483 #7 0x7fe57b84da61 in sd_bus_call_methodv ../src/libsystemd/sd-bus/bus-convenience.c:183 #8 0x7fe57b2789e8 in bus_call_method ../src/shared/bus-locator.c:109 #9 0x40f71c in show_machine ../src/machine/machinectl.c:713 #10 0x7fe57b65c8cf in dispatch_verb ../src/shared/verbs.c:103 #11 0x42e9ce in machinectl_main ../src/machine/machinectl.c:2980 #12 0x42ebf9 in run ../src/machine/machinectl.c:3005 #13 0x42ed1f in main ../src/machine/machinectl.c:3008 #14 0x7fe579e4a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) Indirect leak of 234 byte(s) in 2 object(s) allocated from: #0 0x7fe57cab95b5 in __interceptor_realloc.part.0 (/lib64/libasan.so.8+0xb95b5) #1 0x7fe57b909822 in bus_socket_read_message ../src/libsystemd/sd-bus/bus-socket.c:1214 #2 0x7fe57b92db71 in bus_read_message ../src/libsystemd/sd-bus/sd-bus.c:2082 #3 0x7fe57b933352 in sd_bus_call ../src/libsystemd/sd-bus/sd-bus.c:2483 #4 0x7fe57b84da61 in sd_bus_call_methodv ../src/libsystemd/sd-bus/bus-convenience.c:183 #5 0x7fe57b2789e8 in bus_call_method ../src/shared/bus-locator.c:109 #6 0x40f71c in show_machine ../src/machine/machinectl.c:713 #7 0x7fe57b65c8cf in dispatch_verb ../src/shared/verbs.c:103 #8 0x42e9ce in machinectl_main ../src/machine/machinectl.c:2980 #9 0x42ebf9 in run ../src/machine/machinectl.c:3005 #10 0x42ed1f in main ../src/machine/machinectl.c:3008 #11 0x7fe579e4a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) Indirect leak of 4 byte(s) in 2 object(s) allocated from: #0 0x7fe57ca7243b in strdup (/lib64/libasan.so.8+0x7243b) #1 0x7fe57b8c1543 in message_parse_fields ../src/libsystemd/sd-bus/bus-message.c:4125 #2 0x7fe57b893586 in bus_message_from_malloc ../src/libsystemd/sd-bus/bus-message.c:443 #3 0x7fe57b9089a8 in bus_socket_make_message ../src/libsystemd/sd-bus/bus-socket.c:1165 #4 0x7fe57b90affe in bus_socket_read_message ../src/libsystemd/sd-bus/bus-socket.c:1294 #5 0x7fe57b92db71 in bus_read_message ../src/libsystemd/sd-bus/sd-bus.c:2082 #6 0x7fe57b933352 in sd_bus_call ../src/libsystemd/sd-bus/sd-bus.c:2483 #7 0x7fe57b84da61 in sd_bus_call_methodv ../src/libsystemd/sd-bus/bus-convenience.c:183 #8 0x7fe57b2789e8 in bus_call_method ../src/shared/bus-locator.c:109 #9 0x40f71c in show_machine ../src/machine/machinectl.c:713 #10 0x7fe57b65c8cf in dispatch_verb ../src/shared/verbs.c:103 #11 0x42e9ce in machinectl_main ../src/machine/machinectl.c:2980 #12 0x42ebf9 in run ../src/machine/machinectl.c:3005 #13 0x42ed1f in main ../src/machine/machinectl.c:3008 #14 0x7fe579e4a50f in __libc_start_call_main (/lib64/libc.so.6+0x2750f) SUMMARY: AddressSanitizer: 1806 byte(s) leaked in 6 allocation(s). --- src/machine/machinectl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c index 9ed9af08cd..197d0cfa1c 100644 --- a/src/machine/machinectl.c +++ b/src/machine/machinectl.c @@ -687,9 +687,7 @@ static int show_machine_properties(sd_bus *bus, const char *path, bool *new_line } static int show_machine(int argc, char *argv[], void *userdata) { - _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL; - _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL; bool properties, new_line = false; sd_bus *bus = ASSERT_PTR(userdata); int r = 0; @@ -708,6 +706,7 @@ static int show_machine(int argc, char *argv[], void *userdata) { } for (int i = 1; i < argc; i++) { + _cleanup_(sd_bus_message_unrefp) sd_bus_message *reply = NULL; const char *path = NULL; r = bus_call_method(bus, bus_machine_mgr, "GetMachine", &error, &reply, "s", argv[i]); From 378db9e2b93fe6b65f9c30fb839ca30fb3f1a135 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 12 May 2023 17:39:41 +0200 Subject: [PATCH 4/7] test: add a couple of tests for machinectl --- test/TEST-13-NSPAWN-SMOKE/test.sh | 5 + test/test-functions | 1 + test/units/testsuite-13.machinectl.sh | 197 ++++++++++++++ test/units/testsuite-13.nspawn.sh | 374 ++++++++++++++++++++++++++ test/units/testsuite-13.sh | 372 +------------------------ 5 files changed, 582 insertions(+), 367 deletions(-) create mode 100755 test/units/testsuite-13.machinectl.sh create mode 100755 test/units/testsuite-13.nspawn.sh diff --git a/test/TEST-13-NSPAWN-SMOKE/test.sh b/test/TEST-13-NSPAWN-SMOKE/test.sh index 8352541b17..f607c2733b 100755 --- a/test/TEST-13-NSPAWN-SMOKE/test.sh +++ b/test/TEST-13-NSPAWN-SMOKE/test.sh @@ -5,6 +5,11 @@ set -e TEST_DESCRIPTION="systemd-nspawn smoke test" IMAGE_NAME="nspawn" TEST_NO_NSPAWN=1 +# The test containers are missing the $BUILD_DIR with the necessary note files +# which generates lots of errors regarding missing coverage. Since fixing this +# would make the test code unnecessarily messy, let's just ignore them, at least +# for now. +IGNORE_MISSING_COVERAGE=yes # shellcheck source=test/test-functions . "${TEST_BASE_DIR:?