aboutsummaryrefslogtreecommitdiff
path: root/src/syscall/exec_linux_test.go
AgeCommit message (Collapse)Author
2023-06-14all: fix spelling errorsAlexander Yastrebov
Fix spelling errors discovered using https://github.com/codespell-project/codespell. Errors in data files and vendored packages are ignored. Change-Id: I83c7818222f2eea69afbd270c15b7897678131dc GitHub-Last-Rev: 3491615b1b82832cc0064f535786546e89aa6184 GitHub-Pull-Request: golang/go#60758 Reviewed-on: https://go-review.googlesource.com/c/go/+/502576 Auto-Submit: Michael Pratt <mpratt@google.com> Run-TryBot: Michael Pratt <mpratt@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Michael Pratt <mpratt@google.com>
2023-03-15internal/testenv, syscall: move isNotSupported to internal/testenvTobias Klauser
This allows to use this helper function in packages other than syscall, namely package net. For #58114 Change-Id: I72c59ab013e9195801ff1315019ae1aef4396287 Reviewed-on: https://go-review.googlesource.com/c/go/+/476216 Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Cherry Mui <cherryyz@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Bryan Mills <bcmills@google.com>
2023-03-15syscall: handle errors.ErrUnsupported in isNotSupportedTobias Klauser
Updates #41198 Change-Id: Ifed913f6088b77abc7a21d2a79168a20799f9d0e Reviewed-on: https://go-review.googlesource.com/c/go/+/475857 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com>
2023-03-13syscall: use clone3 syscall with CLONE_NEWTIMETobias Klauser
CLONE_NEWTIME can only be used with the clone3 and unshare system calls, see https://github.com/torvalds/linux/commit/769071ac9f20b6a447410c7eaa55d1a5233ef40c: > All available clone flags have been used, so CLONE_NEWTIME uses the highest > bit of CSIGNAL. It means that it can be used only with the unshare() and > the clone3() system calls. The clone3 syscall was added in Linux kernel version 5.3 and CLONE_NEWTIME was added in version 5.6. However, it was non-functional until version 6.3 (and stable versions with the corresponding fix [1]). [1] https://lore.kernel.org/lkml/20230308105126.10107-1-tklauser@distanz.ch/ In case CLONE_NEWTIME is set in SysProcAttr.Cloneflags on an unsupported kernel version, the fork/exec call will fail. Fixes #49779 Change-Id: Ic3ecfc2b601bafaab12b1805d7f9512955a8c7e2 Reviewed-on: https://go-review.googlesource.com/c/go/+/474356 TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Auto-Submit: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Cherry Mui <cherryyz@google.com>
2023-01-27syscall: avoid making assumptions about syscall permissionsBryan C. Mills
We currently check for at least three different permission bits before running tests that require root permissions: we look for UID 0, lack of an LXC container, and lack of a Docker container, and probe a number of distro-specific files in /proc and /sys. The sheer number of these checks suggests that we have probably missed at least one. Per Alan J. Perlis, “If you have a procedure with ten parameters, you probably missed some.” (And, indeed, we definitely have: a Debian patch¹ adds one more environment check!) CL 58170 added some of these container checks, but “decided to go this way instead of just skipping os.IsPermission errors because many of those tests were specifically written to check false positive permission errors.” However, we can't in general distinguish between a false-positive error and a real one caused by a container: if one is making a change to the syscall package, they should run the tests with -v and check for unexpected skips. Notably: - TestUnshare already skips itself if the command fails with an error ending in the string "operation not permitted", which could be caused by a variety of possible bugs. - The Unshare tests added in CL 38471 will fail with a permission error if CLONE_NEWNS is not supported, but it seems to me that if CLONE_NEWNS is supported — sufficient to start the process! — then Unmount must also be supported, and the test can at least check that the two are consistent. - The AmbientCaps tests should fail to start the subprocess with EINVAL or similar (not produce bogus output) if the kernel does not support ambient caps for any reason, which we can then detect. (If the subprocess fails in the way the test is concerned about, it will exit with status 2, not fail to start in the first place.) By executing the system calls and checking for permission errors, this change exposed an existing bug for AmbientCaps (filed as #57208), which was detected by the linux-arm-aws builder. For #57208. Updates #21379. Updates #14693. ¹https://sources.debian.org/patches/golang-1.19/1.19.3-1/0006-skip-userns-test-in-schroot-as-well.patch/ Change-Id: I9b167661fa1bb823168c8b50d8bbbf9643e49f76 Reviewed-on: https://go-review.googlesource.com/c/go/+/456375 Reviewed-by: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org> Auto-Submit: Bryan Mills <bcmills@google.com> Reviewed-by: Alexander Morozov <lk4d4math@gmail.com> Run-TryBot: Bryan Mills <bcmills@google.com>
