bug#21226: FAIL: tests/containers.scm

bug#21226: FAIL: tests/containers.scm

[Jochem Raat]

[-- Attachment #1: Type: text/plain, Size: 307 bytes --]

During the running of make check on the guix 0.8.3 source tarball,
test/containers.scm failed. I don't know enough about guix to understand
why, but the manual said to report it to this email-adress. Please tell
me if you need me to do more tests.

Attached are the test-suite.log and containers.log.

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: test-suite.log --]
[-- Type: text/x-log; name="test-suite.log", Size: 2395 bytes --]

======================================
   GNU Guix 0.8.3: ./test-suite.log
======================================

# TOTAL: 44
# PASS:  43
# SKIP:  0
# XFAIL: 0
# FAIL:  1
# XPASS: 0
# ERROR: 0

.. contents:: :depth: 2

FAIL: tests/containers
======================

%%%% Starting test containers  (Writing full log to "containers.log")
tests/containers.scm:35: FAIL call-with-container, user namespace
tests/containers.scm:43: FAIL call-with-container, uts namespace
tests/containers.scm:53: FAIL call-with-container, pid namespace
tests/containers.scm:68: FAIL call-with-container, mnt namespace
%%%% Starting test containers  (Writing full log to "containers.log")
tests/containers.scm:35: FAIL call-with-container, user namespace
tests/containers.scm:43: FAIL call-with-container, uts namespace
tests/containers.scm:53: FAIL call-with-container, pid namespace
tests/containers.scm:68: FAIL call-with-container, mnt namespace
tests/containers.scm:75: FAIL call-with-container, all namespaces
tests/containers.scm:81: FAIL container-excursion
# of unexpected failures  6
%%%% Starting test containers  (Writing full log to "containers.log")
tests/containers.scm:35: FAIL call-with-container, user namespace
tests/containers.scm:43: FAIL call-with-container, uts namespace
tests/containers.scm:53: FAIL call-with-container, pid namespace
tests/containers.scm:68: FAIL call-with-container, mnt namespace
tests/containers.scm:75: FAIL call-with-container, all namespaces
%%%% Starting test containers  (Writing full log to "containers.log")
tests/containers.scm:35: FAIL call-with-container, user namespace
tests/containers.scm:43: FAIL call-with-container, uts namespace
tests/containers.scm:53: FAIL call-with-container, pid namespace
%%%% Starting test containers  (Writing full log to "containers.log")
tests/containers.scm:35: FAIL call-with-container, user namespace
tests/containers.scm:43: FAIL call-with-container, uts namespace
%%%% Starting test containers  (Writing full log to "containers.log")
tests/containers.scm:35: FAIL call-with-container, user namespace
tests/containers.scm:43: FAIL call-with-container, uts namespace
%%%% Starting test containers  (Writing full log to "containers.log")
tests/containers.scm:35: FAIL call-with-container, user namespace
%%%% Starting test containers  (Writing full log to "containers.log")


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #3: containers.log --]
[-- Type: text/x-log; name="containers.log", Size: 16018 bytes --]