}/test-functions" diff --git a/test/test-functions b/test/test-functions index d59ac29382..6063c5d5e2 100644 --- a/test/test-functions +++ b/test/test-functions @@ -193,6 +193,7 @@ BASICTOOLS=( loadkeys login losetup + lsattr lz4cat mkfifo mknod diff --git a/test/units/testsuite-13.machinectl.sh b/test/units/testsuite-13.machinectl.sh new file mode 100755 index 0000000000..9ca6f5f02b --- /dev/null +++ b/test/units/testsuite-13.machinectl.sh @@ -0,0 +1,197 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: LGPL-2.1-or-later +# shellcheck disable=SC2016 +set -eux +set -o pipefail + +export PAGER= + +CREATE_BB_CONTAINER="/usr/lib/systemd/tests/testdata/create-busybox-container" + +at_exit() { + set +e + + machinectl status long-running >/dev/null && machinectl kill --signal=KILL long-running + mountpoint -q /var/lib/machines && timeout 10 sh -c "while ! umount /var/lib/machines; do sleep .5; done" +} + +trap at_exit EXIT + +# Mount tmpfs over /var/lib/machines to not pollute the image +mkdir -p /var/lib/machines +mount -t tmpfs tmpfs /var/lib/machines + +# Create a couple of containers we can refer to in tests +for i in {0..4}; do + "$CREATE_BB_CONTAINER" "/var/lib/machines/container$i" + machinectl start "container$i" +done +# Create one "long running" container with some basic signal handling +"$CREATE_BB_CONTAINER" /var/lib/machines/long-running +cat >/var/lib/machines/long-running/sbin/init <<\EOF +#!/bin/sh -x +# +PID=0 + +# sh doesn't recognize RTMIN+4, so we have to use the signal number directly +trap "touch /poweroff" 38 +trap "touch /reboot" INT +trap "touch /trap" TRAP +trap 'kill $PID' EXIT + +# We need to wait for the sleep process asynchronously in order to allow +# bash to process signals +sleep infinity & +PID=$! +while :; do + wait || : +done +EOF +machinectl start long-running + +machinectl +machinectl --no-pager --help +machinectl --version +machinectl list +machinectl list --no-legend --no-ask-password + +machinectl status long-running long-running long-running +machinectl status --full long-running +machinectl status --quiet --lines=1 long-running +machinectl status --lines=0 --max-addresses=0 long-running +machinectl status --machine=testuser@.host long-running +machinectl status --output=help long-running +while read -r output; do + machinectl status --output="$output" long-running +done < <(machinectl --output=help) + +machinectl show +machinectl show --all +machinectl show --all --machine=root@ +machinectl show --all --machine=testuser@ +[[ "$(machinectl show --property=PoolPath --value)" == "/var/lib/machines" ]] +machinectl show long-running +machinectl show long-running long-running long-running --all +[[ "$(machinectl show --property=RootDirectory --value long-running)" == "/var/lib/machines/long-running" ]] + +machinectl enable long-running +test -L /etc/systemd/system/machines.target.wants/systemd-nspawn@long-running.service +machinectl enable long-running long-running long-running container1 +machinectl disable long-running +test ! -L /etc/systemd/system/machines.target.wants/systemd-nspawn@long-running.service +machinectl disable long-running long-running long-running container1 + +[[ "$(machinectl shell testuser@ /bin/sh -c 'echo -ne $FOO')" == "" ]] +[[ "$(machinectl shell --setenv=FOO=bar testuser@ /bin/sh -c 'echo -ne $FOO')" == "bar" ]] + +[[ "$(machinectl show --property=State --value long-running)" == "running" ]] +# Equivalent to machinectl kill --signal=SIGRTMIN+4 --kill-whom=leader +rm -f /var/lib/machines/long-running/poweroff +machinectl poweroff long-running +test -e /var/lib/machines/long-running/poweroff +machinectl poweroff long-running long-running long-running +# Equivalent to machinectl kill --signal=SIGINT --kill-whom=leader +rm -f /var/lib/machines/long-running/reboot +machinectl reboot long-running +test -e /var/lib/machines/long-running/reboot +machinectl reboot long-running long-running long-running +# Skip machinectl terminate for now, as it doesn't play well with our "init" +rm -f /var/lib/machines/long-running/trap +machinectl kill --signal=SIGTRAP --kill-whom=leader long-running +test -e /var/lib/machines/long-running/trap +machinectl kill --signal=SIGTRAP --kill-whom=leader long-running long-running long-running +# All used signals should've been caught by a handler +[[ "$(machinectl show --property=State --value long-running)" == "running" ]] + +cp /etc/machine-id /tmp/foo +machinectl copy-to long-running /tmp/foo /root/foo +test -f /var/lib/machines/long-running/root/foo +machinectl copy-from long-running /root/foo /tmp/bar +diff /tmp/foo /tmp/bar +rm -f /tmp/{foo,bar} + +# machinectl bind is covered by testcase_check_machinectl_bind() in nspawn tests + +machinectl list-images +machinectl list-images --no-legend +machinectl image-status +machinectl image-status container1 +machinectl image-status container1 container1 container{0..4} +machinectl show-image +machinectl show-image container1 +machinectl show-image container1 container1 container{0..4} + +machinectl clone container1 clone1 +machinectl show-image clone1 +machinectl rename clone1 clone2 +(! machinectl show-image clone1) +machinectl show-image clone2 +if lsattr -d /var/lib/machines >/dev/null; then + [[ "$(machinectl show-image --property=ReadOnly --value clone2)" == no ]] + machinectl read-only clone2 yes + [[ "$(machinectl show-image --property=ReadOnly --value clone2)" == yes ]] + machinectl read-only clone2 no + [[ "$(machinectl show-image --property=ReadOnly --value clone2)" == no ]] +fi +machinectl remove clone2 +for i in {0..4}; do + machinectl clone container1 "clone$i" +done +machinectl remove clone{0..4} +for i in {0..4}; do + machinectl clone container1 ".hidden$i" +done +machinectl list-images --all +test -d /var/lib/machines/.hidden1 +machinectl clean +test ! -d /var/lib/machines/.hidden1 + +# Prepare a simple raw container +mkdir -p /tmp/mnt +dd if=/dev/zero of=/tmp/container.raw bs=1M count=32 +mkfs.ext4 /tmp/container.raw +mount -o loop /tmp/container.raw /tmp/mnt +cp -r /var/lib/machines/container1/* /tmp/mnt +umount /tmp/mnt +# Try to import it, run it, export it, and re-import it +machinectl import-raw /tmp/container.raw container-raw +[[ "$(machinectl show-image --property=Type --value container-raw)" == "raw" ]] +machinectl start container-raw +machinectl export-raw container-raw /tmp/container-export.raw +machinectl import-raw /tmp/container-export.raw container-raw-reimport +[[ "$(machinectl show-image --property=Type --value container-raw-reimport)" == "raw" ]] +rm -f /tmp/container{,-export}.raw + +# Prepare a simple tar.gz container +tar -pczf /tmp/container.tar.gz -C /var/lib/machines/container1 . +# Try to import it, run it, export it, and re-import it +machinectl import-tar /tmp/container.tar.gz container-tar +[[ "$(machinectl show-image --property=Type --value container-tar)" == "directory" ]] +machinectl start container-tar +machinectl export-tar container-tar /tmp/container-export.tar.gz +machinectl import-tar /tmp/container-export.tar.gz container-tar-reimport +[[ "$(machinectl show-image --property=Type --value container-tar-reimport)" == "directory" ]] +rm -f /tmp/container{,-export}.tar.gz + +# Try to import a container directory & run it +cp -r /var/lib/machines/container1 /tmp/container.dir +machinectl import-fs /tmp/container.dir container-dir +[[ "$(machinectl show-image --property=Type --value container-dir)" == "directory" ]] +machinectl start container-dir +rm -fr /tmp/container.dir + +timeout 10 sh -c "while ! machinectl clean --all; do sleep .5; done" + +for opt in format lines machine max-addresses output setenv verify; do + (! machinectl status "--$opt=" long-running) + (! machinectl status "--$opt=-1" long-running) + (! machinectl status "--$opt=''" long-running) +done +(! machinectl show "") +(! machinectl enable) +(! machinectl enable "") +(! machinectl disable) +(! machinectl disable "") +(! machinectl read-only container1 "") +(! machinectl read-only container1 foo) +(! machinectl read-only container1 -- -1) diff --git a/test/units/testsuite-13.nspawn.sh b/test/units/testsuite-13.nspawn.sh new file mode 100755 index 0000000000..c234887d05 --- /dev/null +++ b/test/units/testsuite-13.nspawn.sh @@ -0,0 +1,374 @@ +#!/usr/bin/env bash +# SPDX-License-Identifier: LGPL-2.1-or-later +# shellcheck disable=SC2016 +set -eux +set -o pipefail + +export SYSTEMD_LOG_LEVEL=debug +export SYSTEMD_LOG_TARGET=journal +CREATE_BB_CONTAINER="/usr/lib/systemd/tests/testdata/create-busybox-container" + +at_exit() { + set +e + + mountpoint -q /var/lib/machines && umount /var/lib/machines +} + +trap at_exit EXIT + +# check cgroup-v2 +IS_CGROUPSV2_SUPPORTED=no +mkdir -p /tmp/cgroup2 +if mount -t cgroup2 cgroup2 /tmp/cgroup2; then + IS_CGROUPSV2_SUPPORTED=yes + umount /tmp/cgroup2 +fi +rmdir /tmp/cgroup2 + +# check cgroup namespaces +IS_CGNS_SUPPORTED=no +if [[ -f /proc/1/ns/cgroup ]]; then + IS_CGNS_SUPPORTED=yes +fi + +IS_USERNS_SUPPORTED=no +# On some systems (e.g. CentOS 7) the default limit for user namespaces +# is set to 0, which causes the following unshare syscall to fail, even +# with enabled user namespaces support. By setting this value explicitly +# we can ensure the user