mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Kir Kolyshkin
41670e21f0
1. Get rid of fixed ROOT, *_BUNDLE, and CONSOLE_SOCKET dirs. Now they are temporary directories created in setup_bundle. 2. Automate containers cleanup: instead of having to specify all containers to be removed, list and destroy everything (which is now possible since every test case has its own unique root). 3. Randomize cgroup paths so two tests running in parallel won't use the same cgroup. Now it's theoretically possible to execute tests in parallel. Practically it's not possible yet because bats uses GNU parallel, which do not provide a terminal for whatever it executes, and many runc tests (all those that run containers with terminal: true) needs a tty. This may possibly be addressed later. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
105 lines
3.2 KiB
Bash
105 lines
3.2 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
function setup() {
|
|
setup_busybox
|
|
}
|
|
|
|
function teardown() {
|
|
teardown_bundle
|
|
}
|
|
|
|
@test "runc run [redundant default /dev/tty]" {
|
|
update_config ' .linux.devices += [{"path": "/dev/tty", "type": "c", "major": 5, "minor": 0}]
|
|
| .process.args |= ["ls", "-lLn", "/dev/tty"]'
|
|
|
|
runc run test_dev
|
|
[ "$status" -eq 0 ]
|
|
|
|
if [[ "$ROOTLESS" -ne 0 ]]; then
|
|
[[ "${lines[0]}" =~ "crw-rw-rw".+"1".+"65534".+"65534".+"5,".+"0".+"/dev/tty" ]]
|
|
else
|
|
[[ "${lines[0]}" =~ "crw-rw-rw".+"1".+"0".+"0".+"5,".+"0".+"/dev/tty" ]]
|
|
fi
|
|
}
|
|
|
|
@test "runc run [redundant default /dev/ptmx]" {
|
|
update_config ' .linux.devices += [{"path": "/dev/ptmx", "type": "c", "major": 5, "minor": 2}]
|
|
| .process.args |= ["ls", "-lLn", "/dev/ptmx"]'
|
|
|
|
runc run test_dev
|
|
[ "$status" -eq 0 ]
|
|
[[ "${lines[0]}" =~ "crw-rw-rw".+"1".+"0".+"0".+"5,".+"2".+"/dev/ptmx" ]]
|
|
}
|
|
|
|
@test "runc run [device cgroup deny]" {
|
|
requires root
|
|
|
|
update_config ' .linux.resources.devices = [{"allow": false, "access": "rwm"}]
|
|
| .linux.devices = [{"path": "/dev/kmsg", "type": "c", "major": 1, "minor": 11}]
|
|
| .process.args |= ["sh"]'
|
|
|
|
runc run -d --console-socket "$CONSOLE_SOCKET" test_deny
|
|
[ "$status" -eq 0 ]
|
|
|
|
# test write
|
|
runc exec test_deny sh -c 'hostname | tee /dev/kmsg'
|
|
[ "$status" -eq 1 ]
|
|
[[ "${output}" == *'Operation not permitted'* ]]
|
|
|
|
# test read
|
|
runc exec test_deny sh -c 'head -n 1 /dev/kmsg'
|
|
[ "$status" -eq 1 ]
|
|
[[ "${output}" == *'Operation not permitted'* ]]
|
|
}
|
|
|
|
@test "runc run [device cgroup allow rw char device]" {
|
|
requires root
|
|
|
|
update_config ' .linux.resources.devices = [{"allow": false, "access": "rwm"},{"allow": true, "type": "c", "major": 1, "minor": 11, "access": "rwm"}]
|
|
| .linux.devices = [{"path": "/dev/kmsg", "type": "c", "major": 1, "minor": 11}]
|
|
| .process.args |= ["sh"]
|
|
| .hostname = "myhostname"'
|
|
|
|
runc run -d --console-socket "$CONSOLE_SOCKET" test_allow_char
|
|
[ "$status" -eq 0 ]
|
|
|
|
# test write
|
|
runc exec test_allow_char sh -c 'hostname | tee /dev/kmsg'
|
|
[ "$status" -eq 0 ]
|
|
[[ "${lines[0]}" == *'myhostname'* ]]
|
|
|
|
# test read
|
|
runc exec test_allow_char sh -c 'head -n 1 /dev/kmsg'
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "runc run [device cgroup allow rm block device]" {
|
|
requires root
|
|
|
|
# get first block device
|
|
device="/dev/$(lsblk -nd -o NAME | head -n 1)"
|
|
major="$(lsblk -nd -o MAJ:MIN | head -n 1 | awk -F":" '{print $1}' | sed "s/\s*//g")"
|
|
minor="$(lsblk -nd -o MAJ:MIN | head -n 1 | awk -F":" '{print $2}')"
|
|
|
|
update_config ' .linux.resources.devices = [{"allow": false, "access": "rwm"},{"allow": true, "type": "b", "major": '"$major"', "minor": '"$minor"', "access": "rwm"}]
|
|
| .linux.devices = [{"path": "'"$device"'", "type": "b", "major": '"$major"', "minor": '"$minor"'}]
|
|
| .process.args |= ["sh"]
|
|
| .process.capabilities.bounding += ["CAP_MKNOD"]
|
|
| .process.capabilities.effective += ["CAP_MKNOD"]
|
|
| .process.capabilities.inheritable += ["CAP_MKNOD"]
|
|
| .process.capabilities.permitted += ["CAP_MKNOD"]'
|
|
|
|
runc run -d --console-socket "$CONSOLE_SOCKET" test_allow_block
|
|
[ "$status" -eq 0 ]
|
|
|
|
# test mknod
|
|
runc exec test_allow_block sh -c 'mknod /dev/fooblock b '"$major"' '"$minor"''
|
|
[ "$status" -eq 0 ]
|
|
|
|
# test read
|
|
runc exec test_allow_block sh -c 'fdisk -l '"$device"''
|
|
[ "$status" -eq 0 ]
|
|
}
|