From: Ian Lance Taylor <iant@golang.org>
Date: Fri, 19 Jun 2015 20:48:06 +0000 (-0700)
Subject: syscall: skip non-root user namespace test if kernel forbids
X-Git-Tag: go1.5beta1~163
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=79d4d6eca47acc3b2dd0ec598b6a55c0bb0b1b31;p=gostls13.git

syscall: skip non-root user namespace test if kernel forbids

Some Linux kernels apparently have a sysctl that prohibits
nonprivileged processes from creating user namespaces.  If we see a
failure for that reason, skip the test.

Fixes #11261.

Change-Id: I82dfcaf475eea4eaa387941373ce7165df4848ad
Reviewed-on: https://go-review.googlesource.com/11269
Reviewed-by: Mikio Hara <mikioh.mikioh@gmail.com>
---

diff --git a/src/syscall/exec_linux_test.go b/src/syscall/exec_linux_test.go
index 1f0a27d92e..60d2734f66 100644
--- a/src/syscall/exec_linux_test.go
+++ b/src/syscall/exec_linux_test.go
@@ -42,6 +42,14 @@ func testNEWUSERRemap(t *testing.T, uid, gid int, setgroups bool) {
 	cmd := whoamiCmd(t, uid, gid, setgroups)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
+		// On some systems, there is a sysctl setting.
+		if os.IsPermission(err) && os.Getuid() != 0 {
+			data, errRead := ioutil.ReadFile("/proc/sys/kernel/unprivileged_userns_clone")
+			if errRead == nil && data[0] == '0' {
+				t.Skip("kernel prohibits user namespace in unprivileged process")
+			}
+		}
+
 		t.Fatalf("Cmd failed with err %v, output: %s", err, out)
 	}
 	sout := strings.TrimSpace(string(out))
@@ -97,7 +105,7 @@ func TestCloneNEWUSERAndRemapNoRootSetgroupsEnableSetgroups(t *testing.T) {
 	if err == nil {
 		t.Skip("probably old kernel without security fix")
 	}
-	if !strings.Contains(err.Error(), "operation not permitted") {
+	if !os.IsPermission(err) {
 		t.Fatalf("Unprivileged gid_map rewriting with GidMappingsEnableSetgroups must fail")
 	}
 }