%%%% Starting test containers
Group begin: containers
Test begin:
  test-name: "call-with-container, user namespace"
  source-file: "tests/containers.scm"
  source-line: 35
  source-form: (test-assert "call-with-container, user namespace" (zero? (call-with-container (quote ()) (lambda () (assert-exit (and (zero? (getuid)) (zero? (getgid))))) #:namespaces (quote (user)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12229/setgroups") (2))
Test begin:
  test-name: "call-with-container, uts namespace"
  source-file: "tests/containers.scm"
  source-line: 43
  source-form: (test-assert "call-with-container, uts namespace" (zero? (call-with-container (quote ()) (lambda () (sethostname "test-container") (primitive-exit 0)) #:namespaces (quote (user uts)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12230/setgroups") (2))
Test begin:
  test-name: "call-with-container, pid namespace"
  source-file: "tests/containers.scm"
  source-line: 53
  source-form: (test-assert "call-with-container, pid namespace" (zero? (call-with-container (quote ()) (lambda () (match (primitive-fork) (0 (assert-exit (= 2 (getpid)))) (pid (primitive-exit (match (waitpid pid) ((_ . status) (status:exit-val status))))))) #:namespaces (quote (user pid)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12237/setgroups") (2))
Test begin:
  test-name: "call-with-container, mnt namespace"
  source-file: "tests/containers.scm"
  source-line: 68
  source-form: (test-assert "call-with-container, mnt namespace" (zero? (call-with-container (quote (("none" device "/testing" "tmpfs" () #f #f))) (lambda () (assert-exit (file-exists? "/testing"))) #:namespaces (quote (user mnt)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12242/setgroups") (2))
Test begin:
  test-name: "call-with-container, all namespaces"
  source-file: "tests/containers.scm"
  source-line: 75
  source-form: (test-assert "call-with-container, all namespaces" (zero? (call-with-container (quote ()) (lambda () (primitive-exit 0)))))
%%%% Starting test containers
Group begin: containers
Test begin:
  test-name: "call-with-container, user namespace"
  source-file: "tests/containers.scm"
  source-line: 35
  source-form: (test-assert "call-with-container, user namespace" (zero? (call-with-container (quote ()) (lambda () (assert-exit (and (zero? (getuid)) (zero? (getgid))))) #:namespaces (quote (user)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12229/setgroups") (2))
Test begin:
  test-name: "call-with-container, uts namespace"
  source-file: "tests/containers.scm"
  source-line: 43
  source-form: (test-assert "call-with-container, uts namespace" (zero? (call-with-container (quote ()) (lambda () (sethostname "test-container") (primitive-exit 0)) #:namespaces (quote (user uts)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12230/setgroups") (2))
Test begin:
  test-name: "call-with-container, pid namespace"
  source-file: "tests/containers.scm"
  source-line: 53
  source-form: (test-assert "call-with-container, pid namespace" (zero? (call-with-container (quote ()) (lambda () (match (primitive-fork) (0 (assert-exit (= 2 (getpid)))) (pid (primitive-exit (match (waitpid pid) ((_ . status) (status:exit-val status))))))) #:namespaces (quote (user pid)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12237/setgroups") (2))
Test begin:
  test-name: "call-with-container, mnt namespace"
  source-file: "tests/containers.scm"
  source-line: 68
  source-form: (test-assert "call-with-container, mnt namespace" (zero? (call-with-container (quote (("none" device "/testing" "tmpfs" () #f #f))) (lambda () (assert-exit (file-exists? "/testing"))) #:namespaces (quote (user mnt)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12242/setgroups") (2))
Test begin:
  test-name: "call-with-container, all namespaces"
  source-file: "tests/containers.scm"
  source-line: 75
  source-form: (test-assert "call-with-container, all namespaces" (zero? (call-with-container (quote ()) (lambda () (primitive-exit 0)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12250/setgroups") (2))
Test begin:
  test-name: "container-excursion"
  source-file: "tests/containers.scm"
  source-line: 81