2023-01-06syscall: skip TestUseCgroupFD if cgroupfs not mountedShengjing Zhu
When building in schroot (for building Debian package), the cgroupfs is not mounted in schroot (only sysfs is mounted). Change-Id: Ieddac7b2f334d58d832f5d84d81af812badf3720 Reviewed-on: https://go-review.googlesource.com/c/go/+/460539 TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Heschi Kreinick <heschi@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com>
2022-12-12syscall: skip TestUseCgroupFD if cgroupfs mounted ROPaul E. Murphy
The skipping logic should also trigger if /sys/fs/cgroup is mounted read-only too. This is how it is mounted on the ppc64le/p10 containers today. Fixes #57262 Change-Id: Idc0ab050052ebf5777ac09f9519215b437b0ee7c Reviewed-on: https://go-review.googlesource.com/c/go/+/456835 Reviewed-by: Ian Lance Taylor <iant@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Bryan Mills <bcmills@google.com> Auto-Submit: Bryan Mills <bcmills@google.com> Run-TryBot: Paul Murphy <murp@ibm.com>
2022-09-09syscall: add CgroupFD support for ForkExec on LinuxKir Kolyshkin
Implement CLONE_INTO_CGROUP feature, allowing to put a child in a specified cgroup in a clean and simple way. Note that the feature only works for cgroup v2, and requires Linux kernel 5.7 or newer. Using the feature requires a new syscall, clone3. Currently this is the only reason to use clone3, but the code is structured in a way so that other cases may be easily added in the future. Add a test case. While at it, try to simplify the syscall calling code in forkAndExecInChild1, which became complicated over time because: 1. It was using either rawVforkSyscall or RawSyscall6 depending on whether CLONE_NEWUSER was set. 2. On Linux/s390, the first two arguments to clone(2) system call are swapped (which deserved a mention in Linux ABI hall of shame). It was worked around in rawVforkSyscall on s390, but had to be implemented via a switch/case when using RawSyscall6, making the code less clear. Let's - modify rawVforkSyscall to have two arguments (which is also required for clone3); - remove the arguments workaround from s390 asm, instead implementing arguments swap in the caller (which still looks ugly but at least it's done once and is clearly documented now); - use rawVforkSyscall for all cases (since it is essentially similar to RawSyscall6, except for having less parameters, not returning r2, and saving/restoring the return address before/after syscall on 386 and amd64). Updates #51246. Change-Id: Ifcd418ebead9257177338ffbcccd0bdecb94474e Reviewed-on: https://go-review.googlesource.com/c/go/+/417695 Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Michael Knyszek <mknyszek@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Run-TryBot: Kirill Kolyshkin <kolyshkin@gmail.com> TryBot-Result: Gopher Robot <gobot@golang.org>
2022-09-03syscall: fix skipping some tests on LinuxKir Kolyshkin
The kernel knob /proc/sys/kernel/unprivileged_userns_clone is only available in Debian (and Ubuntu) kernels, so if the tests are run on e.g. Fedora, skipUnprivilegedUserClone() skips a lot of tests. Modify it to treat ENOENT as "it should work". Change-Id: I959201ede139ede989cc8ab646c9bf51e0539ada Reviewed-on: https://go-review.googlesource.com/c/go/+/417694 TryBot-Result: Gopher Robot <gobot@golang.org> Auto-Submit: Ian Lance Taylor <iant@google.com> Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com> Run-TryBot: Kirill Kolyshkin <kolyshkin@gmail.com> Reviewed-by: Heschi Kreinick <heschi@google.com> Run-TryBot: Ian Lance Taylor <iant@google.com> Reviewed-by: Ian Lance Taylor <iant@google.com>
2022-03-31syscall: relax output check in TestGroupCleanupUserNamespaceBryan C. Mills
