Commit graph

2 commits

Author SHA1 Message Date
Ian Lance Taylor
6b24da6ae8 syscall: skip TestCloneNEWUSERAndRemapNoRootDisableSetgroups before 3.19
The test fails on Ubuntu Trusty for some reason, probably because of
some set of kernel patches.

Change-Id: I52f7ca50b96fea5725817c9e9198860d419f9313
Reviewed-on: https://go-review.googlesource.com/11055
Reviewed-by: Mikio Hara <mikioh.mikioh@gmail.com>
2015-06-14 01:52:54 +00:00
Alexander Morozov
f5c60ff2da syscall: add GidMappingsEnableSetgroups to Linux SysProcAttr
Linux 3.19 made a change in the handling of setgroups and the 'gid_map' file to
address a security issue.
The upshot of the 3.19 changes is that in order to update the 'gid_maps' file,
use of the setgroups() system call in this user namespace must first be disabled
by writing "deny" to one of the /proc/PID/setgroups files for this namespace.

Also added tests for remapping uid_map and gid_map inside new user
namespace.

Fixes #10626

Change-Id: I4d2539acbab741a37092d277e10f31fc39a8feb7
Reviewed-on: https://go-review.googlesource.com/10670
Run-TryBot: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
2015-06-12 23:38:59 +00:00