test/TEST-13-NSPAWN-SMOKE/test.sh

   1 #!/bin/bash
   2 set -e
   3 TEST_DESCRIPTION="systemd-nspawn smoke test"
   4 TEST_NO_NSPAWN=1
   5
   6 . $TEST_BASE_DIR/test-functions
   7
   8 test_setup() {
   9     create_empty_image_rootdir
  10
  11     # Create what will eventually be our root filesystem onto an overlay
  12     (
  13         LOG_LEVEL=5
  14         eval $(udevadm info --export --query=env --name=${LOOPDEV}p2)
  15
  16         setup_basic_environment
  17         mask_supporting_services
  18         dracut_install busybox chmod rmdir unshare ip sysctl
  19
  20         cp create-busybox-container $initdir/
  21
  22         ./create-busybox-container $initdir/nc-container
  23         initdir="$initdir/nc-container" dracut_install nc ip
  24
  25         # setup the testsuite service
  26         cat >$initdir/etc/systemd/system/testsuite.service <<EOF
  27 [Unit]
  28 Description=Testsuite service
  29
  30 [Service]
  31 ExecStart=/test-nspawn.sh
  32 Type=oneshot
  33 EOF
  34
  35         cat >$initdir/test-nspawn.sh <<'EOF'
  36 #!/bin/bash
  37 set -x
  38 set -e
  39 set -u
  40 set -o pipefail
  41
  42 export SYSTEMD_LOG_LEVEL=debug
  43
  44 # check cgroup-v2
  45 is_v2_supported=no
  46 mkdir -p /tmp/cgroup2
  47 if mount -t cgroup2 cgroup2 /tmp/cgroup2; then
  48     is_v2_supported=yes
  49     umount /tmp/cgroup2
  50 fi
  51 rmdir /tmp/cgroup2
  52
  53 # check cgroup namespaces
  54 is_cgns_supported=no
  55 if [[ -f /proc/1/ns/cgroup ]]; then
  56     is_cgns_supported=yes
  57 fi
  58
  59 is_user_ns_supported=no
  60 # On some systems (e.g. CentOS 7) the default limit for user namespaces
  61 # is set to 0, which causes the following unshare syscall to fail, even
  62 # with enabled user namespaces support. By setting this value explicitly
  63 # we can ensure the user namespaces support to be detected correctly.
  64 sysctl -w user.max_user_namespaces=10000
  65 if unshare -U sh -c :; then
  66     is_user_ns_supported=yes
  67 fi
  68
  69 function check_bind_tmp_path {
  70     # https://github.com/systemd/systemd/issues/4789
  71     local _root="/var/lib/machines/bind-tmp-path"
  72     /create-busybox-container "$_root"
  73     >/tmp/bind
  74     systemd-nspawn --register=no -D "$_root" --bind=/tmp/bind /bin/sh -c 'test -e /tmp/bind'
  75 }
  76
  77 function check_norbind {
  78     # https://github.com/systemd/systemd/issues/13170
  79     local _root="/var/lib/machines/norbind-path"
  80     mkdir -p /tmp/binddir/subdir
  81     echo -n "outer" > /tmp/binddir/subdir/file
  82     mount -t tmpfs tmpfs /tmp/binddir/subdir
  83     echo -n "inner" > /tmp/binddir/subdir/file
  84     /create-busybox-container "$_root"
  85     systemd-nspawn --register=no -D "$_root" --bind=/tmp/binddir:/mnt:norbind /bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi'
  86 }
  87
  88 function check_notification_socket {
  89     # https://github.com/systemd/systemd/issues/4944
  90     local _cmd='echo a | $(busybox which nc) -U -u -w 1 /run/systemd/nspawn/notify'
  91     systemd-nspawn --register=no -D /nc-container /bin/sh -x -c "$_cmd"
  92     systemd-nspawn --register=no -D /nc-container -U /bin/sh -x -c "$_cmd"
  93 }
  94
  95 function run {
  96     if [[ "$1" = "yes" && "$is_v2_supported" = "no" ]]; then
  97         printf "Unified cgroup hierarchy is not supported. Skipping.\n" >&2
  98         return 0
  99     fi
 100     if [[ "$2" = "yes" && "$is_cgns_supported" = "no" ]];  then
 101         printf "CGroup namespaces are not supported. Skipping.\n" >&2
 102         return 0
 103     fi
 104
 105     local _root="/var/lib/machines/unified-$1-cgns-$2-api-vfs-writable-$3"
 106     /create-busybox-container "$_root"
 107     SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" -b
 108     SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" --private-network -b
 109
 110     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" -U -b; then
 111        [[ "$is_user_ns_supported" = "yes" && "$3" = "network" ]] && return 1
 112     else
 113        [[ "$is_user_ns_supported" = "no" && "$3" = "network" ]] && return 1
 114     fi
 115
 116     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" --private-network -U -b; then
 117        [[ "$is_user_ns_supported" = "yes" && "$3" = "yes" ]] && return 1
 118     else
 119        [[ "$is_user_ns_supported" = "no" && "$3" = "yes" ]] && return 1
 120     fi
 121
 122     local _netns_opt="--network-namespace-path=/proc/self/ns/net"
 123
 124     # --network-namespace-path and network-related options cannot be used together
 125     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-interface=lo -b; then
 126        return 1
 127     fi
 128
 129     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-macvlan=lo -b; then
 130        return 1
 131     fi
 132
 133     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-ipvlan=lo -b; then
 134        return 1
 135     fi
 136
 137     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-veth -b; then
 138        return 1
 139     fi
 140
 141     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-veth-extra=lo -b; then
 142        return 1
 143     fi
 144
 145     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-bridge=lo -b; then
 146        return 1
 147     fi
 148
 149     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-zone=zone -b; then
 150        return 1
 151     fi
 152
 153     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --private-network -b; then
 154        return 1
 155     fi
 156
 157     # test --network-namespace-path works with a network namespace created by "ip netns"
 158     ip netns add nspawn_test
 159     _netns_opt="--network-namespace-path=/run/netns/nspawn_test"
 160     SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" /bin/ip a | grep -v -E '^1: lo.*UP'
 161     local r=$?
 162     ip netns del nspawn_test
 163
 164     if [ $r -ne 0 ]; then
 165        return 1
 166     fi
 167
 168     return 0
 169 }
 170
 171 check_bind_tmp_path
 172
 173 check_norbind
 174
 175 check_notification_socket
 176
 177 for api_vfs_writable in yes no network; do
 178     run no no $api_vfs_writable
 179     run yes no $api_vfs_writable
 180     run no yes $api_vfs_writable
 181     run yes yes $api_vfs_writable
 182 done
 183
 184 touch /testok
 185 EOF
 186
 187         chmod 0755 $initdir/test-nspawn.sh
 188         setup_testsuite
 189     )
 190 }
 191
 192 do_test "$@"