From d05af626956af449fb13815cef06b606bc7740c6 Mon Sep 17 00:00:00 2001 From: Michael Stapelberg Date: Tue, 14 May 2024 10:54:40 +0200 Subject: syscall: skip TestAmbientCapsUserns when restricted, document fixes golang/go#67088 Change-Id: I42e7a8d02b161187772f147e3e136ab6e0f71d7f Reviewed-on: https://go-review.googlesource.com/c/go/+/585059 LUCI-TryBot-Result: Go LUCI Reviewed-by: Ian Lance Taylor --- src/syscall/exec_linux.go | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'src/syscall/exec_linux.go') diff --git a/src/syscall/exec_linux.go b/src/syscall/exec_linux.go index e6d6343ed8..e4b9ce1bf4 100644 --- a/src/syscall/exec_linux.go +++ b/src/syscall/exec_linux.go @@ -53,6 +53,10 @@ const ( // SysProcIDMap holds Container ID to Host ID mappings used for User Namespaces in Linux. // See user_namespaces(7). +// +// Note that User Namespaces are not available on a number of popular Linux +// versions (due to security issues), or are available but subject to AppArmor +// restrictions like in Ubuntu 24.04. type SysProcIDMap struct { ContainerID int // Container ID. HostID int // Host ID. -- cgit v1.3