  source-form: (test-assert "container-excursion" (call-with-temporary-directory (lambda (root) (match (list (pipe) (pipe)) (((start-in . start-out) (end-in . end-out)) (define (container) (close end-out) (close start-in) (write (quote ready) start-out) (close start-out) (read end-in) (close end-in)) (define (namespaces pid) (let ((pid (number->string pid))) (map (lambda (ns) (readlink (string-append "/proc/" pid "/ns/" ns))) (quote ("user" "ipc" "uts" "net" "pid" "mnt"))))) (let* ((pid (run-container root (quote ()) %namespaces container)) (container-namespaces (namespaces pid)) (result (begin (close start-out) (read start-in) (close start-in) (container-excursion pid (lambda () (match (primitive-fork) (0 (assert-exit (equal? container-namespaces (namespaces (getpid))))) (fork-pid (match (waitpid fork-pid) ((_ . status) (primitive-exit (status:exit-val status))))))))))) (close end-in) (write (quote done) end-out) (close end-out) (waitpid pid) (zero? result)))))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12254/setgroups") (2))
Group end: containers
# of unexpected failures  6
%%%% Starting test containers
Group begin: containers
Test begin:
  test-name: "call-with-container, user namespace"
  source-file: "tests/containers.scm"
  source-line: 35
  source-form: (test-assert "call-with-container, user namespace" (zero? (call-with-container (quote ()) (lambda () (assert-exit (and (zero? (getuid)) (zero? (getgid))))) #:namespaces (quote (user)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12229/setgroups") (2))
Test begin:
  test-name: "call-with-container, uts namespace"
  source-file: "tests/containers.scm"
  source-line: 43
  source-form: (test-assert "call-with-container, uts namespace" (zero? (call-with-container (quote ()) (lambda () (sethostname "test-container") (primitive-exit 0)) #:namespaces (quote (user uts)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12230/setgroups") (2))
Test begin:
  test-name: "call-with-container, pid namespace"
  source-file: "tests/containers.scm"
  source-line: 53
  source-form: (test-assert "call-with-container, pid namespace" (zero? (call-with-container (quote ()) (lambda () (match (primitive-fork) (0 (assert-exit (= 2 (getpid)))) (pid (primitive-exit (match (waitpid pid) ((_ . status) (status:exit-val status))))))) #:namespaces (quote (user pid)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12237/setgroups") (2))
Test begin:
  test-name: "call-with-container, mnt namespace"
  source-file: "tests/containers.scm"
  source-line: 68
  source-form: (test-assert "call-with-container, mnt namespace" (zero? (call-with-container (quote (("none" device "/testing" "tmpfs" () #f #f))) (lambda () (assert-exit (file-exists? "/testing"))) #:namespaces (quote (user mnt)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12242/setgroups") (2))
Test begin:
  test-name: "call-with-container, all namespaces"
  source-file: "tests/containers.scm"
  source-line: 75
  source-form: (test-assert "call-with-container, all namespaces" (zero? (call-with-container (quote ()) (lambda () (primitive-exit 0)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12250/setgroups") (2))
Test begin:
  test-name: "container-excursion"
  source-file: "tests/containers.scm"
  source-line: 81
  source-form: (test-assert "container-excursion" (call-with-temporary-directory (lambda (root) (match (list (pipe) (pipe)) (((start-in . start-out) (end-in . end-out)) (define (container) (close end-out) (close start-in) (write (quote ready) start-out) (close start-out) (read end-in) (close end-in)) (define (namespaces pid) (let ((pid (number->string pid))) (map (lambda (ns) (readlink (string-append "/proc/" pid "/ns/" ns))) (quote ("user" "ipc" "uts" "net" "pid" "mnt"))))) (let* ((pid (run-container root (quote ()) %namespaces container)) (container-namespaces (namespaces pid)) (result (begin (close start-out) (read start-in) (close start-in) (container-excursion pid (lambda () (match (primitive-fork) (0 (assert-exit (equal? container-namespaces (namespaces (getpid))))) (fork-pid (match (waitpid fork-pid) ((_ . status) (primitive-exit (status:exit-val status))))))))))) (close end-in) (write (quote done) end-out) (close end-out) (waitpid pid) (zero? result)))))))
%%%% Starting test containers
Group begin: containers
Test begin:
  test-name: "call-with-container, user namespace"
  source-file: "tests/containers.scm"
  source-line: 35
  source-form: (test-assert "call-with-container, user namespace" (zero? (call-with-container (quote ()) (lambda () (assert-exit (and (zero? (getuid)) (zero? (getgid))))) #:namespaces (quote (user)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12229/setgroups") (2))
Test begin:
  test-name: "call-with-container, uts namespace"
  source-file: "tests/containers.scm"
  source-line: 43
  source-form: (test-assert "call-with-container, uts namespace" (zero? (call-with-container (quote ()) (lambda () (sethostname "test-container") (primitive-exit 0)) #:namespaces (quote (user uts)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12230/setgroups") (2))