namespaces support to be detected correctly. +sysctl -w user.max_user_namespaces=10000 +if unshare -U sh -c :; then + IS_USERNS_SUPPORTED=yes +fi + +# Mount tmpfs over /var/lib/machines to not pollute the image +mkdir -p /var/lib/machines +mount -t tmpfs tmpfs /var/lib/machines + +testcase_check_bind_tmp_path() { + # https://github.com/systemd/systemd/issues/4789 + local root + + root="$(mktemp -d /var/lib/machines/testsuite-13.bind-tmp-path.XXX)" + "$CREATE_BB_CONTAINER" "$root" + : >/tmp/bind + systemd-nspawn --register=no \ + --directory="$root" \ + --bind=/tmp/bind \ + /bin/sh -c 'test -e /tmp/bind' + + rm -fr "$root" /tmp/bind +} + +testcase_check_norbind() { + # https://github.com/systemd/systemd/issues/13170 + local root + + root="$(mktemp -d /var/lib/machines/testsuite-13.norbind-path.XXX)" + mkdir -p /tmp/binddir/subdir + echo -n "outer" >/tmp/binddir/subdir/file + mount -t tmpfs tmpfs /tmp/binddir/subdir + echo -n "inner" >/tmp/binddir/subdir/file + "$CREATE_BB_CONTAINER" "$root" + + systemd-nspawn --register=no \ + --directory="$root" \ + --bind=/tmp/binddir:/mnt:norbind \ + /bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi' + + umount /tmp/binddir/subdir + rm -fr "$root" /tmp/binddir/ +} + +check_rootidmap_cleanup() { + local dir="${1:?}" + + mountpoint -q "$dir/bind" && umount "$dir/bind" + rm -fr "$dir" +} + +testcase_check_rootidmap() { + local root cmd permissions + local owner=1000 + + root="$(mktemp -d /var/lib/machines/testsuite-13.rootidmap-path.XXX)" + # Create ext4 image, as ext4 supports idmapped-mounts. + mkdir -p /tmp/rootidmap/bind + dd if=/dev/zero of=/tmp/rootidmap/ext4.img bs=4k count=2048 + mkfs.ext4 /tmp/rootidmap/ext4.img + mount /tmp/rootidmap/ext4.img /tmp/rootidmap/bind + trap "check_rootidmap_cleanup /tmp/rootidmap/" RETURN + + touch /tmp/rootidmap/bind/file + chown -R "$owner:$owner" /tmp/rootidmap/bind + + "$CREATE_BB_CONTAINER" "$root" + cmd='PERMISSIONS=$(stat -c "%u:%g" /mnt/file); if [[ $PERMISSIONS != "0:0" ]]; then echo "*** wrong permissions: $PERMISSIONS"; return 1; fi; touch /mnt/other_file' + if ! SYSTEMD_LOG_TARGET=console \ + systemd-nspawn --register=no \ + --directory="$root" \ + --bind=/tmp/rootidmap/bind:/mnt:rootidmap \ + /bin/sh -c "$cmd" |& tee nspawn.out; then + if grep -q "Failed to map ids for bind mount.*: Function not implemented" nspawn.out; then + echo "idmapped mounts are not supported, skipping the test..." + return 0 + fi + + return 1 + fi + + permissions=$(stat -c "%u:%g" /tmp/rootidmap/bind/other_file) + if [[ $permissions != "$owner:$owner" ]]; then + echo "*** wrong permissions: $permissions" + [[ "$IS_USERNS_SUPPORTED" == "yes" ]] && return 1 + fi +} + +testcase_check_notification_socket() { + # https://github.com/systemd/systemd/issues/4944 + local cmd='echo a | $(busybox which nc) -U -u -w 1 /run/host/notify' + + # /testsuite-13.nc-container is prepared by test.sh + systemd-nspawn --register=no --directory=/testsuite-13.nc-container /bin/sh -x -c "$cmd" + systemd-nspawn --register=no --directory=/testsuite-13.nc-container -U /bin/sh -x -c "$cmd" +} + +testcase_check_os_release() { + local root entrypoint os_release_source + + root="$(mktemp -d /var/lib/machines/testsuite-13.check-os-release.XXX)" + "$CREATE_BB_CONTAINER" "$root" + entrypoint="$root/entrypoint.sh" + cat >"$entrypoint" <<\EOF +#!/bin/sh -ex + +. /tmp/os-release +[[ -n "${ID:-}" && "$ID" != "$container_host_id" ]] && exit 1 +[[ -n "${VERSION_ID:-}" && "$VERSION_ID" != "$container_host_version_id" ]] && exit 1 +[[ -n "${BUILD_ID:-}" && "$BUILD_ID" != "$container_host_build_id" ]] && exit 1 +[[ -n "${VARIANT_ID:-}" && "$VARIANT_ID" != "$container_host_variant_id" ]] && exit 1 + +cd /tmp +(cd /run/host && md5sum os-release) | md5sum -c +EOF + chmod +x "$entrypoint" + + os_release_source="/etc/os-release" + if [[ ! -r "$os_release_source" ]]; then + os_release_source="/usr/lib/os-release" + elif [[ -L "$os_release_source" ]]; then + # Ensure that /etc always wins if available + cp --remove-destination -fv /usr/lib/os-release /etc/os-release + echo MARKER=1 >>/etc/os-release + fi + + systemd-nspawn --register=no \ + --directory="$root" \ + --bind="$os_release_source:/tmp/os-release" \ + "${entrypoint##"$root"}" + + if grep -q MARKER /etc/os-release; then + ln -svrf /usr/lib/os-release /etc/os-release + fi + + rm -fr "$root" +} + +testcase_check_machinectl_bind() { + local service_path service_name root container_name ec + local cmd='for i in $(seq 1 20); do if test -f /tmp/marker; then exit 0; fi; usleep 500000; done; exit 1;' + + root="$(mktemp -d /var/lib/machines/testsuite-13.check-machinectl-bind.XXX)" + "$CREATE_BB_CONTAINER" "$root" + container_name="${root##*/}" + + service_path="$(mktemp /run/systemd/system/nspawn-machinectl-bind-XXX.service)" + service_name="${service_path##*/}" + cat >"$service_path" </dev/null || ! selinuxenabled; then + echo >&2 "SELinux is not enabled, skipping SELinux-related tests" + return 0 + fi + + local root + + root="$(mktemp -d /var/lib/machines/testsuite-13.check-selinux.XXX)" + "$CREATE_BB_CONTAINER" "$root" + chcon -R -t container_t "$root" + + systemd-nspawn --register=no \ + --boot \ + --directory="$root" \ + --selinux-apifs-context=system_u:object_r:container_file_t:s0:c0,c1 \ + --selinux-context=system_u:system_r:container_t:s0:c0,c1 + + rm -fr "$root" +} + +testcase_check_ephemeral_config() { + # https://github.com/systemd/systemd/issues/13297 + local root container_name + + root="$(mktemp -d /var/lib/machines/testsuite-13.check-ephemeral-config.XXX)" + "$CREATE_BB_CONTAINER" "$root" + container_name="${root##*/}" + + mkdir -p /run/systemd/nspawn/ + cat >"/run/systemd/nspawn/$container_name.nspawn" <&2 "Unified cgroup hierarchy is not supported, skipping..." + return 0 + fi + + if [[ "$use_cgns" == "yes" && "$IS_CGNS_SUPPORTED" == "no" ]]; then + echo >&2 "CGroup namespaces are not supported, skipping..." + return 0 + fi + + root="$(mktemp -d "/var/lib/machines/testsuite-13.unified-$1-cgns-$2-api-vfs-writable-$3.XXX")" + "$CREATE_BB_CONTAINER" "$root" + + SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --boot + + SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --private-network \ + --boot + + if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --private-users=pick \ + --boot; then + [[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "network" ]] && return 1 + else + [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "network" ]] && return 1 + fi + + if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --private-network \ + --private-users=pick \ + --boot; then + [[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "yes" ]] && return 1 + else + [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "yes" ]] && return 1 + fi + + local netns_opt="--network-namespace-path=/proc/self/ns/net" + local net_opt + local net_opts=( + "--network-bridge=lo" + "--network-interface=lo" + "--network-ipvlan=lo" + "--network-macvlan=lo" + "--network-veth" + "--network-veth-extra=lo" + "--network-zone=zone" + ) + + # --network-namespace-path and network-related options cannot be used together + for net_opt in "${net_opts[@]}"; do + echo "$netns_opt in combination with $net_opt should fail" + if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --boot \ + "$netns_opt" \ + "$net_opt"; then + echo >&2 "unexpected pass" + return 1 + fi + done + + # allow combination of --network-namespace-path and --private-network + SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --boot \ + --private-network \ + "$netns_opt" + + # test --network-namespace-path works with a network namespace created by "ip netns" + ip netns add nspawn_test + netns_opt="--network-namespace-path=/run/netns/nspawn_test" + SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ + systemd-nspawn --register=no \ + --directory="$root" \ + --network-namespace-path=/run/netns/nspawn_test \ + /bin/ip a | grep -v -E '^1: lo.*UP' + ip netns del nspawn_test + + rm -fr "$root" + + return 0 +} + +# Create a list of all functions prefixed with testcase_ +mapfile -t TESTCASES < <(declare -F | awk '$3 ~ /^testcase_/ {print $3;}') + +if [[ "${#TESTCASES[@]}" -eq 0 ]]; then + echo >&2 "No test cases found, this is most likely an error" + exit 1 +fi + +for testcase in "${TESTCASES[@]}"; do + "$testcase" +done + +for api_vfs_writable in yes no network; do + matrix_run_one no no $api_vfs_writable + matrix_run_one yes no $api_vfs_writable + matrix_run_one no yes $api_vfs_writable + matrix_run_one yes yes $api_vfs_writable +done diff --git a/test/units/testsuite-13.sh b/test/units/testsuite-13.sh index 0a4b102f03..5a07e7b78c 100755 --- a/test/units/testsuite-13.sh +++ b/test/units/testsuite-13.sh @@ -1,376 +1,14 @@ #!