From f7b2779086683bf00570427ce08bebfb54c53b76 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 16 Nov 2023 00:42:04 -0800 Subject: syscall: fix getting pidfd when using CLONE_NEWUSER While working on CL 528798, I found out that sys.PidFD field (added in CL 520266) is not filled in when CLONE_NEWUSER is used. This happens because the code assumed that the parent and the child run in the same memory space. This assumption is right only when CLONE_VM is used for clone syscall, and the code only sets CLONE_VM when CLONE_NEWUSER is not used. Fix this, and add a test case (which fails before the fix). Updates #51246. Change-Id: I805203c1369cadd63d769568b132a9ffd92cc184 Reviewed-on: https://go-review.googlesource.com/c/go/+/542698 LUCI-TryBot-Result: Go LUCI Reviewed-by: Michael Pratt Reviewed-by: Michael Knyszek Auto-Submit: Michael Pratt --- src/syscall/exec_linux_test.go | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'src/syscall/exec_linux_test.go') diff --git a/src/syscall/exec_linux_test.go b/src/syscall/exec_linux_test.go index f255930aa8..a7af00d2c0 100644 --- a/src/syscall/exec_linux_test.go +++ b/src/syscall/exec_linux_test.go @@ -522,7 +522,7 @@ func TestCloneTimeNamespace(t *testing.T) { } } -func testPidFD(t *testing.T) error { +func testPidFD(t *testing.T, userns bool) error { testenv.MustHaveExec(t) if os.Getenv("GO_WANT_HELPER_PROCESS") == "1" { @@ -541,6 +541,9 @@ func testPidFD(t *testing.T) error { cmd.SysProcAttr = &syscall.SysProcAttr{ PidFD: &pidfd, } + if userns { + cmd.SysProcAttr.Cloneflags = syscall.CLONE_NEWUSER + } if err := cmd.Start(); err != nil { return err } @@ -572,7 +575,13 @@ func testPidFD(t *testing.T) error { } func TestPidFD(t *testing.T) { - if err := testPidFD(t); err != nil { + if err := testPidFD(t, false); err != nil { + t.Fatal("can't start a process:", err) + } +} + +func TestPidFDWithUserNS(t *testing.T) { + if err := testPidFD(t, true); err != nil { t.Fatal("can't start a process:", err) } } @@ -581,7 +590,7 @@ func TestPidFDClone3(t *testing.T) { *syscall.ForceClone3 = true defer func() { *syscall.ForceClone3 = false }() - if err := testPidFD(t); err != nil { + if err := testPidFD(t, false); err != nil { if testenv.SyscallIsNotSupported(err) { t.Skip("clone3 not supported:", err) } -- cgit v1.3