“If you have a procedure with ten parameters, you probably missed some.” ― attr. Alan J. Perlis I argue that the same is true for hard-coded special cases. In TestGroupCleanupUserNamespace, instead of a curated list of strings observed in the wild we now check for a prefix, as was done for TestGroupCleanup in CL 24670. Updates #16224. Updates #16303. Updates #19938. Updates #34547. Updates #46752. Fixes #52088. Change-Id: I59c5b0c048113e306996c0f8247e09c714d2423a Reviewed-on: https://go-review.googlesource.com/c/go/+/397316 Trust: Bryan Mills <bcmills@google.com> Run-TryBot: Bryan Mills <bcmills@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-10-28all: go fix -fix=buildtag std cmd (except for bootstrap deps, vendor)Russ Cox
When these packages are released as part of Go 1.18, Go 1.16 will no longer be supported, so we can remove the +build tags in these files. Ran go fix -fix=buildtag std cmd and then reverted the bootstrapDirs as defined in src/cmd/dist/buildtool.go, which need to continue to build with Go 1.4 for now. Also reverted src/vendor and src/cmd/vendor, which will need to be updated in their own repos first. Manual changes in runtime/pprof/mprof_test.go to adjust line numbers. For #41184. Change-Id: Ic0f93f7091295b6abc76ed5cd6e6746e1280861e Reviewed-on: https://go-review.googlesource.com/c/go/+/344955 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Bryan C. Mills <bcmills@google.com>
2021-10-06all: use bytes.Cut, strings.CutRuss Cox
Many uses of Index/IndexByte/IndexRune/Split/SplitN can be written more clearly using the new Cut functions. Do that. Also rewrite to other functions if that's clearer. For #46336. Change-Id: I68d024716ace41a57a8bf74455c62279bde0f448 Reviewed-on: https://go-review.googlesource.com/c/go/+/351711 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-09-14syscall: remove use of IN_KUBERNETES in testTobias Klauser
CL 201737 dropped the use of IN_KUBERNETES in tests, but it looks like it did not catch all occurrences. For #12815 For #34956 Change-Id: I72b89bfb850ba2890e9e6aa39b87167291ab7e9f Reviewed-on: https://go-review.googlesource.com/c/go/+/349789 Trust: Tobias Klauser <tobias.klauser@gmail.com> Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-06-16syscall: fix TestGroupCleanupUserNamespace test failure on FedoraRahul Bajaj
Fixes #46752 Change-Id: I2eaa9d15fac4e859e18191fcf1372e5be94899df GitHub-Last-Rev: 8a2672d8dc6713ec6cbd207d870e893062c8fe5b GitHub-Pull-Request: golang/go#46753 Reviewed-on: https://go-review.googlesource.com/c/go/+/328109 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
2021-02-20all: go fmt std cmd (but revert vendor)Russ Cox
Make all our package sources use Go 1.17 gofmt format (adding //go:build lines). Part of //go:build change (#41184). See https://golang.org/design/draft-gobuild Change-Id: Ia0534360e4957e58cd9a18429c39d0e32a6addb4 Reviewed-on: https://go-review.googlesource.com/c/go/+/294430 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-12-09all: update to use os.ReadFile, os.WriteFile, os.CreateTemp, os.MkdirTempRuss Cox
As part of #42026, these helpers from io/ioutil were moved to os. (ioutil.TempFile and TempDir became os.CreateTemp and MkdirTemp.) Update the Go tree to use the preferred names. As usual, code compiled with the Go 1.4 bootstrap toolchain and code vendored from other sources is excluded. ReadDir changes are in a separate CL, because they are not a simple search and replace. For #42026. Change-Id: If318df0216d57e95ea0c4093b89f65e5b0ababb3 Reviewed-on: https://go-review.googlesource.com/c/go/+/266365 Trust: Russ Cox <rsc@golang.org> Run-TryBot: Russ Cox <rsc@golang.org> TryBot-Result: Go Bot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2020-05-11syscall: append to environment in tests, don't clobber itIan Lance Taylor
Fixes https://gcc.gnu.org/PR95061 Change-Id: I3cddfe5920b6da572ddeafa201617003c25175e6 Reviewed-on: https://go-review.googlesource.com/c/go/+/233318 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-10-17syscall: remove use of IN_KUBERNETES in test, add a TODO to improve furtherBrad Fitzpatrick
Updates #34956 Change-Id: I35c39f3afda7226eeae0fd6936f7ee0d5d6c025b Reviewed-on: https://go-review.googlesource.com/c/go/+/201737 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Bryan C. Mills <bcmills@google.com> Reviewed-by: Bryan C. Mills <bcmills@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-09-30syscall: fix TestGroupCleanupUserNamespace on CentOSTobias Klauser
