Currently this test creates one process and wait it. So most part of the
time this test has only one process without children.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
For other tests set of file descriptors can be changed
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Restoring mount namespaces requires to create temporary directories
in a test root.
When tests execute in a new userns, they have non-zero gid and uid,
so we need to grant permissions for them.
v2: add +rx as well
Reported-by: Mr Jenkins
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Sockets tests are excluded, because SO_RCVBUFFORCE and SO_SNDBUFFORCE
are protected by CAP_NET_ADMIN
tty*, pty* are excluded, because TIOCSLCKTRMIOS protected by
CAP_SYS_ADMIN
*ghost, *notify, *unlink* are excluded, because linkat(AT_EMPTY_PATH)
are protected by CAP_DAC_READ_SEARCH
v2: use a blacklist
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Here are two issues:
1. All mounts in a new user namespace are locked, so
we need to create a new root mount. We need to bind-mount root to
itself.
2. /proc and /sys must be mounted before umounting /proc and /sys
which were inhereted. It's a security policy.
"""
Author: Eric W. Biederman <ebiederm@xmission.com>
Date: Sun Mar 24 14:28:27 2013 -0700
userns: Restrict when proc and sysfs can be mounted
Only allow unprivileged mounts of proc and sysfs if they are already
mounted when the user namespace is created.
"""
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Devices can not be created in a new user namespace.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
page-server are not tested now. I suggest to add it in the pre-dump job.
v2: execute all tests with and without page server
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
When a process, which starts a service, exits, we know that we can
connect to the page server and we expect to find pidfile.
If we create pidfile from a page server process, we have a race window.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Now we check them for all test processes
v2: Busybox doesn't have truncate
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Reviewed-by: Christopher Covington <cov@codeaurora.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
We simply check that major/minor didn't changed after restore.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Currently we fill as much as posible data in a socket and then use
half of these data to make a flow in the connection.
These data is send and recv buffers. When a connection is dumped and
restored, it needs time to go back to the normal work. In this time we
can reliably fill only send buffers. So at the result the sockets may
contain less data than required for heartbeating and the test will
block.
The test with this patch will monitor actuall size of data in a test
socket.
Cc: Konstantin Neumoin <kneumoin@parallels.com>
Reported-by: Konstantin Neumoin <kneumoin@parallels.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
In addition it checks that criu closes all its descriptors
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
In criu we carry SysV memory via @VMA_AREA_SYSVIPC
attribute but to the test must have a live reference
to real memory area to check that shmem address was
restored correctly. Add it.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Andrew Vagin <avagin@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Users don't like errors even if criu returns zero.
So I suggest to start looking at them.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
In this case we have another chance to not skip errors.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
This timeout is too small for tcp test cases.
This timeout should be bigger than TCP_RTO_MAX 120 seconds
Signed-off-by: Konstantin Neumoin <kneumoin@parallels.com>
Acked-by: Andrew Vagin <avagin@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
It's bad idea to have only one target object.
In addition I add a shared region to the second process,
which is not mapped in the first.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
The main problem with the
test that it's never 'fail'.
Test can only 'pass' or hangs.
Signed-off-by: Konstantin Neumoin <kneumoin@parallels.com>
Acked-by: Andrew Vagin <avagin@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
After changing an owner the current user will not be able to remove or
change the directory. It isn't convenient.
Reported-by: Tycho Andersen <tycho.andersen@canonical.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
zdtm-pre-dump, zdtm-snapshot, zdtm-iter, zdtm execute pipe00, so
these targets should be executed one by one.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Error was:
maps02.c: In function ‘main’:
maps02.c:57:74: error: ‘MADV_DONTDUMP’ undeclared (first use in this function)
maps02.c:57:74: note: each undeclared identifier is reported only once for each function it appears in
make: *** [maps02] Error 1
ERROR: fail to start /home/root/criu/test/zdtm/live/static/maps02
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Acked-by: Andrew Vagin <avagin@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
* check page server
* check snapshots
* check a few iterations of dump/restore
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
man 2 open:
"""
mode specifies the permissions to use in case a new file is cre‐
ated. This argument must be supplied when O_CREAT or O_TMPFILE
is specified in flags;
"""
Cc: Konstantin Neumoin <kneumoin@parallels.com>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Test maps 17 pages and mlocks them, then changes user id from root
to 18943, after c/r checks that MAP_LOCKED bit is set for that vma.