Test begin:
  test-name: "call-with-container, pid namespace"
  source-file: "tests/containers.scm"
  source-line: 53
  source-form: (test-assert "call-with-container, pid namespace" (zero? (call-with-container (quote ()) (lambda () (match (primitive-fork) (0 (assert-exit (= 2 (getpid)))) (pid (primitive-exit (match (waitpid pid) ((_ . status) (status:exit-val status))))))) #:namespaces (quote (user pid)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12237/setgroups") (2))
Test begin:
  test-name: "call-with-container, mnt namespace"
  source-file: "tests/containers.scm"
  source-line: 68
  source-form: (test-assert "call-with-container, mnt namespace" (zero? (call-with-container (quote (("none" device "/testing" "tmpfs" () #f #f))) (lambda () (assert-exit (file-exists? "/testing"))) #:namespaces (quote (user mnt)))))
%%%% Starting test containers
Group begin: containers
Test begin:
  test-name: "call-with-container, user namespace"
  source-file: "tests/containers.scm"
  source-line: 35
  source-form: (test-assert "call-with-container, user namespace" (zero? (call-with-container (quote ()) (lambda () (assert-exit (and (zero? (getuid)) (zero? (getgid))))) #:namespaces (quote (user)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12229/setgroups") (2))
Test begin:
  test-name: "call-with-container, uts namespace"
  source-file: "tests/containers.scm"
  source-line: 43
  source-form: (test-assert "call-with-container, uts namespace" (zero? (call-with-container (quote ()) (lambda () (sethostname "test-container") (primitive-exit 0)) #:namespaces (quote (user uts)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12230/setgroups") (2))
Test begin:
  test-name: "call-with-container, pid namespace"
  source-file: "tests/containers.scm"
  source-line: 53
  source-form: (test-assert "call-with-container, pid namespace" (zero? (call-with-container (quote ()) (lambda () (match (primitive-fork) (0 (assert-exit (= 2 (getpid)))) (pid (primitive-exit (match (waitpid pid) ((_ . status) (status:exit-val status))))))) #:namespaces (quote (user pid)))))
%%%% Starting test containers
Group begin: containers
Test begin:
  test-name: "call-with-container, user namespace"
  source-file: "tests/containers.scm"
  source-line: 35
  source-form: (test-assert "call-with-container, user namespace" (zero? (call-with-container (quote ()) (lambda () (assert-exit (and (zero? (getuid)) (zero? (getgid))))) #:namespaces (quote (user)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12229/setgroups") (2))
Test begin:
  test-name: "call-with-container, uts namespace"
  source-file: "tests/containers.scm"
  source-line: 43
  source-form: (test-assert "call-with-container, uts namespace" (zero? (call-with-container (quote ()) (lambda () (sethostname "test-container") (primitive-exit 0)) #:namespaces (quote (user uts)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12230/setgroups") (2))
Test begin:
  test-name: "call-with-container, pid namespace"
  source-file: "tests/containers.scm"
  source-line: 53
  source-form: (test-assert "call-with-container, pid namespace" (zero? (call-with-container (quote ()) (lambda () (match (primitive-fork) (0 (assert-exit (= 2 (getpid)))) (pid (primitive-exit (match (waitpid pid) ((_ . status) (status:exit-val status))))))) #:namespaces (quote (user pid)))))
%%%% Starting test containers
Group begin: containers
Test begin:
  test-name: "call-with-container, user namespace"
  source-file: "tests/containers.scm"
  source-line: 35
  source-form: (test-assert "call-with-container, user namespace" (zero? (call-with-container (quote ()) (lambda () (assert-exit (and (zero? (getuid)) (zero? (getgid))))) #:namespaces (quote (user)))))
Test end:
  result-kind: fail
  actual-value: #f
  actual-error: (system-error "open-file" "~A: ~S" ("No such file or directory" "/proc/12229/setgroups") (2))
Test begin:
  test-name: "call-with-container, uts namespace"
  source-file: "tests/containers.scm"
  source-line: 43
  source-form: (test-assert "call-with-container, uts namespace" (zero? (call-with-container (quote ()) (lambda () (sethostname "test-container") (primitive-exit 0)) #:namespaces (quote (user uts)))))
%%%% Starting test containers
Group begin: containers
Test begin:
  test-name: "call-with-container, user namespace"
  source-file: "tests/containers.scm"
  source-line: 35
  source-form: (test-assert "call-with-container, user namespace" (zero? (call-with-container (quote ()) (lambda () (assert-exit (and (zero? (getuid)) (zero? (getgid))))) #:namespaces (quote (user)))))

