Skip to content

Commit

Permalink
Merge pull request #7760 from rhatdan/rootless
Browse files Browse the repository at this point in the history 
Remove some SkipIfRootless flags from tests
  • Loading branch information
@openshift-merge-robot
openshift-merge-robot authored Sep 25, 2020
2 parents 90c2cc6 + ff63715 commit 2583246
Show file tree
Hide file tree
Showing 5 changed files with 54 additions and 62 deletions.
1 change: 1 addition & 0 deletions test/e2e/common_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ var (
ARTIFACT_DIR = "/tmp/.artifacts"
RESTORE_IMAGES = []string{ALPINE, BB, nginx}
defaultWaitTimeout = 90
CGROUPSV2, _ = cgroups.IsCgroup2UnifiedMode()
)

// PodmanTestIntegration struct for command line options
Expand Down
3 changes: 3 additions & 0 deletions test/e2e/libpod_suite_remote_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,9 @@ func SkipIfRemote(reason string) {
ginkgo.Skip("[remote]: " + reason)
}

func SkipIfRootlessCgroupsV1() {
}

func SkipIfRootless() {
if os.Geteuid() != 0 {
ginkgo.Skip("This function is not enabled for rootless podman")
Expand Down
6 changes: 6 additions & 0 deletions test/e2e/libpod_suite_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,12 @@ func IsRemote() bool {
func SkipIfRemote(string) {
}

func SkipIfRootlessCgroupsV1() {
if os.Geteuid() != 0 && !CGROUPSV2 {
Skip("Rooless requires cgroupsV2 to set limits")
}
}

func SkipIfRootless() {
if os.Geteuid() != 0 {
Skip("This function is not enabled for rootless podman")
Expand Down
3 changes: 3 additions & 0 deletions test/e2e/libpod_suite_varlink_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,9 @@ func IsRemote() bool {
return true
}

func SkipIfRootlessCgroupsV1() {
}

func SkipIfRemote(reason string) {
ginkgo.Skip("[remote]: " + reason)
}
Expand Down
103 changes: 41 additions & 62 deletions test/e2e/run_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@ import (
"syscall"
"time"

"github.com/containers/podman/v2/pkg/cgroups"
. "github.com/containers/podman/v2/test/utils"
"github.com/containers/storage/pkg/stringid"
"github.com/mrunalp/fileutils"
Expand Down Expand Up @@ -50,7 +49,6 @@ var _ = Describe("Podman run", func() {
})

It("podman run a container based on a complex local image name", func() {
SkipIfRootless()
imageName := strings.TrimPrefix(nginx, "quay.io/")
session := podmanTest.Podman([]string{"run", imageName, "ls"})
session.WaitWithDefaultTimeout()
Expand Down Expand Up @@ -311,12 +309,15 @@ USER bin`
})

It("podman run limits test", func() {
SkipIfRootless()
session := podmanTest.Podman([]string{"run", "--rm", "--ulimit", "rtprio=99", "--cap-add=sys_nice", fedoraMinimal, "cat", "/proc/self/sched"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
SkipIfRootlessCgroupsV1()

if !isRootless() {
session := podmanTest.Podman([]string{"run", "--rm", "--ulimit", "rtprio=99", "--cap-add=sys_nice", fedoraMinimal, "cat", "/proc/self/sched"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
}

session = podmanTest.Podman([]string{"run", "--rm", "--ulimit", "nofile=2048:2048", fedoraMinimal, "ulimit", "-n"})
session := podmanTest.Podman([]string{"run", "--rm", "--ulimit", "nofile=2048:2048", fedoraMinimal, "ulimit", "-n"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(ContainSubstring("2048"))
Expand All @@ -326,10 +327,7 @@ USER bin`
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(ContainSubstring("1024"))

cgroupsv2, err := cgroups.IsCgroup2UnifiedMode()
Expect(err).To(BeNil())

if !cgroupsv2 {
if !CGROUPSV2 {
// --oom-kill-disable not supported on cgroups v2.
session = podmanTest.Podman([]string{"run", "--rm", "--oom-kill-disable=true", fedoraMinimal, "echo", "memory-hog"})
session.WaitWithDefaultTimeout()
Expand Down Expand Up @@ -370,25 +368,23 @@ USER bin`
})

It("podman run sysctl test", func() {
SkipIfRootless()
SkipIfRootless() // Network sysclts are not avalable root rootless
session := podmanTest.Podman([]string{"run", "--rm", "--sysctl", "net.core.somaxconn=65535", ALPINE, "sysctl", "net.core.somaxconn"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(ContainSubstring("net.core.somaxconn = 65535"))
})

