Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2025-12-08 06:10:04 +00:00
Code Issues Projects Releases Packages Wiki Activity

syscall: skip non-root user namespace test if kernel forbids

Browse source 
Some Linux kernels apparently have a sysctl that prohibits
nonprivileged processes from creating user namespaces.  If we see a
failure for that reason, skip the test.

Fixes #11261.

Change-Id: I82dfcaf475eea4eaa387941373ce7165df4848ad
Reviewed-on: https://go-review.googlesource.com/11269
Reviewed-by: Mikio Hara <mikioh.mikioh@gmail.com>
This commit is contained in:
Ian Lance Taylor 2015-06-19 13:48:06 -07:00
parent 2f2908bec3
commit 79d4d6eca4
1 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

10
src/syscall/exec_linux_test.go
View file

@ -42,6 +42,14 @@ func testNEWUSERRemap(t *testing.T, uid, gid int, setgroups bool) {
cmd := whoamiCmd(t, uid, gid, setgroups) cmd := whoamiCmd(t, uid, gid, setgroups)
out, err := cmd.CombinedOutput() out, err := cmd.CombinedOutput()
if err != nil { if err != nil {
// On some systems, there is a sysctl setting.
if os.IsPermission(err) && os.Getuid() != 0 {
data, errRead := ioutil.ReadFile("/proc/sys/kernel/unprivileged_userns_clone")
if errRead == nil && data[0] == '0' {
t.Skip("kernel prohibits user namespace in unprivileged process")
}
}
t.Fatalf("Cmd failed with err %v, output: %s", err, out) t.Fatalf("Cmd failed with err %v, output: %s", err, out)
} }
sout := strings.TrimSpace(string(out)) sout := strings.TrimSpace(string(out))
@ -97,7 +105,7 @@ func TestCloneNEWUSERAndRemapNoRootSetgroupsEnableSetgroups(t *testing.T) {
if err == nil { if err == nil {
t.Skip("probably old kernel without security fix") t.Skip("probably old kernel without security fix")
} }
if !strings.Contains(err.Error(), "operation not permitted") { if !os.IsPermission(err) {
t.Fatalf("Unprivileged gid_map rewriting with GidMappingsEnableSetgroups must fail") t.Fatalf("Unprivileged gid_map rewriting with GidMappingsEnableSetgroups must fail")
} }
} }