239 lines
6.1 KiB
Go
239 lines
6.1 KiB
Go
// Copyright 2018 Google Inc.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package boot
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
specs "github.com/opencontainers/runtime-spec/specs-go"
|
|
"gvisor.googlesource.com/gvisor/pkg/control/server"
|
|
"gvisor.googlesource.com/gvisor/pkg/log"
|
|
"gvisor.googlesource.com/gvisor/pkg/sentry/context/contexttest"
|
|
)
|
|
|
|
func init() {
|
|
log.SetLevel(log.Debug)
|
|
}
|
|
|
|
// testSpec returns a simple spec that can be used in tests.
|
|
func testSpec() *specs.Spec {
|
|
return &specs.Spec{
|
|
// The host filesystem root is the sandbox root.
|
|
Root: &specs.Root{
|
|
Path: "/",
|
|
Readonly: true,
|
|
},
|
|
Process: &specs.Process{
|
|
Args: []string{"/bin/true"},
|
|
},
|
|
}
|
|
}
|
|
|
|
func createLoader() (*Loader, error) {
|
|
fd, err := server.CreateSocket(ControlSocketAddr("123"))
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
conf := &Config{
|
|
RootDir: "unused_root_dir",
|
|
Network: NetworkNone,
|
|
FileAccess: FileAccessDirect,
|
|
DisableSeccomp: true,
|
|
}
|
|
return New(testSpec(), conf, fd, nil, false)
|
|
}
|
|
|
|
// TestRun runs a simple application in a sandbox and checks that it succeeds.
|
|
func TestRun(t *testing.T) {
|
|
s, err := createLoader()
|
|
if err != nil {
|
|
t.Fatalf("error creating loader: %v", err)
|
|
}
|
|
defer s.Destroy()
|
|
|
|
// Run the application.
|
|
if err := s.Run(); err != nil {
|
|
t.Errorf("error running application: %v", err)
|
|
}
|
|
|
|
// Wait for the application to exit. It should succeed.
|
|
if status := s.WaitExit(); status.Code != 0 || status.Signo != 0 {
|
|
t.Errorf("application exited with status %+v, want 0", status)
|
|
}
|
|
}
|
|
|
|
// TestStartSignal tests that the controller Start message will cause
|
|
// WaitForStartSignal to return.
|
|
func TestStartSignal(t *testing.T) {
|
|
s, err := createLoader()
|
|
if err != nil {
|
|
t.Fatalf("error creating loader: %v", err)
|
|
}
|
|
defer s.Destroy()
|
|
|
|
// We aren't going to wait on this application, so the control server
|
|
// needs to be shut down manually.
|
|
defer s.ctrl.srv.Stop()
|
|
|
|
// Start a goroutine that calls WaitForStartSignal and writes to a
|
|
// channel when it returns.
|
|
waitFinished := make(chan struct{})
|
|
go func() {
|
|
s.WaitForStartSignal()
|
|
// Pretent that Run() executed and returned no error.
|
|
s.ctrl.app.startResultChan <- nil
|
|
waitFinished <- struct{}{}
|
|
}()
|
|
|
|
// Nothing has been written to the channel, so waitFinished should not
|
|
// return. Give it a little bit of time to make sure the goroutine has
|
|
// started.
|
|
select {
|
|
case <-waitFinished:
|
|
t.Errorf("WaitForStartSignal completed but it should not have")
|
|
case <-time.After(50 * time.Millisecond):
|
|
// OK.
|
|
}
|
|
|
|
// Trigger the control server Start method.
|
|
if err := s.ctrl.app.Start(nil, nil); err != nil {
|
|
t.Errorf("error calling Start: %v", err)
|
|
}
|
|
|
|
// Now WaitForStartSignal should return (within a short amount of
|
|
// time).
|
|
select {
|
|
case <-waitFinished:
|
|
// OK.
|
|
case <-time.After(50 * time.Millisecond):
|
|
t.Errorf("WaitForStartSignal did not complete but it should have")
|
|
}
|
|
|
|
}
|
|
|
|
// Test that MountNamespace can be created with various specs.