Update the list of expected "id" outputs in TestGroupCleanupUserNamespace with SELinux context information as used on CentOS. Fixes #34547 Change-Id: I426bbe2d04e2039c87490362a1891ec3de6e36e0 Reviewed-on: https://go-review.googlesource.com/c/go/+/197841 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-09-19syscall: extend skip criteria for TestAmbientCapsUsernsTobias Klauser
TestAmbientCapsUserns also needs to be skipped, e.g. in case the test is run inside a chroot. Updates #34015 Change-Id: I53913432fe9408217edfe64619adbfd911a51a7a Reviewed-on: https://go-review.googlesource.com/c/go/+/196500 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-09-18syscall: skip TestAmbientCapsUserns if user namespaces are not supportedTobias Klauser
Fixes #34015 Change-Id: I29798fb9c72b6f4bee8aecea96ab13b4cba2e80d Reviewed-on: https://go-review.googlesource.com/c/go/+/195738 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2019-06-06syscall: fix skip condition in skipUnprivilegedUserCloneMeng Zhuo
This is a follow up CL of CL 180877: It will skip test create user namespaces under 3 conditions: 1. sysctl file is missing 2. file reads nothing 3. user don't have permission to create namespaces Change-Id: I25f00a6b67213bf98d654972388637789978e1fe Reviewed-on: https://go-review.googlesource.com/c/go/+/180937 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
2019-06-06syscall: skip test if unprivileged_userns_clone sysctl is missingMeng Zhuo
The original test (CL 166460) didn't check the existence of /proc/sys/kernel/unprivileged_userns_clone and continue the test if the file doesn't exist. Fixes #32459 Change-Id: Iab4938252fcaded32b61e17edf68f966c2565582 Reviewed-on: https://go-review.googlesource.com/c/go/+/180877 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
2019-03-12syscall: correctly set up uid/gid mappings in user namespacesMichael Stapelberg
Before this CL, uid/gid mapping was always set up from the parent process, which is a privileged operation. When using unprivileged user namespaces, a process can modify its uid/gid mapping after the unshare(2) call (but setting the uid/gid mapping from another process is NOT possible). Fixes #29789 Change-Id: I8c96a03f5da23fe80bbb83ef051ad89cf185d750 Reviewed-on: https://go-review.googlesource.com/c/go/+/158298 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2019-03-10syscall: skip non-root user namespace test if kernel forbidsAlberto Donizetti
The unprivileged_userns_clone sysctl prevents unpriviledged users from creating namespaces, which the AmbientCaps test does. It's set to 0 by default in a few Linux distributions (Debian and Arch, possibly others), so we need to check it before running the test. I've verified that setting echo 1 > /proc/sys/kernel/unprivileged_userns_clone and then running the test *without this patch* makes it pass, which proves that checking unprivileged_userns_clone is indeed sufficient. Fixes #30698 Change-Id: Ib2079b5e714d7f2440ddf979c3e7cfda9a9c5005 Reviewed-on: https://go-review.googlesource.com/c/go/+/166460 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2019-03-08syscall: add all ambient capabilities into permitted and inheritable setsAndrei Vagin
According to the prctl man page, each capability from the ambient set must already be present in both the permitted and the inheritable sets of the process. exec_linux_test suggests configuring the capabilities in the parent process. This doesn't look nice, because: * Capabilities are a per-thread attribute, so we need to use LockOSThread. * Need to restore capabilities after creating a process. * Doesn't work with user namespaces, because a process gets capabilities when a namespace is created. Fixes #23152 Change-Id: Iba23e530fc7b9f5182d602fe855f82218f354219 Reviewed-on: https://go-review.googlesource.com/c/go/+/156577 Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2018-08-29syscall: skip an unsupported test case on androidBen Shi
Lookup is not supported on android, and the test syscall/exec_linux_test.go which relies on it will fail on android/arm64. Fixes #27327 Change-Id: I6fdb8992d4634ac7e3689360ff114e9431b5e90c Reviewed-on: https://go-review.googlesource.com/131995 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2018-07-18syscall: update check for UserNS support for CentOS 7.5+EduRam
Fixes #26385 Change-Id: I5594564f42898a71d30531e5132bddb3a6915247 GitHub-Last-Rev: fbd7b38b0419e21ecd22fe802ede5c0ee3f14a9a GitHub-Pull-Request: golang/go#26427 Reviewed-on: https://go-review.googlesource.com/124555 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-09-10syscall: fix TestCloneNEWUSERAndRemapRootEnableSetgroups on linuxHiroshi Ioka