It("podman run blkio-weight test", func() {
SkipIfRootless()
cgroupsv2, err := cgroups.IsCgroup2UnifiedMode()
Expect(err).To(BeNil())

if !cgroupsv2 {
SkipIfRootless() // FIXME: This is blowing up because of no /sys/fs/cgroup/user.slice/user-14467.slice/[email protected]/cgroup.subtree_control file
// SkipIfRootlessCgroupsV1()
if !CGROUPSV2 {
if _, err := os.Stat("/sys/fs/cgroup/blkio/blkio.weight"); os.IsNotExist(err) {
Skip("Kernel does not support blkio.weight")
}
}

if cgroupsv2 {
if CGROUPSV2 {
// convert linearly from [10-1000] to [1-10000]
session := podmanTest.Podman([]string{"run", "--rm", "--blkio-weight=15", ALPINE, "sh", "-c", "cat /sys/fs/cgroup/$(sed -e 's|0::||' < /proc/self/cgroup)/io.bfq.weight"})
session.WaitWithDefaultTimeout()
Expand All @@ -403,84 +399,72 @@ USER bin`
})

It("podman run device-read-bps test", func() {
SkipIfRootless()

cgroupsv2, err := cgroups.IsCgroup2UnifiedMode()
Expect(err).To(BeNil())

SkipIfRootless() // FIXME: Missing /sys/fs/cgroup/user.slice/user-14467.slice/[email protected]/cgroup.subtree_control
SkipIfRootlessCgroupsV1()
var session *PodmanSessionIntegration

if cgroupsv2 {
if CGROUPSV2 {
session = podmanTest.Podman([]string{"run", "--rm", "--device-read-bps=/dev/zero:1mb", ALPINE, "sh", "-c", "cat /sys/fs/cgroup/$(sed -e 's|0::||' < /proc/self/cgroup)/io.max"})
} else {
session = podmanTest.Podman([]string{"run", "--rm", "--device-read-bps=/dev/zero:1mb", ALPINE, "cat", "/sys/fs/cgroup/blkio/blkio.throttle.read_bps_device"})
}

session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
if !cgroupsv2 { // TODO: Test Simplification. For now, we only care about exit(0) w/ cgroupsv2
if !CGROUPSV2 { // TODO: Test Simplification. For now, we only care about exit(0) w/ cgroupsv2
Expect(session.OutputToString()).To(ContainSubstring("1048576"))
}
})

It("podman run device-write-bps test", func() {
SkipIfRootless()

cgroupsv2, err := cgroups.IsCgroup2UnifiedMode()
Expect(err).To(BeNil())

SkipIfRootless() // FIXME /sys/fs/cgroup/user.slice/user-14467.slice/[email protected]/cgroup.subtree_control does not exist
SkipIfRootlessCgroupsV1()
var session *PodmanSessionIntegration

if cgroupsv2 {
if CGROUPSV2 {
session = podmanTest.Podman([]string{"run", "--rm", "--device-write-bps=/dev/zero:1mb", ALPINE, "sh", "-c", "cat /sys/fs/cgroup/$(sed -e 's|0::||' < /proc/self/cgroup)/io.max"})
} else {
session = podmanTest.Podman([]string{"run", "--rm", "--device-write-bps=/dev/zero:1mb", ALPINE, "cat", "/sys/fs/cgroup/blkio/blkio.throttle.write_bps_device"})
}
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
if !cgroupsv2 { // TODO: Test Simplification. For now, we only care about exit(0) w/ cgroupsv2
if !CGROUPSV2 { // TODO: Test Simplification. For now, we only care about exit(0) w/ cgroupsv2
Expect(session.OutputToString()).To(ContainSubstring("1048576"))
}
})

It("podman run device-read-iops test", func() {
SkipIfRootless()

cgroupsv2, err := cgroups.IsCgroup2UnifiedMode()
Expect(err).To(BeNil())

SkipIfRootless() // FIXME /sys/fs/cgroup/user.slice/user-14467.slice/[email protected]/cgroup.subtree_control does not exist
SkipIfRootlessCgroupsV1()
var session *PodmanSessionIntegration

if cgroupsv2 {
if CGROUPSV2 {
session = podmanTest.Podman([]string{"run", "--rm", "--device-read-iops=/dev/zero:100", ALPINE, "sh", "-c", "cat /sys/fs/cgroup/$(sed -e 's|0::||' < /proc/self/cgroup)/io.max"})
} else {
session = podmanTest.Podman([]string{"run", "--rm", "--device-read-iops=/dev/zero:100", ALPINE, "cat", "/sys/fs/cgroup/blkio/blkio.throttle.read_iops_device"})
}

session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
if !cgroupsv2 { // TODO: Test Simplification. For now, we only care about exit(0) w/ cgroupsv2
if !CGROUPSV2 { // TODO: Test Simplification. For now, we only care about exit(0) w/ cgroupsv2
Expect(session.OutputToString()).To(ContainSubstring("100"))
}
})

It("podman run device-write-iops test", func() {
SkipIfRootless()

cgroupsv2, err := cgroups.IsCgroup2UnifiedMode()
Expect(err).To(BeNil())