/usr/bin/env bash # SPDX-License-Identifier: LGPL-2.1-or-later -# shellcheck disable=SC2016 set -eux set -o pipefail -export SYSTEMD_LOG_LEVEL=debug -export SYSTEMD_LOG_TARGET=journal -CREATE_BB_CONTAINER="/usr/lib/systemd/tests/testdata/create-busybox-container" +# shellcheck source=test/units/test-control.sh +. "$(dirname "$0")"/test-control.sh -at_exit() { - set +e +: >/failed - mountpoint -q /var/lib/machines && umount /var/lib/machines -} - -trap at_exit EXIT - -# check cgroup-v2 -IS_CGROUPSV2_SUPPORTED=no -mkdir -p /tmp/cgroup2 -if mount -t cgroup2 cgroup2 /tmp/cgroup2; then - IS_CGROUPSV2_SUPPORTED=yes - umount /tmp/cgroup2 -fi -rmdir /tmp/cgroup2 - -# check cgroup namespaces -IS_CGNS_SUPPORTED=no -if [[ -f /proc/1/ns/cgroup ]]; then - IS_CGNS_SUPPORTED=yes -fi - -IS_USERNS_SUPPORTED=no -# On some systems (e.g. CentOS 7) the default limit for user namespaces -# is set to 0, which causes the following unshare syscall to fail, even -# with enabled user namespaces support. By setting this value explicitly -# we can ensure the user namespaces support to be detected correctly. -sysctl -w user.max_user_namespaces=10000 -if unshare -U sh -c :; then - IS_USERNS_SUPPORTED=yes -fi - -# Mount tmpfs over /var/lib/machines to not pollute the image -mkdir -p /var/lib/machines -mount -t tmpfs tmpfs /var/lib/machines - -testcase_check_bind_tmp_path() { - # https://github.com/systemd/systemd/issues/4789 - local root - - root="$(mktemp -d /var/lib/machines/testsuite-13.bind-tmp-path.XXX)" - "$CREATE_BB_CONTAINER" "$root" - : >/tmp/bind - systemd-nspawn --register=no \ - --directory="$root" \ - --bind=/tmp/bind \ - /bin/sh -c 'test -e /tmp/bind' - - rm -fr "$root" /tmp/bind -} - -testcase_check_norbind() { - # https://github.com/systemd/systemd/issues/13170 - local root - - root="$(mktemp -d /var/lib/machines/testsuite-13.norbind-path.XXX)" - mkdir -p /tmp/binddir/subdir - echo -n "outer" >/tmp/binddir/subdir/file - mount -t tmpfs tmpfs /tmp/binddir/subdir - echo -n "inner" >/tmp/binddir/subdir/file - "$CREATE_BB_CONTAINER" "$root" - - systemd-nspawn --register=no \ - --directory="$root" \ - --bind=/tmp/binddir:/mnt:norbind \ - /bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi' - - umount /tmp/binddir/subdir - rm -fr "$root" /tmp/binddir/ -} - -check_rootidmap_cleanup() { - local dir="${1:?}" - - mountpoint -q "$dir/bind" && umount "$dir/bind" - rm -fr "$dir" -} - -testcase_check_rootidmap() { - local root cmd permissions - local owner=1000 - - root="$(mktemp -d /var/lib/machines/testsuite-13.rootidmap-path.XXX)" - # Create ext4 image, as ext4 supports idmapped-mounts. - mkdir -p /tmp/rootidmap/bind - dd if=/dev/zero of=/tmp/rootidmap/ext4.img bs=4k count=2048 - mkfs.ext4 /tmp/rootidmap/ext4.img - mount /tmp/rootidmap/ext4.img /tmp/rootidmap/bind - trap "check_rootidmap_cleanup /tmp/rootidmap/" RETURN - - touch /tmp/rootidmap/bind/file - chown -R "$owner:$owner" /tmp/rootidmap/bind - - "$CREATE_BB_CONTAINER" "$root" - cmd='PERMISSIONS=$(stat -c "%u:%g" /mnt/file); if [[ $PERMISSIONS != "0:0" ]]; then echo "*** wrong permissions: $PERMISSIONS"; return 1; fi; touch /mnt/other_file' - if ! SYSTEMD_LOG_TARGET=console \ - systemd-nspawn --register=no \ - --directory="$root" \ - --bind=/tmp/rootidmap/bind:/mnt:rootidmap \ - /bin/sh -c "$cmd" |& tee nspawn.out; then - if grep -q "Failed to map ids for bind mount.*: Function not implemented" nspawn.out; then - echo "idmapped mounts are not supported, skipping the test..." - return 0 - fi - - return 1 - fi - - permissions=$(stat -c "%u:%g" /tmp/rootidmap/bind/other_file) - if [[ $permissions != "$owner:$owner" ]]; then - echo "*** wrong permissions: $permissions" - [[ "$IS_USERNS_SUPPORTED" == "yes" ]] && return 1 - fi -} - -testcase_check_notification_socket() { - # https://github.com/systemd/systemd/issues/4944 - local cmd='echo a | $(busybox which nc) -U -u -w 1 /run/host/notify' - - # /testsuite-13.nc-container is prepared by test.sh - systemd-nspawn --register=no --directory=/testsuite-13.nc-container /bin/sh -x -c "$cmd" - systemd-nspawn --register=no --directory=/testsuite-13.nc-container -U /bin/sh -x -c "$cmd" -} - -testcase_check_os_release() { - local root entrypoint os_release_source - - root="$(mktemp -d /var/lib/machines/testsuite-13.check-os-release.XXX)" - "$CREATE_BB_CONTAINER" "$root" - entrypoint="$root/entrypoint.sh" - cat >"$entrypoint" <<\EOF -#!/bin/sh -ex - -. /tmp/os-release -[[ -n "${ID:-}" && "$ID" != "$container_host_id" ]] && exit 1 -[[ -n "${VERSION_ID:-}" && "$VERSION_ID" != "$container_host_version_id" ]] && exit 1 -[[ -n "${BUILD_ID:-}" && "$BUILD_ID" != "$container_host_build_id" ]] && exit 1 -[[ -n "${VARIANT_ID:-}" && "$VARIANT_ID" != "$container_host_variant_id" ]] && exit 1 - -cd /tmp -(cd /run/host && md5sum os-release) | md5sum -c -EOF - chmod +x "$entrypoint" - - os_release_source="/etc/os-release" - if [[ ! -r "$os_release_source" ]]; then - os_release_source="/usr/lib/os-release" - elif [[ -L "$os_release_source" ]]; then - # Ensure that /etc always wins if available - cp --remove-destination -fv /usr/lib/os-release /etc/os-release - echo MARKER=1 >>/etc/os-release - fi - - systemd-nspawn --register=no \ - --directory="$root" \ - --bind="$os_release_source:/tmp/os-release" \ - "${entrypoint##"$root"}" - - if grep -q MARKER /etc/os-release; then - ln -svrf /usr/lib/os-release /etc/os-release - fi - - rm -fr "$root" -} - -testcase_check_machinectl_bind() { - local service_path service_name root container_name ec - local cmd='for i in $(seq 1 20); do if test -f /tmp/marker; then exit 0; fi; usleep 500000; done; exit 1;' - - root="$(mktemp -d /var/lib/machines/testsuite-13.check-machinectl-bind.XXX)" - "$CREATE_BB_CONTAINER" "$root" - container_name="${root##*/}" - - service_path="$(mktemp /run/systemd/system/nspawn-machinectl-bind-XXX.service)" - service_name="${service_path##*/}" - cat >"$service_path" </dev/null || ! selinuxenabled; then - echo >&2 "SELinux is not enabled, skipping SELinux-related tests" - return 0 - fi - - local root - - root="$(mktemp -d /var/lib/machines/testsuite-13.check-selinux.XXX)" - "$CREATE_BB_CONTAINER" "$root" - chcon -R -t container_t "$root" - - systemd-nspawn --register=no \ - --boot \ - --directory="$root" \ - --selinux-apifs-context=system_u:object_r:container_file_t:s0:c0,c1 \ - --selinux-context=system_u:system_r:container_t:s0:c0,c1 - - rm -fr "$root" -} - -testcase_check_ephemeral_config() { - # https://github.com/systemd/systemd/issues/13297 - local root container_name - - root="$(mktemp -d /var/lib/machines/testsuite-13.check-ephemeral-config.XXX)" - "$CREATE_BB_CONTAINER" "$root" - container_name="${root##*/}" - - mkdir -p /run/systemd/nspawn/ - cat >"/run/systemd/nspawn/$container_name.nspawn" <&2 "Unified cgroup hierarchy is not supported, skipping..." - return 0 - fi - - if [[ "$use_cgns" == "yes" && "$IS_CGNS_SUPPORTED" == "no" ]]; then - echo >&2 "CGroup namespaces are not supported, skipping..." - return 0 - fi - - root="$(mktemp -d "/var/lib/machines/testsuite-13.unified-$1-cgns-$2-api-vfs-writable-$3.XXX")" - "$CREATE_BB_CONTAINER" "$root" - - SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ - systemd-nspawn --register=no \ - --directory="$root" \ - --boot - - SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ - systemd-nspawn --register=no \ - --directory="$root" \ - --private-network \ - --boot - - if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ - systemd-nspawn --register=no \ - --directory="$root" \ - --private-users=pick \ - --boot; then - [[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "network" ]] && return 1 - else - [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "network" ]] && return 1 - fi - - if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ - systemd-nspawn --register=no \ - --directory="$root" \ - --private-network \ - --private-users=pick \ - --boot; then - [[ "$IS_USERNS_SUPPORTED" == "yes" && "$api_vfs_writable" == "yes" ]] && return 1 - else - [[ "$IS_USERNS_SUPPORTED" == "no" && "$api_vfs_writable" = "yes" ]] && return 1 - fi - - local netns_opt="--network-namespace-path=/proc/self/ns/net" - local net_opt - local net_opts=( - "--network-bridge=lo" - "--network-interface=lo" - "--network-ipvlan=lo" - "--network-macvlan=lo" - "--network-veth" - "--network-veth-extra=lo" - "--network-zone=zone" - ) - - # --network-namespace-path and network-related options cannot be used together - for net_opt in "${net_opts[@]}"; do - echo "$netns_opt in combination with $net_opt should fail" - if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ - systemd-nspawn --register=no \ - --directory="$root" \ - --boot \ - "$netns_opt" \ - "$net_opt"; then - echo >&2 "unexpected pass" - return 1 - fi - done - - # allow combination of --network-namespace-path and --private-network - SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ - systemd-nspawn --register=no \ - --directory="$root" \ - --boot \ - --private-network \ - "$netns_opt" - - # test --network-namespace-path works with a network namespace created by "ip netns" - ip netns add nspawn_test - netns_opt="--network-namespace-path=/run/netns/nspawn_test" - SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$cgroupsv2" SYSTEMD_NSPAWN_USE_CGNS="$use_cgns" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$api_vfs_writable" \ - systemd-nspawn --register=no \ - --directory="$root" \ - --network-namespace-path=/run/netns/nspawn_test \ - /bin/ip a | grep -v -E '^1: lo.