test/TEST-13-NSPAWN-SMOKE/test.sh

   1 #!/bin/bash
   2 set -e
   3 TEST_DESCRIPTION="systemd-nspawn smoke test"
   4 TEST_NO_NSPAWN=1
   5
   6 . $TEST_BASE_DIR/test-functions
   7
   8 test_setup() {
   9     create_empty_image_rootdir
  10
  11     # Create what will eventually be our root filesystem onto an overlay
  12     (
  13         LOG_LEVEL=5
  14         eval $(udevadm info --export --query=env --name=${LOOPDEV}p2)
  15
  16         setup_basic_environment
  17         dracut_install busybox chmod rmdir unshare ip sysctl
  18
  19         # mask some services that we do not want to run in these tests
  20         ln -fs /dev/null $initdir/etc/systemd/system/systemd-hwdb-update.service
  21         ln -fs /dev/null $initdir/etc/systemd/system/systemd-journal-catalog-update.service
  22         ln -fs /dev/null $initdir/etc/systemd/system/systemd-networkd.service
  23         ln -fs /dev/null $initdir/etc/systemd/system/systemd-networkd.socket
  24         ln -fs /dev/null $initdir/etc/systemd/system/systemd-resolved.service
  25         ln -fs /dev/null $initdir/etc/systemd/system/systemd-machined.service
  26
  27         cp create-busybox-container $initdir/
  28
  29         ./create-busybox-container $initdir/nc-container
  30         initdir="$initdir/nc-container" dracut_install nc ip
  31
  32         # setup the testsuite service
  33         cat >$initdir/etc/systemd/system/testsuite.service <<EOF
  34 [Unit]
  35 Description=Testsuite service
  36
  37 [Service]
  38 ExecStart=/test-nspawn.sh
  39 Type=oneshot
  40 StandardOutput=tty
  41 StandardError=tty
  42 EOF
  43
  44         cat >$initdir/test-nspawn.sh <<'EOF'
  45 #!/bin/bash
  46 set -x
  47 set -e
  48 set -u
  49 set -o pipefail
  50
  51 export SYSTEMD_LOG_LEVEL=debug
  52
  53 # check cgroup-v2
  54 is_v2_supported=no
  55 mkdir -p /tmp/cgroup2
  56 if mount -t cgroup2 cgroup2 /tmp/cgroup2; then
  57     is_v2_supported=yes
  58     umount /tmp/cgroup2
  59 fi
  60 rmdir /tmp/cgroup2
  61
  62 # check cgroup namespaces
  63 is_cgns_supported=no
  64 if [[ -f /proc/1/ns/cgroup ]]; then
  65     is_cgns_supported=yes
  66 fi
  67
  68 is_user_ns_supported=no
  69 # On some systems (e.g. CentOS 7) the default limit for user namespaces
  70 # is set to 0, which causes the following unshare syscall to fail, even
  71 # with enabled user namespaces support. By setting this value explicitly
  72 # we can ensure the user namespaces support to be detected correctly.
