Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: do not use 'tail' for skip-file-rwx-check test #2307

Merged
merged 1 commit into from
Dec 21, 2023
Merged

ci: do not use 'tail' for skip-file-rwx-check test #2307

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions scripts/ci/prepare-for-fedora-rawhide.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ dnf install -y \
libnet-devel \
libnl3-devel \
libbsd-devel \
libselinux-utils \
make \
procps-ng \
protobuf-c-devel \
Expand Down
11 changes: 8 additions & 3 deletions scripts/ci/run-ci-tests.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -288,11 +288,16 @@ ip net add test

# Rootless tests
# Check if cap_checkpoint_restore is supported and also if unshare -c is supported.
if capsh --supports=cap_checkpoint_restore && unshare -c /bin/true; then
#
# Do not run this test in a container (see https://github.com/checkpoint-restore/criu/issues/2312).
# This is a temporary workaround until fixed in the kernel.
# The kernel currently does not show correct device and inode numbers in /proc/pid/maps
# for stackable file systems.
if capsh --supports=cap_checkpoint_restore && unshare -c /bin/true && [ ! -e /run/.containerenv ]; then
adrianreber marked this conversation as resolved.
Show resolved Hide resolved
make -C test/zdtm/ cleanout
rm -rf test/dump
setcap cap_checkpoint_restore,cap_sys_ptrace+eip criu/criu
if [ -d /sys/fs/selinux ]; then
if [ -d /sys/fs/selinux ] && command -v getenforce &>/dev/null; then
# Note: selinux in Enforcing mode prevents us from calling clone3() or writing to ns_last_pid on restore; hence set to Permissive for the test and then set back.
selinuxmode=$(getenforce)
setenforce Permissive
Expand All @@ -301,7 +306,7 @@ if capsh --supports=cap_checkpoint_restore && unshare -c /bin/true; then
# under those conditions. Note that the "... && true" part is necessary; we need at least one statement after the tests so that bash can reap zombies in the user namespace,
# otherwise it will exec the last statement and get replaced and nobody will be left to reap our zombies.
sudo --user=#65534 --group=#65534 unshare -Ucfpm --mount-proc -- bash -c "./test/zdtm.py run -t zdtm/static/maps00 -f h --rootless && true"
adrianreber marked this conversation as resolved.
Show resolved Hide resolved
if [ -d /sys/fs/selinux ]; then
if [ -d /sys/fs/selinux ] && command -v getenforce &>/dev/null; then
setenforce "$selinuxmode"
fi
setcap -r criu/criu
Expand Down
4 changes: 4 additions & 0 deletions scripts/ci/vagrant.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,10 @@ fedora-rawhide() {
#
ssh default 'sudo dnf remove -y crun || true'
ssh default sudo dnf install -y podman runc
# Some tests in the container need selinux to be disabled.
# In the container it is not possible to change the state of selinux.
# Let's just disable it for this test run completely.
ssh default 'sudo setenforce Permissive'
ssh default 'cd /vagrant; tar xf criu.tar; cd criu; sudo -E make -C scripts/ci fedora-rawhide CONTAINER_RUNTIME=podman BUILD_OPTIONS="--security-opt seccomp=unconfined"'
}

Expand Down
Loading