SkipIfRootless() // FIXME /sys/fs/cgroup/user.slice/user-14467.slice/[email protected]/cgroup.subtree_control does not exist
SkipIfRootlessCgroupsV1()
var session *PodmanSessionIntegration

if cgroupsv2 {
if CGROUPSV2 {
session = podmanTest.Podman([]string{"run", "--rm", "--device-write-iops=/dev/zero:100", ALPINE, "sh", "-c", "cat /sys/fs/cgroup/$(sed -e 's|0::||' < /proc/self/cgroup)/io.max"})
} else {
session = podmanTest.Podman([]string{"run", "--rm", "--device-write-iops=/dev/zero:100", ALPINE, "cat", "/sys/fs/cgroup/blkio/blkio.throttle.write_iops_device"})
}

session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
if !cgroupsv2 { // TODO: Test Simplification. For now, we only care about exit(0) w/ cgroupsv2
if !CGROUPSV2 { // TODO: Test Simplification. For now, we only care about exit(0) w/ cgroupsv2
Expect(session.OutputToString()).To(ContainSubstring("100"))
}
})
Expand Down Expand Up @@ -586,7 +570,7 @@ USER bin`
})

It("podman run with FIPS mode secrets", func() {
SkipIfRootless()
SkipIfRootless() // rootless can not manipulate system-fips file
fipsFile := "/etc/system-fips"
err = ioutil.WriteFile(fipsFile, []byte{}, 0755)
Expect(err).To(BeNil())
Expand All @@ -601,27 +585,24 @@ USER bin`
})

It("podman run without group-add", func() {
SkipIfRootless()
session := podmanTest.Podman([]string{"run", "--rm", ALPINE, "id"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(Equal("uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)"))
Expect(session.LineInOutputContains("27(video),777,65533(nogroup)")).To(BeFalse())
})

It("podman run with group-add", func() {
SkipIfRootless()
session := podmanTest.Podman([]string{"run", "--rm", "--group-add=audio", "--group-add=nogroup", "--group-add=777", ALPINE, "id"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(Equal("uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),18(audio),20(dialout),26(tape),27(video),777,65533(nogroup)"))
Expect(session.LineInOutputContains("777,65533(nogroup)")).To(BeTrue())
})

It("podman run with user (default)", func() {
SkipIfRootless()
session := podmanTest.Podman([]string{"run", "--rm", ALPINE, "id"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(Equal("uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)"))
Expect(session.LineInOutputContains("uid=0(root) gid=0(root)")).To(BeTrue())
})

It("podman run with user (integer, not in /etc/passwd)", func() {
Expand All @@ -632,19 +613,17 @@ USER bin`
})

It("podman run with user (integer, in /etc/passwd)", func() {
SkipIfRootless()
session := podmanTest.Podman([]string{"run", "--rm", "--user=8", ALPINE, "id"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(Equal("uid=8(mail) gid=12(mail) groups=12(mail)"))
Expect(session.LineInOutputContains("uid=8(mail) gid=12(mail)")).To(BeTrue())
})

It("podman run with user (username)", func() {
SkipIfRootless()
session := podmanTest.Podman([]string{"run", "--rm", "--user=mail", ALPINE, "id"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(session.OutputToString()).To(Equal("uid=8(mail) gid=12(mail) groups=12(mail)"))
Expect(session.LineInOutputContains("uid=8(mail) gid=12(mail)")).To(BeTrue())
})

It("podman run with user:group (username:integer)", func() {
Expand Down Expand Up @@ -910,15 +889,14 @@ USER mail`
})

It("podman run --mount type=bind,bind-nonrecursive", func() {
SkipIfRootless()
SkipIfRootless() // rootless users are not allowed to mount bind-nonrecursive (Could this be a Kernel bug?
session := podmanTest.Podman([]string{"run", "--mount", "type=bind,bind-nonrecursive,slave,src=/,target=/host", fedoraMinimal, "findmnt", "-nR", "/host"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expect(len(session.OutputToStringArray())).To(Equal(1))
})

It("podman run --mount type=devpts,target=/foo/bar", func() {
SkipIfRootless()
session := podmanTest.Podman([]string{"run", "--mount", "type=devpts,target=/foo/bar", fedoraMinimal, "stat", "-f", "-c%T", "/foo/bar"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
Expand Down Expand Up @@ -1071,7 +1049,8 @@ USER mail`
})

It("podman run with cgroups=disabled runs without cgroups", func() {
SkipIfRootless()
SkipIfRootless() // FIXME: I believe this should work but need to fix this test
SkipIfRootlessCgroupsV1()
// Only works on crun
if !strings.Contains(podmanTest.OCIRuntime, "crun") {
Skip("Test only works on crun")
Expand Down Expand Up @@ -1103,7 +1082,7 @@ USER mail`
})

It("podman run with cgroups=enabled makes cgroups", func() {
SkipIfRootless()
SkipIfRootlessCgroupsV1()
// Only works on crun
if !strings.Contains(podmanTest.OCIRuntime, "crun") {
Skip("Test only works on crun")
Expand Down Expand Up @@ -1146,7 +1125,7 @@ USER mail`
})

It("podman run --device-cgroup-rule", func() {
SkipIfRootless()
SkipIfRootless() // rootless users are not allowed to mknod
deviceCgroupRule := "c 42:* rwm"
session := podmanTest.Podman([]string{"run", "--name", "test", "-d", "--device-cgroup-rule", deviceCgroupRule, ALPINE, "top"})
session.WaitWithDefaultTimeout()
Expand Down

0 comments on commit 2583246

Please sign in to comment.