mirror of
https://github.com/checkpoint-restore/criu.git
synced 2026-07-18 00:58:31 +00:00
1d482bd43e
Move the two remaining Cirrus CI Vagrant-based tests (no-VDSO and
non-root) into the existing vm-fedora-rawhide-test GitHub Actions
matrix job using Lima VMs.
Add fedora-no-vdso-{setup,test} and fedora-non-root-{setup,test}
functions to scripts/ci/lima.sh, expand the matrix in ci.yml with
the two new variants, make the reboot step conditional on
matrix.reboot, and remove .cirrus.yml and scripts/ci/vagrant.sh
along with their Makefile targets.
Assisted-by: Claude Code (claude-opus-4-6):claude-opus-4-6@default
Signed-off-by: Adrian Reber <areber@redhat.com>
204 lines
6.5 KiB
Bash
Executable file
204 lines
6.5 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
# This script runs inside Lima VMs to set up and run CI tests.
|
|
# It is invoked with a command name, e.g.:
|
|
# lima.sh centos-stream-setup
|
|
# lima.sh centos-stream-test
|
|
# lima.sh fedora-stable-setup
|
|
# lima.sh fedora-stable-test
|
|
# lima.sh fedora-next-setup
|
|
# lima.sh fedora-next-test
|
|
# lima.sh fedora-no-vdso-setup
|
|
# lima.sh fedora-no-vdso-test
|
|
# lima.sh fedora-non-root-setup
|
|
# lima.sh fedora-non-root-test
|
|
|
|
set -e
|
|
set -x
|
|
|
|
CRIU_DIR="${CRIU_DIR:-/home/criu}"
|
|
|
|
centos-stream-setup() {
|
|
# Enable CRB repository
|
|
dnf config-manager --set-enabled crb
|
|
# Install EPEL
|
|
dnf -y install epel-release
|
|
# Install build/test dependencies
|
|
"${CRIU_DIR}"/contrib/dependencies/dnf-packages.sh
|
|
# Disable sssd to avoid zdtm test failures in pty04
|
|
systemctl stop sssd || true
|
|
# Set SELinux to permissive mode; selinux tests still run but
|
|
# are not blocked by the restricted service context of CI.
|
|
setenforce 0
|
|
# The rpc test cases are running as user #1000
|
|
adduser -u 1000 test
|
|
}
|
|
|
|
centos-stream-test() {
|
|
# Increase the max thread limit for the thread-bomb test
|
|
sysctl -w kernel.threads-max=100000
|
|
|
|
# Newer systemd versions limit the number of tasks per user via
|
|
# cgroup pids controller. Remove the limit for the root user.
|
|
systemctl set-property user-0.slice TasksMax=infinity
|
|
|
|
cd "${CRIU_DIR}"
|
|
make -C scripts/ci local \
|
|
SKIP_CI_PREP=1 CC=gcc CD_TO_TOP=1 \
|
|
ZDTM_OPTS="-x zdtm/static/socket-raw"
