-
Notifications
You must be signed in to change notification settings - Fork 2.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
libct/int: add device update test #3000
Conversation
Same in Fedora CI:
I changed the test like this: diff --git a/libcontainer/integration/update_test.go b/libcontainer/integration/update_test.go
index 4a83ed41..0ec1dca1 100644
--- a/libcontainer/integration/update_test.go
+++ b/libcontainer/integration/update_test.go
@@ -69,14 +69,18 @@ func TestUpdateDevices(t *testing.T) {
// Now flip the access permission
isAllowed = !isAllowed
- config.Cgroups.Resources.Devices = []*devices.Rule{
- {
- Type: devices.CharDevice,
- Major: 1,
- Minor: 7,
- Permissions: "rwm",
- Allow: isAllowed,
- },
+ if isAllowed {
+ config.Cgroups.Resources.Devices = []*devices.Rule{
+ {
+ Type: devices.CharDevice,
+ Major: 1,
+ Minor: 7,
+ Permissions: "rwm",
+ Allow: true,
+ },
+ }
+ } else {
+ config.Cgroups.Resources.Devices = []*devices.Rule{}
}
if err := container.Set(*config); err != nil {
t.Fatal(err) and it's still emitting the same warning. |
6ee76ab
to
73dffdf
Compare
Any way I modify the devices list, the warning is here. Modified the test to
|
So I have tried the following ways of modifying device access:
The only method I haven't tried yet is modifying device permissions (say remove/re-add |
This comment has been minimized.
This comment has been minimized.
I think it's easier for you to cherry-pick this test to PR #2986 (or just merge this and then expand this test to cover more cases). |
... and remove the one from tests/integration. The idea is similar to the one for the test case being removed -- try updating device rules many times to make sure we are not leaking eBPF programs after every update/Set(). This is better though as we can really change the device rules every time (which "runc update" can't) and check that the rule is applied. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
73dffdf
to
508f5bf
Compare
@cyphar let me know if you're OK to merge this as is, or is this test totally useless, or there is something else I should address. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. This is a pretty good smoke test and actually exercises the "update" aspect as well, so device rule updates can't be a no-op either.
... and remove the one from tests/integration.
The idea is similar to the one for the test case being removed -- try
updating device rules many times to make sure we are not leaking eBPF
programs after every update/Set(). This is better though as we can
really change the device rules every time (which "runc update" can't)
and check that the rule is applied.
The test works, but I see the following warning (on Fedora 34, cgroup v2):