[PATCH v2 00/14] Improved tool for testing across multiple namespaces
This series extends the "nsholder" tool we use in the tests to "nstool" with some more features. In particular it allows entering an established namespace with capabilities intact, and it allows entering them with less verbose options than nsenter. For now this only gives a modest simplification of the tests, but it should enable more in future. I haven't managed to get all the way through the testsuite with this: it's wedging in the IPv4 UDP throughput tests, but that's happening for me with the main branch too. I'll debug that, but I don't want to delay this series on that for now. Changes since v1: * Fixed a bunch of bad indentation from a bad copy/paste * Assorted minor cleanups based on review from Stefano David Gibson (14): nstool: Rename nsholder to nstool nstool: Reverse parameters to nstool nstool: Move description of its operation modes from comment to usage nstool: Split some command line parsing and socket setup to subcommands nstool: Replace "pid" subcommand with "info" subcommand nstool: Detect what namespaces target is in nstool: Add magic number to advertized information nstool: Helpers to iterate through namespace types nstool: Add nstool exec command to execute commands in an nstool namespace nstool: Add --keep-caps option to nstool exec test: Initialise ${TRACE} properly test: Use "nstool exec" to slightly simplify tests nstool: Advertise the holder's cwd (in its mountns) across the socket nstool: Enter holder's cwd when changing mount ns with nstool exec test/.gitignore | 2 +- test/Makefile | 4 +- test/lib/context | 14 +- test/lib/setup | 49 ++-- test/nsholder.c | 139 ------------ test/nstool.c | 565 +++++++++++++++++++++++++++++++++++++++++++++++ test/run | 5 +- 7 files changed, 602 insertions(+), 176 deletions(-) delete mode 100644 test/nsholder.c create mode 100644 test/nstool.c -- 2.39.2
In preparation for extending what it does.
Signed-off-by: David Gibson
Having the "subcommand" first is more conventional and will make it more
natural for future extensions I have planned.
Signed-off-by: David Gibson
Easier to see it there.
Signed-off-by: David Gibson
This will make it easier to differentiate the options to those commands
further in future.
Signed-off-by: David Gibson
The new subcommand gives more information about the holder process and its
namespace, and may be further extended in future. Add some options which
give the old behaviour for existing scripts.
Signed-off-by: David Gibson
Give nstool the ability to detect what namespaces the target process is in,
relative to where it's called. That is, those namespace types for which
the target is not in the same namespace as the caller. For now, just
print this information with "info", which can be useful for debugging.
Signed-off-by: David Gibson
So that we'll probably give a better error if you point it at something
that's not an nstool hold control socket.
Signed-off-by: David Gibson
Will make things a bit less verbose in future.
Signed-off-by: David Gibson
This combines nstool info -pw <sock> with nsenter with various options for
a more convenient and less verbose of entering existing nstool managed
namespaces.
Signed-off-by: David Gibson
This allows you to run commands within a user namespace with the
privilege that comes from owning that userns.
Signed-off-by: David Gibson
Unlike ${DEBUG} we don't initialize ${TRACE} to 0 if not set, which cases
failures when testing it later. That failure acts as though it is false,
however it emits spurious errors in script.log, which can make it harder to
spot real errors.
Signed-off-by: David Gibson
Using this, rather than using "nstool info" to get the pid then manually
connecting with nsenter makes things a little simpler.
Signed-off-by: David Gibson
This is possible useful in nstool info and has further uses for nstool
exec.
Signed-off-by: David Gibson
If we enter a mount namespace with nstool exec our working directory will
be changed to / in the new mount ns. This is surprising if we haven't
actually altered any mounts yet in the new ns. Instead, change the working
directory to match that of the holder process in this situation.
Signed-off-by: David Gibson
On Thu, 6 Apr 2023 13:28:05 +1000
David Gibson
This series extends the "nsholder" tool we use in the tests to "nstool" with some more features. In particular it allows entering an established namespace with capabilities intact, and it allows entering them with less verbose options than nsenter.
For now this only gives a modest simplification of the tests, but it should enable more in future.
I haven't managed to get all the way through the testsuite with this: it's wedging in the IPv4 UDP throughput tests, but that's happening for me with the main branch too. I'll debug that, but I don't want to delay this series on that for now.
Changes since v1: * Fixed a bunch of bad indentation from a bad copy/paste * Assorted minor cleanups based on review from Stefano
David Gibson (14): nstool: Rename nsholder to nstool nstool: Reverse parameters to nstool nstool: Move description of its operation modes from comment to usage nstool: Split some command line parsing and socket setup to subcommands nstool: Replace "pid" subcommand with "info" subcommand nstool: Detect what namespaces target is in nstool: Add magic number to advertized information nstool: Helpers to iterate through namespace types nstool: Add nstool exec command to execute commands in an nstool namespace nstool: Add --keep-caps option to nstool exec test: Initialise ${TRACE} properly test: Use "nstool exec" to slightly simplify tests nstool: Advertise the holder's cwd (in its mountns) across the socket nstool: Enter holder's cwd when changing mount ns with nstool exec
Pushed, thanks. -- Stefano
participants (2)
-
David Gibson
-
Stefano Brivio