diff --git a/.cirrus.yml b/.cirrus.yml deleted file mode 100644 index 4967ec474..000000000 --- a/.cirrus.yml +++ /dev/null @@ -1,40 +0,0 @@ -task: - name: Vagrant Fedora based test (no VDSO) - environment: - HOME: "/root" - CIRRUS_WORKING_DIR: "/tmp/criu" - - compute_engine_instance: - image_project: cirrus-images - image: family/docker-kvm - platform: linux - cpu: 4 - memory: 16G - nested_virtualization: true - - setup_script: | - contrib/apt-install make gcc pkg-config git perl-modules iproute2 kmod wget cpu-checker - sudo kvm-ok - build_script: | - make -C scripts/ci vagrant-fedora-no-vdso - -task: - name: Vagrant Fedora based test (non-root) - environment: - HOME: "/root" - CIRRUS_WORKING_DIR: "/tmp/criu" - - compute_engine_instance: - image_project: cirrus-images - image: family/docker-kvm - platform: linux - cpu: 4 - memory: 16G - nested_virtualization: true - - setup_script: | - contrib/apt-install make gcc pkg-config git perl-modules iproute2 kmod wget cpu-checker - sudo kvm-ok - build_script: | - make -C scripts/ci vagrant-fedora-non-root - diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ebf0fb4ee..b09c8cab8 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -208,8 +208,16 @@ jobs: include: - variant: fedora-stable name: Stable + reboot: true - variant: fedora-next name: Next + reboot: true + - variant: fedora-no-vdso + name: No VDSO + reboot: true + - variant: fedora-non-root + name: Non-Root + reboot: false steps: - uses: actions/checkout@v4 - uses: ./.github/actions/lima-vm-setup @@ -219,6 +227,7 @@ jobs: - name: Setup VM run: lima sudo /home/criu/scripts/ci/lima.sh ${{ matrix.variant }}-setup - name: Reboot VM to activate new kernel + if: matrix.reboot run: | limactl stop default limactl start default diff --git a/scripts/ci/Makefile b/scripts/ci/Makefile index 80ace0762..78334db7f 100644 --- a/scripts/ci/Makefile +++ b/scripts/ci/Makefile @@ -74,20 +74,6 @@ podman-test: java-test: ./java-test.sh -setup-vagrant: - ./vagrant.sh setup - -vagrant-fedora-no-vdso: setup-vagrant - ./vagrant.sh fedora-no-vdso - -vagrant-fedora-rawhide: setup-vagrant - ./vagrant.sh fedora-rawhide - -vagrant-fedora-non-root: setup-vagrant - ./vagrant.sh fedora-non-root - -.PHONY: setup-vagrant vagrant-fedora-no-vdso vagrant-fedora-rawhide vagrant-fedora-non-root - check-commit: (cd ../.. && git clean -dfx) ($(MAKE) -j $$(nproc) -C ../.. && \ diff --git a/scripts/ci/lima.sh b/scripts/ci/lima.sh index 3e0cb254d..2bddcdd22 100755 --- a/scripts/ci/lima.sh +++ b/scripts/ci/lima.sh @@ -8,6 +8,10 @@ # lima.sh fedora-stable-test # lima.sh fedora-next-setup # lima.sh fedora-next-test +# lima.sh fedora-no-vdso-setup +# lima.sh fedora-no-vdso-test +# lima.sh fedora-non-root-setup +# lima.sh fedora-non-root-test set -e set -x @@ -109,4 +113,92 @@ fedora-next-test() { _common_test } +fedora-no-vdso-setup() { + "${CRIU_DIR}"/contrib/dependencies/dnf-packages.sh + # Disable sssd to avoid zdtm test failures in pty04 due to sssd socket + systemctl mask sssd + # Disable VDSO; the VM is rebooted between setup and test + grubby --update-kernel ALL --args="vdso=0" +} + +fedora-no-vdso-test() { + cd "${CRIU_DIR}" + make -j"$(nproc)" + ./test/zdtm.py run -a --keep-going + # This test requires pidfd_getfd which is guaranteed in Fedora 33. + # It is skipped from -a because it runs in RPC mode only. + ./test/zdtm.py run -t zdtm/transition/pidfd_store_sk --rpc --pre 2 +} + +fedora-non-root-setup() { + "${CRIU_DIR}"/contrib/dependencies/dnf-packages.sh + # Disable sssd to avoid zdtm test failures in pty04 due to sssd socket + systemctl mask sssd + # The rpc test cases are running as user #1000 + adduser -u 1000 test + # The user-namespace test (unshare --map-auto) needs subordinate + # UID/GID ranges so that GID 65534 (nobody) is mapped inside the + # namespace. Without