bug#21226: FAIL: tests/containers.scm

[Thompson, David]

[ Forgot to "Reply All".  Re-sending to bug tracker ]

On Mon, Aug 10, 2015 at 4:23 AM, Jochem Raat <jchmrt@riseup.net> wrote:
> On 10-08-15 02:10, Thompson, David wrote:
>> Hello Jochem,
>>
>> Thanks for the report.  I've done some work to fix these in our
>> master, but perhaps you have a situation that I haven't addressed.
>> The container functionality requires a relatively recent version (3.8,
>> I think) of Linux in order to work.
>>
>> What version of Linux are you using?
>
> I think I am running linux 3.13 ('uname -r' returns: 3.13.0-30-generic).
>
>> What is the output of 'ls -l /proc/self/ns'?
>
> 'ls -l /proc/self/ns' returns:
> total 0
> lrwxrwxrwx 1 jm jm 0 aug 10 10:12 ipc -> ipc:[4026531839]
> lrwxrwxrwx 1 jm jm 0 aug 10 10:12 mnt -> mnt:[4026531840]
> lrwxrwxrwx 1 jm jm 0 aug 10 10:12 net -> net:[4026531956]
> lrwxrwxrwx 1 jm jm 0 aug 10 10:12 pid -> pid:[4026531836]
> lrwxrwxrwx 1 jm jm 0 aug 10 10:12 user -> user:[4026531837]
> lrwxrwxrwx 1 jm jm 0 aug 10 10:12 uts -> uts:[4026531838]
>

Thanks.  So, you have a new enough kernel for all 6 user namespaces to
work but the 'setgroups' interface is not present.  I did some reading
in the user_namespaces(7) man page and found that using setgroups
became a requirement in Linux 3.19 and only kernels may not have it. I
took a look at an Ubuntu 14.04 machine which also runs a 3.13 kernel
and /proc/self/setgroups exists, so indeed it is an optional thing.
The fix will be to test if /proc/self/setgroups exists before writing
to it.  I'll have this fixed next time I get a chance to hack.

Thanks again for reporting this issue!

- Dave

bug#21226: FAIL: tests/containers.scm

[Thompson, David]

Hello Jochem,

On Sun, Aug 9, 2015 at 4:12 PM, Jochem Raat <jchmrt@riseup.net> wrote:
> During the running of make check on the guix 0.8.3 source tarball,
> test/containers.scm failed. I don't know enough about guix to understand
> why, but the manual said to report it to this email-adress. Please tell
> me if you need me to do more tests.
>
> Attached are the test-suite.log and containers.log.

Fixed in commit bc459b6, which skips the tests if /proc/self/setgroups
does not exist, rather than allowing a system with a vulnerable kernel
create containers with a new user namespace.

I would like to note that you should update your kernel as soon as
possible, as the lack of /proc/self/setgroups means that you are
running a kernel with a known security vulnerability.  The fix was
introduced in Linux 3.19, but backported to many older kernels,
including 3.13.

Thanks,

- Dave

bug#21226: FAIL: tests/containers.scm

[Jochem Raat]

On 11-08-15 14:41, Thompson, David wrote:
> 
> Fixed in commit bc459b6, which skips the tests if /proc/self/setgroups
> does not exist, rather than allowing a system with a vulnerable kernel
> create containers with a new user namespace.

Thanks for the fast response and fix!

> 
> I would like to note that you should update your kernel as soon as
> possible, as the lack of /proc/self/setgroups means that you are
> running a kernel with a known security vulnerability.  The fix was
> introduced in Linux 3.19, but backported to many older kernels,
> including 3.13.

Thanks for the advice, I have updated my kernel.