  73 sysctl -w user.max_user_namespaces=10000
  74 if unshare -U sh -c :; then
  75     is_user_ns_supported=yes
  76 fi
  77
  78 function check_bind_tmp_path {
  79     # https://github.com/systemd/systemd/issues/4789
  80     local _root="/var/lib/machines/bind-tmp-path"
  81     /create-busybox-container "$_root"
  82     >/tmp/bind
  83     systemd-nspawn --register=no -D "$_root" --bind=/tmp/bind /bin/sh -c 'test -e /tmp/bind'
  84 }
  85
  86 function check_norbind {
  87     # https://github.com/systemd/systemd/issues/13170
  88     local _root="/var/lib/machines/norbind-path"
  89     mkdir -p /tmp/binddir/subdir
  90     echo -n "outer" > /tmp/binddir/subdir/file
  91     mount -t tmpfs tmpfs /tmp/binddir/subdir
  92     echo -n "inner" > /tmp/binddir/subdir/file
  93     /create-busybox-container "$_root"
  94     systemd-nspawn --register=no -D "$_root" --bind=/tmp/binddir:/mnt:norbind /bin/sh -c 'CONTENT=$(cat /mnt/subdir/file); if [[ $CONTENT != "outer" ]]; then echo "*** unexpected content: $CONTENT"; return 1; fi'
  95 }
  96
  97 function check_notification_socket {
  98     # https://github.com/systemd/systemd/issues/4944
  99     local _cmd='echo a | $(busybox which nc) -U -u -w 1 /run/systemd/nspawn/notify'
 100     systemd-nspawn --register=no -D /nc-container /bin/sh -x -c "$_cmd"
 101     systemd-nspawn --register=no -D /nc-container -U /bin/sh -x -c "$_cmd"
 102 }
 103
 104 function run {
 105     if [[ "$1" = "yes" && "$is_v2_supported" = "no" ]]; then
 106         printf "Unified cgroup hierarchy is not supported. Skipping.\n" >&2
 107         return 0
 108     fi
 109     if [[ "$2" = "yes" && "$is_cgns_supported" = "no" ]];  then
 110         printf "CGroup namespaces are not supported. Skipping.\n" >&2
 111         return 0
 112     fi
 113
 114     local _root="/var/lib/machines/unified-$1-cgns-$2-api-vfs-writable-$3"
 115     /create-busybox-container "$_root"
 116     SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" -b
 117     SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" --private-network -b
 118
 119     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" -U -b; then
 120        [[ "$is_user_ns_supported" = "yes" && "$3" = "network" ]] && return 1
 121     else
 122        [[ "$is_user_ns_supported" = "no" && "$3" = "network" ]] && return 1
 123     fi
 124
 125     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" --private-network -U -b; then
 126        [[ "$is_user_ns_supported" = "yes" && "$3" = "yes" ]] && return 1
 127     else
 128        [[ "$is_user_ns_supported" = "no" && "$3" = "yes" ]] && return 1
 129     fi
 130
 131     local _netns_opt="--network-namespace-path=/proc/self/ns/net"
 132
 133     # --network-namespace-path and network-related options cannot be used together
 134     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-interface=lo -b; then
 135        return 1
 136     fi
 137
 138     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-macvlan=lo -b; then
 139        return 1
 140     fi
 141
 142     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-ipvlan=lo -b; then
 143        return 1
 144     fi
 145
 146     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-veth -b; then
 147        return 1
 148     fi
 149
 150     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-veth-extra=lo -b; then
 151        return 1
 152     fi
 153
 154     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-bridge=lo -b; then
 155        return 1
 156     fi
 157
 158     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --network-zone=zone -b; then
 159        return 1
 160     fi
 161
 162     if SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" --private-network -b; then
 163        return 1
 164     fi
 165
 166     # test --network-namespace-path works with a network namespace created by "ip netns"
 167     ip netns add nspawn_test
 168     _netns_opt="--network-namespace-path=/run/netns/nspawn_test"
 169     SYSTEMD_NSPAWN_UNIFIED_HIERARCHY="$1" SYSTEMD_NSPAWN_USE_CGNS="$2" SYSTEMD_NSPAWN_API_VFS_WRITABLE="$3" systemd-nspawn --register=no -D "$_root" "$_netns_opt" /bin/ip a | grep -v -E '^1: lo.*UP'
 170     local r=$?
 171     ip netns del nspawn_test
 172
 173     if [ $r -ne 0 ]; then
 174        return 1
 175     fi
 176
 177     return 0
 178 }
 179
 180 check_bind_tmp_path
 181
 182 check_norbind
 183
 184 check_notification_socket
 185
 186 for api_vfs_writable in yes no network; do
 187     run no no $api_vfs_writable
 188     run yes no $api_vfs_writable
 189     run no yes $api_vfs_writable
 190     run yes yes $api_vfs_writable
 191 done
 192
 193 touch /testok
 194 EOF
 195
 196         chmod 0755 $initdir/test-nspawn.sh
 197         setup_testsuite
 198     )
 199 }
 200
 201 do_test "$@"