diff options
| author | Michael Stapelberg <stapelberg@golang.org> | 2024-05-14 10:54:40 +0200 |
|---|---|---|
| committer | Tim King <taking@google.com> | 2024-09-11 22:13:15 +0000 |
| commit | b4086b7c1668716c9a7b565b708ea49e1d35fadc (patch) | |
| tree | 8fca3582799cdd804e4cf2dae84dda7fab5adcef | |
| parent | 6fab4b9a9eccbfdae14bdeb45cd3ae625ae2081e (diff) | |
| download | go-b4086b7c1668716c9a7b565b708ea49e1d35fadc.tar.xz | |
[release-branch.go1.22] syscall: skip TestAmbientCapsUserns when restricted, document
For #67088
Fixes #69366
Change-Id: I42e7a8d02b161187772f147e3e136ab6e0f71d7f
Reviewed-on: https://go-review.googlesource.com/c/go/+/585059
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
(cherry picked from commit d05af626956af449fb13815cef06b606bc7740c6)
Reviewed-on: https://go-review.googlesource.com/c/go/+/612475
| -rw-r--r-- | src/syscall/exec_linux.go | 4 | ||||
| -rw-r--r-- | src/syscall/exec_linux_test.go | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/src/syscall/exec_linux.go b/src/syscall/exec_linux.go index e6d6343ed8..e4b9ce1bf4 100644 --- a/src/syscall/exec_linux.go +++ b/src/syscall/exec_linux.go @@ -53,6 +53,10 @@ const ( // SysProcIDMap holds Container ID to Host ID mappings used for User Namespaces in Linux. // See user_namespaces(7). +// +// Note that User Namespaces are not available on a number of popular Linux +// versions (due to security issues), or are available but subject to AppArmor +// restrictions like in Ubuntu 24.04. type SysProcIDMap struct { ContainerID int // Container ID. HostID int // Host ID. diff --git a/src/syscall/exec_linux_test.go b/src/syscall/exec_linux_test.go index 68ec6fe3f8..728f10b241 100644 --- a/src/syscall/exec_linux_test.go +++ b/src/syscall/exec_linux_test.go @@ -642,6 +642,10 @@ func TestAmbientCaps(t *testing.T) { } func TestAmbientCapsUserns(t *testing.T) { + b, err := os.ReadFile("/proc/sys/kernel/apparmor_restrict_unprivileged_userns") + if err == nil && strings.TrimSpace(string(b)) == "1" { + t.Skip("AppArmor restriction for unprivileged user namespaces is enabled") + } testAmbientCaps(t, true) } |