mir/criu
2
0
Fork 0
mirror of https://github.com/checkpoint-restore/criu synced 2025-08-22 01:51:51 +00:00
Code Issues Releases Wiki Activity

ci: disable non-root in user namespace test in container

Browse Source 
Signed-off-by: Adrian Reber <areber@redhat.com>
This commit is contained in:
Adrian Reber 2023-11-30 15:10:23 +00:00 committed by Andrei Vagin
parent fe8f5130c2
commit 2d1f4ec719
3 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
scripts/ci/prepare-for-fedora-rawhide.sh
View File

@ -18,6 +18,7 @@ dnf install -y \
libnet-devel \
libnl3-devel \
libbsd-devel \
libselinux-utils \
make \
procps-ng \
protobuf-c-devel \

11
scripts/ci/run-ci-tests.sh
View File

@ -288,11 +288,16 @@ ip net add test
# Rootless tests
# Check if cap_checkpoint_restore is supported and also if unshare -c is supported.
if capsh --supports=cap_checkpoint_restore && unshare -c /bin/true; then
#
# Do not run this test in a container (see https://github.com/checkpoint-restore/criu/issues/2312).
# This is a temporary workaround until fixed in the kernel.
# The kernel currently does not show correct device and inode numbers in /proc/pid/maps
# for stackable file systems.
if capsh --supports=cap_checkpoint_restore && unshare -c /bin/true && [ ! -e /run/.containerenv ]; then
make -C test/zdtm/ cleanout
rm -rf test/dump
setcap cap_checkpoint_restore,cap_sys_ptrace+eip criu/criu
if [ -d /sys/fs/selinux ]; then
if [ -d /sys/fs/selinux ] && command -v getenforce &>/dev/null; then
# Note: selinux in Enforcing mode prevents us from calling clone3() or writing to ns_last_pid on restore; hence set to Permissive for the test and then set back.
selinuxmode=$(getenforce)
setenforce Permissive
@ -301,7 +306,7 @@ if capsh --supports=cap_checkpoint_restore && unshare -c /bin/true; then
# under those conditions. Note that the "... && true" part is necessary; we need at least one statement after the tests so that bash can reap zombies in the user namespace,
# otherwise it will exec the last statement and get replaced and nobody will be left to reap our zombies.
sudo --user=#65534 --group=#65534 unshare -Ucfpm --mount-proc -- bash -c "./test/zdtm.py run -t zdtm/static/maps00 -f h --rootless && true"
if [ -d /sys/fs/selinux ]; then
if [ -d /sys/fs/selinux ] && command -v getenforce &>/dev/null; then
setenforce "$selinuxmode"
fi
setcap -r criu/criu

4
scripts/ci/vagrant.sh
View File

@ -70,6 +70,10 @@ fedora-rawhide() {
#
ssh default 'sudo dnf remove -y crun || true'
ssh default sudo dnf install -y podman runc
# Some tests in the container need selinux to be disabled.
# In the container it is not possible to change the state of selinux.
# Let's just disable it for this test run completely.
ssh default 'sudo setenforce Permissive'
ssh default 'cd /vagrant; tar xf criu.tar; cd criu; sudo -E make -C scripts/ci fedora-rawhide CONTAINER_RUNTIME=podman BUILD_OPTIONS="--security-opt seccomp=unconfined"'
}