this, zdtm.py --rootless fails with EINVAL + # on setgid(65534). + echo "root:100000:65536" >> /etc/subuid + echo "root:100000:65536" >> /etc/subgid +} + +fedora-non-root-test() { + cd "${CRIU_DIR}" + make -j"$(nproc)" + + # Make the source tree writable by non-root users. On GitHub + # Actions limactl copy preserves the runner's permissions (755 + # directories), so test binaries running as non-root cannot + # create output files without this. + chmod -R a+rwX . + + # Setting the capability should be the only line needed to run + # as non-root on Fedora. In other environments either set + # /proc/sys/kernel/yama/ptrace_scope to 0 or grant + # cap_sys_ptrace to criu. + setcap cap_checkpoint_restore+eip criu/criu + + # Run it once as non-root. + # Remove any root-owned dump directories from make so the + # non-root user can create its own. + criu/criu check --unprivileged + rm -rf test/dump + ./test/zdtm.py run \ + -t zdtm/static/env00 \ + -t zdtm/static/pthread00 \ + -f h --rootless + + # Run it as root with '--rootless' + sudo ./test/zdtm.py run \ + -t zdtm/static/env00 \ + -t zdtm/static/pthread00 \ + -f h + sudo chmod 777 test/dump/zdtm/static/{env00,pthread00} + sudo ./test/zdtm.py run \ + -t zdtm/static/env00 \ + -t zdtm/static/pthread00 \ + -f h --rootless + + # Run it as non-root in a user namespace. Since + # CAP_CHECKPOINT_RESTORE behaves differently in non-user + # namespaces (e.g. no access to map_files) this tests that we + # can dump and restore under those conditions. + # Note: the "... && true" part is necessary so that bash does + # not exec the last statement and still reaps zombies. + # Note: selinux in Enforcing mode prevents clone3() or + # writing to ns_last_pid on restore; set to Permissive for + # the test and then restore it. + # Remove dump directory left by previous test runs as root; + # the user namespace test runs as nobody (uid 65534) and + # cannot write into root-owned directories. + rm -rf test/dump + selinuxmode=$(getenforce) + sudo setenforce Permissive + unshare --map-auto -fpm --mount-proc bash -c \ + "./test/zdtm.py run -t zdtm/static/maps00 -f h --rootless && true" + sudo setenforce "$selinuxmode" +} + "$@" diff --git a/scripts/ci/vagrant.sh b/scripts/ci/vagrant.sh deleted file mode 100755 index 5f2de32b8..000000000 --- a/scripts/ci/vagrant.sh +++ /dev/null @@ -1,101 +0,0 @@ -#!/bin/bash - -# This script is used to run vagrant based tests on Cirrus CI. -# This script is started via .cirrus.yml - -set -e -set -x - -VAGRANT_VERSION=2.4.7 -FEDORA_VERSION=42 -FEDORA_BOX_VERSION=1.1.0 - -setup() { - # Tar up the git checkout to have vagrant rsync it to the VM - tar cf /tmp/criu.tar -C ../../../ criu - # Cirrus has problems with the following certificate. - wget --no-check-certificate https://releases.hashicorp.com/vagrant/${VAGRANT_VERSION}/vagrant_${VAGRANT_VERSION}-1_"$(dpkg --print-architecture)".deb -O /tmp/vagrant.deb && \ - dpkg -i /tmp/vagrant.deb - - ../../contrib/apt-install libvirt-clients libvirt-daemon-system libvirt-dev qemu-utils qemu-system \ - ruby build-essential libxml2-dev qemu-kvm rsync ebtables dnsmasq-base openssh-client - systemctl restart libvirtd - vagrant plugin install vagrant-libvirt - vagrant init cloud-image/fedora-${FEDORA_VERSION} --box-version ${FEDORA_BOX_VERSION} - - # The default libvirt Vagrant VM uses 512MB. - # VMs in our CI typically have around 16GB. - # Increasing it to 4GB should work. - sed -i Vagrantfile -e 's,^end$, config.vm.provider :libvirt do |libvirt|'"\n"' libvirt.memory = 4096;end'"\n"'end,g' - # Sync /tmp/criu.tar into the VM - # We want to use $HOME without expansion - # shellcheck disable=SC2016 - sed -i Vagrantfile -e 's|^end$| config.vm.provision "file", source: "/tmp/criu.tar", destination: "$HOME/criu.tar"'"\n"'end|g' - - vagrant up --provider=libvirt --no-tty - mkdir -p /root/.ssh - vagrant ssh-config >> /root/.ssh/config - - # Disable sssd to avoid zdtm test failures in pty04 due to sssd socket - ssh default sudo systemctl mask sssd - - ssh default 'sudo mkdir -p --mode=777 /vagrant && mv $HOME/criu.tar /vagrant && cd /vagrant && tar xf criu.tar' - ssh default sudo dnf upgrade -y - ssh default sudo /vagrant/criu/contrib/dependencies/dnf-packages.sh - ssh default cat /proc/cmdline -} - -fedora-no-vdso() { - ssh default sudo grubby --update-kernel ALL --args="vdso=0" - vagrant reload - ssh default cat /proc/cmdline - ssh default 'cd /vagrant/criu; make -j' - ssh default 'cd /vagrant/criu/test; sudo ./zdtm.py run -a --keep-going' - # This test (pidfd_store_sk) requires pidfd_getfd syscall which is guaranteed in Fedora 33. - # It is also skipped from -a because it runs in RPC mode only - ssh default 'cd /vagrant/criu/test; sudo ./zdtm.py run -t zdtm/transition/pidfd_store_sk --rpc --pre 2' -} - -fedora-rawhide() { - # Upgrade the kernel to the latest vanilla one - ssh default sudo dnf -y copr enable @kernel-vanilla/stable - ssh default sudo dnf upgrade -y - - # The 6.2 kernel of Fedora 38 in combination with rawhide userspace breaks - # zdtm/static/socket-tcp-nfconntrack. To activate the new kernel previously - # installed this reboots the VM. - vagrant reload - ssh default uname -a - # - # Workaround the problem: - # error running container: error from /usr/bin/crun creating container for [...]: sd-bus call: Transport endpoint is not connected - # Let's just use runc instead of crun - # see also https://github.com/kata-containers/tests/issues/4283 - # - ssh default 'sudo dnf remove -y crun || true' - ssh default sudo dnf install -y podman runc - # Some tests in the container need selinux to be disabled. - # In the container it is not possible to change the state of selinux. - # Let's just disable it for this test run completely. - ssh default 'sudo setenforce Permissive' - ssh default 'cd /vagrant/criu; sudo -E make -C scripts/ci fedora-rawhide CONTAINER_RUNTIME=podman BUILD_OPTIONS="--security-opt seccomp=unconfined"' -} - -fedora-non-root() { - ssh default uname -a - ssh default 'cd /vagrant/criu; make -j' - # Setting the capability should be the only line needed to run as non-root on Fedora - # In other environments either set /proc/sys/kernel/yama/ptrace_scope to 0 or grant cap_sys_ptrace to criu - ssh default 'sudo setcap cap_checkpoint_restore+eip /vagrant/criu/criu/criu' - # Run it once as non-root - ssh default 'cd /vagrant/criu; criu/criu check --unprivileged; ./test/zdtm.py run -t zdtm/static/env00 -t zdtm/static/pthread00 -f h --rootless' - # Run it as root with '--rootless' - ssh default 'cd /vagrant/criu; sudo ./test/zdtm.py run -t zdtm/static/env00 -t zdtm/static/pthread00 -f h; sudo chmod 777 test/dump/zdtm/static/{env00,pthread00}; sudo ./test/zdtm.py run -t zdtm/static/env00 -t zdtm/static/pthread00 -f h --rootless' - # Run it as non-root in a user namespace. Since CAP_CHECKPOINT_RESTORE behaves differently in non-user namespaces (e.g. no access to map_files) this tests that we can dump and restore - # under those conditions. Note that the "... && true" part is necessary; we need at least one statement after the tests so that bash can reap zombies in the user namespace, - # otherwise it will exec the last statement and get replaced and nobody will be left to reap our zombies. - # Note: selinux in Enforcing mode prevents us from calling clone3() or writing to ns_last_pid on restore; hence set to Permissive for the test and then set back. - ssh default 'cd /vagrant/criu; selinuxmode=`getenforce` && sudo setenforce Permissive && unshare -Ucfpm --mount-proc bash -c "./test/zdtm.py run -t zdtm/static/maps00 -f h --rootless && true" && sudo setenforce $selinuxmode' -} - -$1