*UP' - ip netns del nspawn_test - - rm -fr "$root" - - return 0 -} - -# Create a list of all functions prefixed with testcase_ -mapfile -t TESTCASES < <(declare -F | awk '$3 ~ /^testcase_/ {print $3;}') - -if [[ "${#TESTCASES[@]}" -eq 0 ]]; then - echo >&2 "No test cases found, this is most likely an error" - exit 1 -fi - -for testcase in "${TESTCASES[@]}"; do - "$testcase" -done - -for api_vfs_writable in yes no network; do - matrix_run_one no no $api_vfs_writable - matrix_run_one yes no $api_vfs_writable - matrix_run_one no yes $api_vfs_writable - matrix_run_one yes yes $api_vfs_writable -done +run_subtests touch /testok +rm /failed From 990b629e1253ffdd306aa9e3ae6f48235ca9512d Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 12 May 2023 17:56:22 +0200 Subject: [PATCH 5/7] test: always install the script utility --- test/TEST-26-SYSTEMCTL/test.sh | 4 ---- test/TEST-74-AUX-UTILS/test.sh | 4 ---- test/test-functions | 1 + 3 files changed, 1 insertion(+), 8 deletions(-) diff --git a/test/TEST-26-SYSTEMCTL/test.sh b/test/TEST-26-SYSTEMCTL/test.sh index 659311be4d..64accf850f 100755 --- a/test/TEST-26-SYSTEMCTL/test.sh +++ b/test/TEST-26-SYSTEMCTL/test.sh @@ -7,8 +7,4 @@ TEST_DESCRIPTION="systemctl-related tests" # shellcheck source=test/test-functions . "${TEST_BASE_DIR:?}/test-functions" -test_append_files() ( - image_install script -) - do_test "$@" diff --git a/test/TEST-74-AUX-UTILS/test.sh b/test/TEST-74-AUX-UTILS/test.sh index 94bb159464..f422c89141 100755 --- a/test/TEST-74-AUX-UTILS/test.sh +++ b/test/TEST-74-AUX-UTILS/test.sh @@ -7,8 +7,4 @@ TEST_DESCRIPTION="Tests for auxiliary utilities" # shellcheck source=test/test-functions . "${TEST_BASE_DIR:?}/test-functions" -test_append_files() ( - image_install script -) - do_test "$@" diff --git a/test/test-functions b/test/test-functions index 6063c5d5e2..1f9fa6bb57 100644 --- a/test/test-functions +++ b/test/test-functions @@ -211,6 +211,7 @@ BASICTOOLS=( rm rmdir rmmod + script sed seq setfattr From a1ff1ac273d765d70aa2ba5dc996536aaa02de0a Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 12 May 2023 17:59:54 +0200 Subject: [PATCH 6/7] test: merge machinectl edit/cat tests into TEST-13 --- test/units/testsuite-13.machinectl.sh | 19 ++++++++++++++ test/units/testsuite-74.machinectl.sh | 36 --------------------------- 2 files changed, 19 insertions(+), 36 deletions(-) delete mode 100755 test/units/testsuite-74.machinectl.sh diff --git a/test/units/testsuite-13.machinectl.sh b/test/units/testsuite-13.machinectl.sh index 9ca6f5f02b..50dc716230 100755 --- a/test/units/testsuite-13.machinectl.sh +++ b/test/units/testsuite-13.machinectl.sh @@ -13,6 +13,7 @@ at_exit() { machinectl status long-running >/dev/null && machinectl kill --signal=KILL long-running mountpoint -q /var/lib/machines && timeout 10 sh -c "while ! umount /var/lib/machines; do sleep .5; done" + [[ -n "${NSPAWN_FRAGMENT:-}" ]] && rm -f "/etc/systemd/nspawn/$NSPAWN_FRAGMENT" "/var/lib/machines/$NSPAWN_FRAGMENT" } trap at_exit EXIT @@ -182,6 +183,24 @@ rm -fr /tmp/container.dir timeout 10 sh -c "while ! machinectl clean --all; do sleep .5; done" +NSPAWN_FRAGMENT="machinectl-test-$RANDOM.nspawn" +cat >"/var/lib/machines/$NSPAWN_FRAGMENT" </tmp/fragment.nspawn <"/var/lib/machines/$NSPAWN_NAME" <<\EOF -[Exec] -Boot=true -EOF - -EDITOR='true' script -ec 'machinectl edit "$NSPAWN_NAME"' /dev/null -[ -f "/etc/systemd/nspawn/$NSPAWN_NAME" ] -cmp "/var/lib/machines/$NSPAWN_NAME" "/etc/systemd/nspawn/$NSPAWN_NAME" - -cat >new <<\EOF -[Exec] -Boot=false -EOF - -script -ec 'machinectl cat "$PWD/new"' /dev/null - -EDITOR='mv new' script -ec 'machinectl edit "$NSPAWN_NAME"' /dev/null -printf '%s\n' '[Exec]' 'Boot=false' | cmp - "/etc/systemd/nspawn/$NSPAWN_NAME" From 7362947c3f3992cf3660b170f46bd80bb5fe1021 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 12 May 2023 21:36:50 +0200 Subject: [PATCH 7/7] machine,portable: fix a typo in an info message --- src/machine/operation.c | 2 +- src/portable/portabled-operation.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/machine/operation.c b/src/machine/operation.c index 49b6d31bdc..87c62a977b 100644 --- a/src/machine/operation.c +++ b/src/machine/operation.c @@ -15,7 +15,7 @@ static int operation_done(sd_event_source *s, const siginfo_t *si, void *userdat assert(si); - log_debug("Operating " PID_FMT " is now complete with code=%s status=%i", + log_debug("Operation " PID_FMT " is now complete with code=%s status=%i", o->pid, sigchld_code_to_string(si->si_code), si->si_status); diff --git a/src/portable/portabled-operation.c b/src/portable/portabled-operation.c index 6897ed0b28..53f33e52aa 100644 --- a/src/portable/portabled-operation.c +++ b/src/portable/portabled-operation.c @@ -14,7 +14,7 @@ static int operation_done(sd_event_source *s, const siginfo_t *si, void *userdat assert(si); - log_debug("Operating " PID_FMT " is now complete with code=%s status=%i", + log_debug("Operation " PID_FMT " is now complete with code=%s status=%i", o->pid, sigchld_code_to_string(si->si_code), si->si_status);