tests/containers.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   3 ;;;
   4 ;;; This file is part of GNU Guix.
   5 ;;;
   6 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   7 ;;; under the terms of the GNU General Public License as published by
   8 ;;; the Free Software Foundation; either version 3 of the License, or (at
   9 ;;; your option) any later version.
  10 ;;;
  11 ;;; GNU Guix is distributed in the hope that it will be useful, but
  12 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  13 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 ;;; GNU General Public License for more details.
  15 ;;;
  16 ;;; You should have received a copy of the GNU General Public License
  17 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  18
  19 (define-module (test-containers)
  20   #:use-module (guix utils)
  21   #:use-module (guix build syscalls)
  22   #:use-module (gnu build linux-container)
  23   #:use-module (srfi srfi-64)
  24   #:use-module (ice-9 match))
  25
  26 (define (assert-exit x)
  27   (primitive-exit (if x 0 1)))
  28
  29 (test-begin "containers")
  30
  31 ;; Skip these tests unless user namespaces are available and the setgroups
  32 ;; file (introduced in Linux 3.19 to address a security issue) exists.
  33 (unless (and (user-namespace-supported?)
  34              (unprivileged-user-namespace-supported?)
  35              (setgroups-supported?))
  36   (test-skip 7))
  37
  38 (test-assert "call-with-container, exit with 0 when there is no error"
  39   (zero?
  40    (call-with-container '() (const #t) #:namespaces '(user))))
  41
  42 (test-assert "call-with-container, user namespace"
  43   (zero?
  44    (call-with-container '()
  45      (lambda ()
  46        ;; The user is root within the new user namespace.
  47        (assert-exit (and (zero? (getuid)) (zero? (getgid)))))
  48      #:namespaces '(user))))
  49
  50 (test-assert "call-with-container, uts namespace"
  51   (zero?
  52    (call-with-container '()
  53      (lambda ()
  54        ;; The user is root within the container and should be able to change
  55        ;; the hostname of that container.
  56        (sethostname "test-container")
  57        (primitive-exit 0))
  58      #:namespaces '(user uts))))
  59
  60 (test-assert "call-with-container, pid namespace"
  61   (zero?
  62    (call-with-container '()
  63      (lambda ()
  64        (match (primitive-fork)
  65          (0
  66           ;; The first forked process in the new pid namespace is pid 2.
  67           (assert-exit (= 2 (getpid))))
  68          (pid
  69           (primitive-exit
  70            (match (waitpid pid)
  71              ((_ . status)
  72               (status:exit-val status)))))))
  73      #:namespaces '(user pid))))
  74
  75 (test-assert "call-with-container, mnt namespace"
  76   (zero?
  77    (call-with-container '(("none" device "/testing" "tmpfs" () #f #f))
  78      (lambda ()
  79        (assert-exit (file-exists? "/testing")))
  80      #:namespaces '(user mnt))))
  81
  82 (test-equal "call-with-container, mnt namespace, wrong bind mount"
  83   `(system-error ,ENOENT)
  84   ;; An exception should be raised; see <http://bugs.gnu.org/23306>.
  85   (catch 'system-error
  86     (lambda ()
  87       (call-with-container '(("/does-not-exist" device "/foo"
  88                               "none" (bind-mount) #f #f))
  89         (const #t)
  90         #:namespaces '(user mnt)))
  91     (lambda args
  92       (list 'system-error (system-error-errno args)))))
  93
  94 (test-assert "call-with-container, all namespaces"
  95   (zero?
  96    (call-with-container '()
  97      (lambda ()
  98        (primitive-exit 0)))))
  99
 100 (test-assert "container-excursion"
 101   (call-with-temporary-directory
 102    (lambda (root)
 103      ;; Two pipes: One for the container to signal that the test can begin,
 104      ;; and one for the parent to signal to the container that the test is
 105      ;; over.
 106      (match (list (pipe) (pipe))
 107        (((start-in . start-out) (end-in . end-out))
 108         (define (container)
 109           (close end-out)
 110           (close start-in)
 111           ;; Signal for the test to start.
 112           (write 'ready start-out)
 113           (close start-out)
 114           ;; Wait for test completion.
 115           (read end-in)
 116           (close end-in))
 117
 118         (define (namespaces pid)
 119           (let ((pid (number->string pid)))
 120             (map (lambda (ns)
 121                    (readlink (string-append "/proc/" pid "/ns/" ns)))
 122                  '("user" "ipc" "uts" "net" "pid" "mnt"))))
 123
 124         (let* ((pid (run-container root '() %namespaces 1 container))
 125                (container-namespaces (namespaces pid))
 126                (result
 127                 (begin
 128                   (close start-out)
 129                   ;; Wait for container to be ready.
 130                   (read start-in)
 131                   (close start-in)
 132                   (container-excursion pid
 133                     (lambda ()
 134                       ;; Fork again so that the pid is within the context of
 135                       ;; the joined pid namespace instead of the original pid
 136                       ;; namespace.
 137                       (match (primitive-fork)
 138                         (0
 139                          ;; Check that all of the namespace identifiers are
 140                          ;; the same as the container process.
 141                          (assert-exit
 142                           (equal? container-namespaces
 143                                   (namespaces (getpid)))))
 144                         (fork-pid
 145                          (match (waitpid fork-pid)
 146                            ((_ . status)
 147                             (primitive-exit
 148                              (status:exit-val status)))))))))))
 149           (close end-in)
 150           ;; Stop the container.
 151           (write 'done end-out)
 152           (close end-out)
 153           (waitpid pid)
 154           (zero? result)))))))
 155
 156 (test-end)