1 ;;; GNU Guix --- Functional package management for GNU
2 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
4 ;;; This file is part of GNU Guix.
6 ;;; GNU Guix is free software; you can redistribute it and/or modify it
7 ;;; under the terms of the GNU General Public License as published by
8 ;;; the Free Software Foundation; either version 3 of the License, or (at
9 ;;; your option) any later version.
11 ;;; GNU Guix is distributed in the hope that it will be useful, but
12 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
13 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 ;;; GNU General Public License for more details.
16 ;;; You should have received a copy of the GNU General Public License
17 ;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
19 (define-module (test-containers)
20 #:use-module (guix utils)
21 #:use-module (guix build syscalls)
22 #:use-module (gnu build linux-container)
23 #:use-module (srfi srfi-64)
24 #:use-module (ice-9 match))
26 (define (assert-exit x)
27 (primitive-exit (if x 0 1)))
29 (test-begin "containers")
31 ;; Skip these tests unless user namespaces are available and the setgroups
32 ;; file (introduced in Linux 3.19 to address a security issue) exists.
33 (define (skip-if-unsupported)
34 (unless (and (user-namespace-supported?)
35 (unprivileged-user-namespace-supported?)
36 (setgroups-supported?))
40 (test-assert "call-with-container, exit with 0 when there is no error"
42 (call-with-container '() (const #t) #:namespaces '(user))))
45 (test-assert "call-with-container, user namespace"
47 (call-with-container '()
49 ;; The user is root within the new user namespace.
50 (assert-exit (and (zero? (getuid)) (zero? (getgid)))))
51 #:namespaces '(user))))
54 (test-assert "call-with-container, uts namespace"
56 (call-with-container '()
58 ;; The user is root within the container and should be able to change
59 ;; the hostname of that container.
60 (sethostname "test-container")
62 #:namespaces '(user uts))))
65 (test-assert "call-with-container, pid namespace"
67 (call-with-container '()
69 (match (primitive-fork)
71 ;; The first forked process in the new pid namespace is pid 2.
72 (assert-exit (= 2 (getpid))))
77 (status:exit-val status)))))))
78 #:namespaces '(user pid))))
81 (test-assert "call-with-container, mnt namespace"
83 (call-with-container '(("none" device "/testing" "tmpfs" () #f #f))
85 (assert-exit (file-exists? "/testing")))
86 #:namespaces '(user mnt))))
89 (test-equal "call-with-container, mnt namespace, wrong bind mount"
90 `(system-error ,ENOENT)
91 ;; An exception should be raised; see <http://bugs.gnu.org/23306>.
94 (call-with-container '(("/does-not-exist" device "/foo"
95 "none" (bind-mount) #f #f))
97 #:namespaces '(user mnt)))
99 (list 'system-error (system-error-errno args)))))
101 (skip-if-unsupported)
102 (test-assert "call-with-container, all namespaces"
104 (call-with-container '()
106 (primitive-exit 0)))))
108 (skip-if-unsupported)
109 (test-assert "container-excursion"
110 (call-with-temporary-directory
112 ;; Two pipes: One for the container to signal that the test can begin,
113 ;; and one for the parent to signal to the container that the test is
115 (match (list (pipe) (pipe))
116 (((start-in . start-out) (end-in . end-out))
120 ;; Signal for the test to start.
121 (write 'ready start-out)
123 ;; Wait for test completion.
127 (define (namespaces pid)
128 (let ((pid (number->string pid)))
130 (readlink (string-append "/proc/" pid "/ns/" ns)))
131 '("user" "ipc" "uts" "net" "pid" "mnt"))))
133 (let* ((pid (run-container root '() %namespaces 1 container))
134 (container-namespaces (namespaces pid))
138 ;; Wait for container to be ready.
141 (container-excursion pid
143 ;; Fork again so that the pid is within the context of
144 ;; the joined pid namespace instead of the original pid
146 (match (primitive-fork)
148 ;; Check that all of the namespace identifiers are
149 ;; the same as the container process.
151 (equal? container-namespaces
152 (namespaces (getpid)))))
154 (match (waitpid fork-pid)
157 (status:exit-val status)))))))))))
159 ;; Stop the container.
160 (write 'done end-out)