|
|
func TestCreateMountNamespace(t *testing.T) {
|
|
conf := &Config{
|
|
RootDir: "unused_root_dir",
|
|
FileAccess: FileAccessDirect,
|
|
DisableSeccomp: true,
|
|
}
|
|
|
|
testCases := []struct {
|
|
name string
|
|
// Spec that will be used to create the mount manager. Note
|
|
// that we can't mount procfs without a kernel, so each spec
|
|
// MUST contain something other than procfs mounted at /proc.
|
|
spec specs.Spec
|
|
// Paths that are expected to exist in the resulting fs.
|
|
expectedPaths []string
|
|
}{
|
|
{
|
|
// Only proc.
|
|
name: "only proc mount",
|
|
spec: specs.Spec{
|
|
Root: &specs.Root{
|
|
Path: os.TempDir(),
|
|
Readonly: true,
|
|
},
|
|
Mounts: []specs.Mount{
|
|
{
|
|
Destination: "/proc",
|
|
Type: "tmpfs",
|
|
},
|
|
},
|
|
},
|
|
// /proc, /dev, and /sys should always be mounted.
|
|
expectedPaths: []string{"/proc", "/dev", "/sys"},
|
|
},
|
|
{
|
|
// Mount at a deep path, with many components that do
|
|
// not exist in the root.
|
|
name: "deep mount path",
|
|
spec: specs.Spec{
|
|
Root: &specs.Root{
|
|
Path: os.TempDir(),
|
|
Readonly: true,
|
|
},
|
|
Mounts: []specs.Mount{
|
|
{
|
|
Destination: "/some/very/very/deep/path",
|
|
Type: "tmpfs",
|
|
},
|
|
{
|
|
Destination: "/proc",
|
|
Type: "tmpfs",
|
|
},
|
|
},
|
|
},
|
|
// /some/deep/path should be mounted, along with /proc,
|
|
// /dev, and /sys.
|
|
expectedPaths: []string{"/some/very/very/deep/path", "/proc", "/dev", "/sys"},
|
|
},
|
|
{
|
|
// Mounts are nested inside eachother.
|
|
name: "nested mounts",
|
|
spec: specs.Spec{
|
|
Root: &specs.Root{
|
|
Path: os.TempDir(),
|
|
Readonly: true,
|
|
},
|
|
Mounts: []specs.Mount{
|
|
{
|
|
Destination: "/proc",
|
|
Type: "tmpfs",
|
|
},
|
|
{
|
|
Destination: "/foo",
|
|
Type: "tmpfs",
|
|
},
|
|
{
|
|
Destination: "/foo/bar",
|
|
Type: "tmpfs",
|
|
},
|
|
{
|
|
Destination: "/foo/bar/baz",
|
|
Type: "tmpfs",
|
|
},
|
|
{
|
|
// A deep path that is in foo but not the other mounts.
|
|
Destination: "/foo/some/very/very/deep/path",
|
|
Type: "tmpfs",
|
|
},
|
|
},
|
|
},
|
|
expectedPaths: []string{"/foo", "/foo/bar", "/foo/bar/baz", "/foo/some/very/very/deep/path", "/proc", "/dev", "/sys"},
|
|
},
|
|
}
|
|
|
|
for _, tc := range testCases {
|
|
ctx := contexttest.Context(t)
|
|
mm, err := createMountNamespace(ctx, &tc.spec, conf, nil)
|
|
if err != nil {
|
|
t.Fatalf("createMountNamespace test case %q failed: %v", tc.name, err)
|
|
}
|
|
defer mm.DecRef()
|
|
root := mm.Root()
|
|
defer root.DecRef()
|
|
for _, p := range tc.expectedPaths {
|
|
if _, err := mm.FindInode(ctx, root, root, p, 0); err != nil {
|
|
t.Errorf("expected path %v to exist with spec %v, but got error %v", p, tc.spec, err)
|
|
}
|
|
}
|
|
}
|
|
}
|