Signed-off-by: Pavel Tikhomirov <ptikhomirov@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
My debian testing produces the following output for uname:
$ uname -r
3.14-2-amd64
and so:
$ set -- `uname -r | sed 's/\./ /g'`
$ echo $1
3
$ echo $2
14-2-amd64
this causes zdtm.sh to fail for me on line 293:
[ $1 -eq 3 -a $2 -ge 11 ] && return 0
because "14-2-amd64 -ge 11" is false.
Signed-off-by: Matthias Neuer <matthias.neuer@uni-ulm.de>
Reviewed-by: Christopher Covington <cov@codeaurora.org>
Acked-by: Andrew Vagin <avagin@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
tmpfs has the "size" option, which is not standard.
Execute zdtm/live/static/mountpoints
./mountpoints --pidfile=mountpoints.pid --outfile=mountpoints.out
Dump 2737
WARNING: mountpoints returned 1 and left running for debug needs
Test: zdtm/live/static/mountpoints, Result: FAIL
==================================== ERROR ====================================
Test: zdtm/live/static/mountpoints, Namespace:
Dump log : /root/git/criu/test/dump/static/mountpoints/2737/1/dump.log
--------------------------------- grep Error ---------------------------------
(00.146444) Error (mount.c:399): Two shared mounts 50, 67 have different sets of children
(00.146460) Error (mount.c:402): 67:./zdtm_mpts/dev/share-1 doesn't have a proper point for 54:./zdtm_mpts/dev/share-3/test.mnt.share
(00.146820) Error (cr-dump.c:1921): Dumping FAILED.
------------------------------------- END -------------------------------------
================================= ERROR OVER =================================
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Tested-by: Ruslan Kuprieiev <kupruser@gmail.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
To show which events are coming and flush events before dump as required by new fsnotify mode.
Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Andrew Vagin <avagin@parallels.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
If a controller is mounted during dumping processes, criu may fail with error:
Error (cgroup.c:768): cg: Set 3 is not subset of 2
so lets create all test controllers before executing tests.
Reported-by: Mr Jenkins
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
There is a potential attack here where if someone is restoring something and
criu write the pid to a file the attacker controls, the attacker can then
re-write that to whatever pid they want. ciru should instead open the file with
O_EXCL so that the restore fails if the file exists.
We don't need O_TRUNC here since we're O_EXCL-ing the file.
Reported-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Tycho Andersen <tycho.andersen@canonical.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
If we open a file, lock one, fork, then close and
open the file in parent again, lock should 'slide'
to the child process anyway.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Inherited flock is the one that a task got from its parent.
In case parent closes the corresponding fd, the /proc/locks
still shows the parent pid, while the lock is owned by child.
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Usually /tmp is a mount point.
Recently we found a bug in criu, when it restore mount fanotify on "./"
instead of "/". The test didn't find it, because they are pointed on the
same mount point.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
We try to remove mark on the correct mount point and
if the mark is restored on a wrong mount point, we will get ENOENT.
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
I'm scared, when I see smth like that:
rm: cannot remove ‘/var/lib/jenkins/jobs/CRIU/workspace/test/dump/static/cgroup00/31195/1/.criu.cgyard.6qctPl/systemd/tasks’: Operation not permitted
v2: do that only in the "test" directory
Reported-by: Mr Jenkins
Signed-off-by: Andrew Vagin <avagin@openvz.org>
Signed-off-by: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