|
|
}
|
|
|
|
_common_setup() {
|
|
# Disable sssd to avoid zdtm test failures in pty04 due to sssd socket
|
|
systemctl mask sssd
|
|
|
|
# The shellcheck tool misunderstands the "do" to be from a loop
|
|
# shellcheck disable=SC1010
|
|
dnf -y do --action=upgrade \* --action=install make podman
|
|
}
|
|
|
|
_common_test() {
|
|
# Increase the max thread limit for the thread-bomb test
|
|
sysctl -w kernel.threads-max=100000
|
|
|
|
# Allow memory overcommit. The thread-bomb test creates 1024
|
|
# threads that each create a successor after restore. In a
|
|
# memory-constrained VM the heuristic overcommit check can
|
|
# deny mmap for new thread stacks, and glibc maps ENOMEM to
|
|
# EAGAIN in pthread_create.
|
|
sysctl -w vm.overcommit_memory=1
|
|
|
|
# Newer systemd versions limit the number of tasks per scope/slice
|
|
# via cgroup pids controller. Set the system-wide default to
|
|
# unlimited and also remove the limit for the root user's slice.
|
|
# Without this, podman container scopes inherit the default
|
|
# TasksMax and thread-bomb fails with EAGAIN.
|
|
mkdir -p /etc/systemd/system.conf.d
|
|
printf '[Manager]\nDefaultTasksMax=infinity\n' \
|
|
> /etc/systemd/system.conf.d/50-tasks.conf
|
|
systemctl daemon-reload
|
|
systemctl set-property user-0.slice TasksMax=infinity
|
|
|
|
# Some tests in the container need selinux to be disabled.
|
|
# In the container it is not possible to change the state of selinux.
|
|
# Let's just disable it for this test run completely.
|
|
setenforce Permissive
|
|
|
|
cd "${CRIU_DIR}"
|
|
# excluding zdtm/static/socket-tcpbuf-local in this setup as it fails
|
|
# sometimes: https://github.com/checkpoint-restore/criu/issues/2987
|
|
make -C scripts/ci fedora-rawhide \
|
|
CONTAINER_RUNTIME=podman \
|
|
BUILD_OPTIONS="--security-opt seccomp=unconfined" \
|
|
ZDTM_OPTS="-x zdtm/static/socket-tcpbuf-local"
|
|
}
|
|
|
|
fedora-stable-setup() {
|
|
# Upgrade the kernel to the latest vanilla stable one
|
|
dnf -y copr enable @kernel-vanilla/stable
|
|
_common_setup
|
|
}
|
|
|
|
fedora-stable-test() {
|
|
_common_test
|
|
}
|
|
|
|
fedora-next-setup() {
|
|
# Upgrade the kernel to the latest vanilla next one
|
|
dnf -y copr enable @kernel-vanilla/next
|
|
_common_setup
|
|
}
|
|
|
|
fedora-next-test() {
|
|
_common_test
|
|
}
|
|
|
|
fedora-no-vdso-setup() {
|
|
"${CRIU_DIR}"/contrib/dependencies/dnf-packages.sh
|
|
# Disable sssd to avoid zdtm test failures in pty04 due to sssd socket
|
|
systemctl mask sssd
|
|
# Disable VDSO; the VM is rebooted between setup and test
|
|
grubby --update-kernel ALL --args="vdso=0"
|
|
}
|
|
|
|
fedora-no-vdso-test() {
|
|
cd "${CRIU_DIR}"
|
|
make -j"$(nproc)"
|
|
./test/zdtm.py run -a --keep-going
|
|
# This test requires pidfd_getfd which is guaranteed in Fedora 33.
|
|
# It is skipped from -a because it runs in RPC mode only.
|
|
./test/zdtm.py run -t zdtm/transition/pidfd_store_sk --rpc --pre 2
|
|
}
|
|
|
|
fedora-non-root-setup() {
|
|
"${CRIU_DIR}"/contrib/dependencies/dnf-packages.sh
|
|
# Disable sssd to avoid zdtm test failures in pty04 due to sssd socket
|
|
systemctl mask sssd
|
|
# The rpc test cases are running as user #1000
|
|
adduser -u 1000 test
|
|
# The user-namespace test (unshare --map-auto) needs subordinate
|
|
# UID/GID ranges so that GID 65534 (nobody) is mapped inside the
|
|
# namespace. Without this, zdtm.py --rootless fails with EINVAL
|
|
# on setgid(65534).
|
|
echo "root:100000:65536" >> /etc/subuid
|
|
echo "root:100000:65536" >> /etc/subgid
|
|
}
|
|
|
|
fedora-non-root-test() {
|
|
cd "${CRIU_DIR}"
|
|
make -j"$(nproc)"
|
|
|
|
# Make the source tree writable by non-root users. On GitHub
|
|
# Actions limactl copy preserves the runner's permissions (755
|
|
# directories), so test binaries running as non-root cannot
|
|
# create output files without this.
|
|
chmod -R a+rwX .
|
|
|
|
# Setting the capability should be the only line needed to run
|
|
# as non-root on Fedora. In other environments either set
|
|
# /proc/sys/kernel/yama/ptrace_scope to 0 or grant
|
|
# cap_sys_ptrace to criu.
|
|
setcap cap_checkpoint_restore+eip criu/criu
|
|
|
|
# Run it once as non-root.
|
|
# Remove any root-owned dump directories from make so the
|
|
# non-root user can create its own.
|
|
criu/criu check --unprivileged
|
|
rm -rf test/dump
|
|
./test/zdtm.py run \
|
|
-t zdtm/static/env00 \
|
|
-t zdtm/static/pthread00 \
|
|
-f h --rootless
|
|
|
|
# Run it as root with '--rootless'
|
|
sudo ./test/zdtm.py run \
|
|
-t zdtm/static/env00 \
|
|
-t zdtm/static/pthread00 \
|
|
-f h
|
|
sudo chmod 777 test/dump/zdtm/static/{env00,pthread00}
|
|
sudo ./test/zdtm.py run \
|
|
-t zdtm/static/env00 \
|
|
-t zdtm/static/pthread00 \
|
|
-f h --rootless
|
|
|
|
# Run it as non-root in a user namespace. Since
|
|
# CAP_CHECKPOINT_RESTORE behaves differently in non-user
|
|
# namespaces (e.g. no access to map_files) this tests that we
|
|
# can dump and restore under those conditions.
|
|
# Note: the "... && true" part is necessary so that bash does
|
|
# not exec the last statement and still reaps zombies.
|
|
# Note: selinux in Enforcing mode prevents clone3() or
|
|
# writing to ns_last_pid on restore; set to Permissive for
|
|
# the test and then restore it.
|
|
# Remove dump directory left by previous test runs as root;
|
|
# the user namespace test runs as nobody (uid 65534) and
|
|
# cannot write into root-owned directories.
|
|
rm -rf test/dump
|
|
selinuxmode=$(getenforce)
|
|
sudo setenforce Permissive
|
|
unshare --map-auto -fpm --mount-proc bash -c \
|
|
"./test/zdtm.py run -t zdtm/static/maps00 -f h --rootless && true"
|
|
sudo setenforce "$selinuxmode"
|
|
}
|
|
|
|
"$@"
|