containerd/pkg/sys/unshare_linux_test.go

/*
   Copyright The containerd Authors.

   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
*/

package sys

import (
	"fmt"
	"os"
	"syscall"
	"testing"

	kernel "github.com/containerd/containerd/v2/pkg/kernelversion"
	"github.com/containerd/continuity/testutil"
	"github.com/stretchr/testify/require"
	"golang.org/x/sys/unix"
)

func TestUnshareAfterEnterUserns(t *testing.T) {
	testutil.RequiresRoot(t)

	k510 := kernel.KernelVersion{Kernel: 5, Major: 10}
	ok, err := kernel.GreaterEqualThan(k510)
	require.NoError(t, err)
	if !ok {
		t.Skip("Requires kernel >= 5.10")
	}

	err = UnshareAfterEnterUserns("0:1000:1", "0:1000:1", syscall.CLONE_NEWUSER|syscall.CLONE_NEWIPC, nil)
	require.Error(t, err)
	require.ErrorContains(t, err, "unshare flags should not include user namespace")

	t.Run("should work", testUnshareAfterEnterUsernsShouldWork)
	t.Run("killpid", testUnshareAfterEnterUsernsKillPid)
	t.Run("invalid unshare flags", testUnshareAfterEnterUsernsInvalidFlags)
	t.Run("user namespace ownership", testUnshareAfterEnterUsernsOwnership)
}

func testUnshareAfterEnterUsernsShouldWork(t *testing.T) {
	t.Parallel()

	currentNetNs, err := getNamespaceInode(os.Getpid(), "net")
	require.NoError(t, err)

	currentUserNs, err := getNamespaceInode(os.Getpid(), "user")
	require.NoError(t, err)

	currentIpcNs, err := getNamespaceInode(os.Getpid(), "ipc")
	require.NoError(t, err)

	currentPidNs, err := getNamespaceInode(os.Getpid(), "pid")
	require.NoError(t, err)

	uerr := UnshareAfterEnterUserns("0:1000:10", "0:1000:10", syscall.CLONE_NEWIPC|syscall.CLONE_NEWNET, func(pid int) error {
		netNs, err := getNamespaceInode(pid, "net")
		require.NoError(t, err)
		require.NotEqual(t, currentNetNs, netNs)

		userNs, err := getNamespaceInode(pid, "user")
		require.NoError(t, err)
		require.NotEqual(t, currentUserNs, userNs)

		ipcNs, err := getNamespaceInode(pid, "ipc")
		require.NoError(t, err)
		require.NotEqual(t, currentIpcNs, ipcNs)

		pidNs, err := getNamespaceInode(pid, "pid")
		require.NoError(t, err)
		require.Equal(t, currentPidNs, pidNs)

		data, err := os.ReadFile(fmt.Sprintf("/proc/%d/uid_map", pid))
		require.NoError(t, err)
		require.Equal(t, "         0       1000         10\n", string(data))

		data, err = os.ReadFile(fmt.Sprintf("/proc/%d/gid_map", pid))
		require.NoError(t, err)
		require.Equal(t, "         0       1000         10\n", string(data))

		data, err = os.ReadFile(fmt.Sprintf("/proc/%d/setgroups", pid))
		require.NoError(t, err)
		require.Equal(t, "allow\n", string(data))
		return nil
	})
	require.NoError(t, uerr)
}

func testUnshareAfterEnterUsernsKillPid(t *testing.T) {
	t.Parallel()

	uerr := UnshareAfterEnterUserns("0:1000:1", "0:1000:1", syscall.CLONE_NEWIPC|syscall.CLONE_NEWNET, func(pid int) error {
		proc, err := os.FindProcess(pid)
		if err != nil {
			return fmt.Errorf("failed to find process: %w", err)
		}

		if err := proc.Kill(); err != nil {
			return fmt.Errorf("failed to kill process: %w", err)
		}

		proc.Wait()

		_, err = os.OpenFile(fmt.Sprintf("/proc/%d/ns/net", pid), os.O_RDONLY, 0600)
		require.Error(t, err)
		require.ErrorIs(t, err, os.ErrNotExist)
		return err
	})
	require.Error(t, uerr)
	require.ErrorIs(t, uerr, os.ErrNotExist)

	uerr = UnshareAfterEnterUserns("0:1000:1", "0:1000:1", syscall.CLONE_NEWIPC|syscall.CLONE_NEWNET, func(pid int) error {
		proc, err := os.FindProcess(pid)
		if err != nil {
			return fmt.Errorf("failed to find process: %w", err)
		}

		if err := proc.Kill(); err != nil {
			return fmt.Errorf("failed to kill process: %w", err)
		}

		proc.Wait()

		return nil
	})
	require.Error(t, uerr)
	require.ErrorContains(t, uerr, "failed to ensure child process is alive: no such process")
}

func testUnshareAfterEnterUsernsInvalidFlags(t *testing.T) {
	t.Parallel()

	uerr := UnshareAfterEnterUserns("0:1000:1", "0:1000:1", syscall.CLONE_IO, nil)
	require.Error(t, uerr)
	require.ErrorContains(t, uerr, "fork/exec /proc/self/exe: invalid argument")
}

func testUnshareAfterEnterUsernsOwnership(t *testing.T) {
	t.Parallel()

	uerr := UnshareAfterEnterUserns("0:1000:1", "0:1000:1", syscall.CLONE_NEWIPC, func(pid int) error {
		nsPath := fmt.Sprintf("/proc/%d/ns/user", pid)
		nsFile, err := os.OpenFile(nsPath, os.O_RDONLY, 0)
		if err != nil {
			return fmt.Errorf("failed to open user namespace: %w", err)
		}
		defer nsFile.Close()

		ownerUID, err := unix.IoctlGetUint32(int(nsFile.Fd()), unix.NS_GET_OWNER_UID)
		if err != nil {
			return fmt.Errorf("NS_GET_OWNER_UID ioctl failed: %w", err)
		}

		require.Equal(t, uint32(1000), ownerUID, "user namespace should be owned by mapped host UID")

		return nil
	})
	require.NoError(t, uerr)
}

func getNamespaceInode(pid int, typ string) (uint64, error) {
	info, err := os.Stat(fmt.Sprintf("/proc/%d/ns/%s", pid, typ))
	if err != nil {
		return 0, err
	}

	return info.Sys().(*syscall.Stat_t).Ino, nil
}