Despite its name, it did the same thing as TestCloneNEWUSERAndRemapRootDisableSetgroups in old code. So fix it. Change-Id: I21265e539179c51980e16f07a553a9bf5bb7903f Reviewed-on: https://go-review.googlesource.com/35273 Run-TryBot: David Crawshaw <crawshaw@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: David Crawshaw <crawshaw@golang.org>
2017-08-23syscall: skip some exec tests in containerAlexander Morozov
For those tests there won't be enough permissions in containers. I decided to go this way instead of just skipping os.IsPermission errors because many of those tests were specifically written to check false positive permission errors. Fixes #21379 Change-Id: Ie25e1d6d47f85bb6b570352638440f3ac1e18e03 Reviewed-on: https://go-review.googlesource.com/58170 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-07-17syscall: update check for UserNS support for centos 7Jess Frazelle
Fixes #20796 Fixes #16283 Change-Id: Ib11992fbd2bc1fbb3b14ae5a6bf0da2e4c12f641 Reviewed-on: https://go-review.googlesource.com/49311 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-07-14syscall: skip TestUnshare on Linux upon permission errorBrad Fitzpatrick
Fixes #17206 Change-Id: Id0ebc3a55ea1c5f52608decffee04c8398a8774b Reviewed-on: https://go-review.googlesource.com/48571 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-07-12syscall: use correct go binary in testBrad Fitzpatrick
Usually this test is skipped (on builders and when not root), so people are unlikely to see this error. Updates #19296 Change-Id: I3acb81260034dad8776c305f83d7cbac4b718e75 Reviewed-on: https://go-review.googlesource.com/48191 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-06-28syscall: add AmbientCaps to linux SysProcAttrMichael Stapelberg
Fixes #19713 Change-Id: Id1ca61b35bca2a4bea23dd64c7fb001a3a14fd88 Reviewed-on: https://go-review.googlesource.com/43512 Reviewed-by: Ian Lance Taylor <iant@golang.org>
2017-04-25syscall: fix ordering of Unshare and chroot on LinuxRonald G. Minnich
When unshare specifies a new namespace, the syscall package changes / to make namespace changes private. If a chroot is specified, the unshare must be done first. If the chroot is done first then the unshare will not specify the correct /. A new test is included which test combining chroot and CLONE_NEWNS; it fails without the patch and works with it. Fixes #20103 Change-Id: I86022803c784bd418a30383321f3d64103d95c62 Reviewed-on: https://go-review.googlesource.com/41626 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-04-13syscall: fix TestGroupCleanup{UserNamespace} on AlpineJess Frazelle
This updates TestGroupCleanup and TestGroupCleanupUserNamespace to pass in the Alpine builder. Updates #19938 Change-Id: Iacbfd73782eccd57f872f9e85726c6024529c277 Reviewed-on: https://go-review.googlesource.com/40692 Reviewed-by: Daniel Martí <mvdan@mvdan.cc> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Daniel Martí <mvdan@mvdan.cc> TryBot-Result: Gobot Gobot <gobot@golang.org>
2017-03-31syscall: skip test on TestUnshareMountNameSpace permission errorBrad Fitzpatrick
TestUnshareMountNameSpace fails on arm64 due to permission problems. Skip that test for now when permission problems are encountered, so we don't regress elsewhere in the meantime. Updates #19698 Change-Id: I9058928afa474b813652c9489f343b8957160a6c Reviewed-on: https://go-review.googlesource.com/39052 Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> Reviewed-by: Josh Bleecher Snyder <josharian@gmail.com>
2017-03-23os/exec: handle Unshareflags with CLONE_NEWNSRonald G. Minnich
In some newer Linux distros, systemd forces all mount namespaces to be shared, starting at /. This disables the CLONE_NEWNS flag in unshare(2) and clone(2). While this problem is most commonly seen on systems with systemd, it can happen anywhere, due to how Linux namespaces now work. Hence, to create a private mount namespace, it is not sufficient to just set CLONE_NEWS; you have to call mount(2) to change the behavior of namespaces, i.e. mount("none", "/", NULL, MS_REC|MS_PRIVATE, NULL) This is tested and working and we can now correctly start child process with private namespaces on Linux distros that use systemd. The new test works correctly on Ubuntu 16.04.2 LTS. It fails if I comment out the new Mount, and succeeds otherwise. In each case it correctly cleans up after itself. Fixes #19661 Change-Id: I52240b59628e3772b529d9bbef7166606b0c157d Reviewed-on: https://go-review.googlesource.com/38471 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-10-05syscall: relax TestUnshareQuentin Smith
