diff options
author | Michael Hudson-Doyle <michael.hudson@canonical.com> | 2015-11-26 11:47:32 +1300 |
---|---|---|
committer | Michael Hudson-Doyle <michael.hudson@canonical.com> | 2015-11-25 23:31:47 +0000 |
commit | 21efa7b2bc872958bcb252f5ab4dc52b2b0abeae (patch) | |
tree | c2180f4b644bc0c271a03630b0c09ff000b526d9 /src/syscall/exec_linux_test.go | |
parent | 240144a3a3e2ea142abbc87aac6e4f48f2e32e2d (diff) | |
download | go-21efa7b2bc872958bcb252f5ab4dc52b2b0abeae.tar.gz go-21efa7b2bc872958bcb252f5ab4dc52b2b0abeae.zip |
syscall: skip tests that create a user namespace when chrooted
The kernel rejects attempts to create user namespaces when in a chroot.
Change-Id: I6548302732c8f5be52f4167cd7233aea16839ad8
Reviewed-on: https://go-review.googlesource.com/17214
Reviewed-by: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Diffstat (limited to 'src/syscall/exec_linux_test.go')
-rw-r--r-- | src/syscall/exec_linux_test.go | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/src/syscall/exec_linux_test.go b/src/syscall/exec_linux_test.go index cca3812a9e..6d31941184 100644 --- a/src/syscall/exec_linux_test.go +++ b/src/syscall/exec_linux_test.go @@ -15,6 +15,17 @@ import ( "testing" ) +// Check if we are in a chroot by checking if the inode of / is +// different from 2 (there is no better test available to non-root on +// linux). +func isChrooted(t *testing.T) bool { + root, err := os.Stat("/") + if err != nil { + t.Fatalf("cannot stat /: %v", err) + } + return root.Sys().(*syscall.Stat_t).Ino != 2 +} + func whoamiCmd(t *testing.T, uid, gid int, setgroups bool) *exec.Cmd { if _, err := os.Stat("/proc/self/ns/user"); err != nil { if os.IsNotExist(err) { @@ -22,6 +33,12 @@ func whoamiCmd(t *testing.T, uid, gid int, setgroups bool) *exec.Cmd { } t.Fatalf("Failed to stat /proc/self/ns/user: %v", err) } + if isChrooted(t) { + // create_user_ns in the kernel (see + // https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/kernel/user_namespace.c) + // forbids the creation of user namespaces when chrooted. + t.Skip("cannot create user namespaces when chrooted") + } // On some systems, there is a sysctl setting. if os.Getuid() != 0 { data, errRead := ioutil.ReadFile("/proc/sys/kernel/unprivileged_userns_clone") |