qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-23 15:20:03 -07:00
Code Releases Activity

syscall: skip non-root user namespace test if kernel forbids

Browse Source 
The unprivileged_userns_clone sysctl prevents unpriviledged users from
creating namespaces, which the AmbientCaps test does. It's set to 0 by
default in a few Linux distributions (Debian and Arch, possibly
others), so we need to check it before running the test.

I've verified that setting

  echo 1 > /proc/sys/kernel/unprivileged_userns_clone

and then running the test *without this patch* makes it pass, which
proves that checking unprivileged_userns_clone is indeed sufficient.

Fixes #30698

Change-Id: Ib2079b5e714d7f2440ddf979c3e7cfda9a9c5005
Reviewed-on: https://go-review.googlesource.com/c/go/+/166460
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
This commit is contained in:
Alberto Donizetti 2019-03-09 18:01:26 +01:00 committed by Brad Fitzpatrick
parent e2dc41b490
commit 1c2d4da10f
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/syscall/exec_linux_test.go
View File

@ -539,6 +539,13 @@ func testAmbientCaps(t *testing.T, userns bool) {
t.Skip("skipping test on Kubernetes-based builders; see Issue 12815") t.Skip("skipping test on Kubernetes-based builders; see Issue 12815")
} }
// Skip the test if the sysctl that prevents unprivileged user
// from creating user namespaces is enabled.
data, errRead := ioutil.ReadFile("/proc/sys/kernel/unprivileged_userns_clone")
if errRead == nil && data[0] == '0' {
t.Skip("kernel prohibits user namespace in unprivileged process")
}
// skip on android, due to lack of lookup support // skip on android, due to lack of lookup support
if runtime.GOOS == "android" { if runtime.GOOS == "android" {
t.Skip("skipping test on android; see Issue 27327") t.Skip("skipping test on android; see Issue 27327")