Fixes #17224. Some systems have more than just "lo" in a fresh network namespace, due to IPv6. Instead of testing for exactly 3 lines of output (implying 1 interface), just test to make sure that the unshare call resulted in fewer interfaces than before. This should still verify that unshare did something. Change-Id: Iaf84c2b0e673fc207059d62e2f4dd7583a753419 Reviewed-on: https://go-review.googlesource.com/30372 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Jessica Frazelle <me@jessfraz.com> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-07-08syscall: add another output for TestGroupCleanupUserNamespaceIan Lance Taylor
Fixes #16303. Change-Id: I2832477ce0117a66da53ca1f198ebb6121953d56 Reviewed-on: https://go-review.googlesource.com/24833 Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-06-30syscall: accept more variants of id output when testing as rootIan Lance Taylor
This should fix the report at #16224, and also fixes running the test as root on my Ubuntu Trusty system. Fixes #16224. Change-Id: I4e3b5527aa63366afb33a7e30efab088d34fb302 Reviewed-on: https://go-review.googlesource.com/24670 Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-06-15syscall: skip TestUnshare if kernel does not support net namespaceCherry Zhang
Fixes #16056. Change-Id: Ic3343914742713851b8ae969b101521f25e85e7b Reviewed-on: https://go-review.googlesource.com/24132 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-06-02syscall: deflake TestUnshareMikio Hara
Change-Id: I21a08c2ff5ebb74e158723cca323574432870ba8 Reviewed-on: https://go-review.googlesource.com/23662 Run-TryBot: Mikio Hara <mikioh.mikioh@gmail.com> Reviewed-by: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-06-02syscall: call setgroups for no groups on GNU/LinuxAlexander Morozov
Skip setgroups only for one particular case: GidMappings != nil and GidMappingsEnableSetgroup == false and list of supplementary groups is empty. This patch returns pre-1.5 behavior for simple exec and still allows to use GidMappings with non-empty Credential. Change-Id: Ia91c77e76ec5efab7a7f78134ffb529910108fc1 Reviewed-on: https://go-review.googlesource.com/23524 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-06-01syscall: rename SysProcAttr.Unshare to UnshareflagsAlexander Morozov
For symmetry with Cloneflags and it looks slightly weird because there is syscall.Unshare method. Change-Id: I3d710177ca8f27c05b344407f212cbbe3435094b Reviewed-on: https://go-review.googlesource.com/23612 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Rob Pike <r@golang.org>
2016-05-20syscall: fix unshare test on mipsJess Frazelle
Change-Id: Iedce3770a92112802f3a45c7b95ee145ab5b187e Reviewed-on: https://go-review.googlesource.com/23282 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org>
2016-05-20syscall: add Unshare flags to SysProcAttr on LinuxJess Frazelle
This patch adds Unshare flags to SysProcAttr for Linux systems. Fixes #1954 Change-Id: Id819c3f92b1474e5a06dd8d55f89d74a43eb770c Reviewed-on: https://go-review.googlesource.com/23233 Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
2016-03-07os, syscall: skip tests when environment doesn't permit testingBrad Fitzpatrick
Fixes #14693 Change-Id: Id0a6a80b4c37c0b0f1c2755667b7233ed8964e40 Reviewed-on: https://go-review.googlesource.com/20342 Reviewed-by: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-11-25syscall: skip tests that create a user namespace when chrootedMichael Hudson-Doyle
The kernel rejects attempts to create user namespaces when in a chroot. Change-Id: I6548302732c8f5be52f4167cd7233aea16839ad8 Reviewed-on: https://go-review.googlesource.com/17214 Reviewed-by: Ian Lance Taylor <iant@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
2015-10-02syscall: skip a couple tests when running under KubernetesBrad Fitzpatrick
Update #12815 Change-Id: I3bf6de74bc8ab07000fe9a4308299839ef20632f Reviewed-on: https://go-review.googlesource.com/15283 Reviewed-by: Evan Brown <evanbrown@google.com> Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Ian Lance Taylor <iant@golang.org>
generated by cgit v1.3 (git 2.53.0) at 2026-04-15 10:54:56 +0000