mirror of
https://github.com/golang/go.git
synced 2024-09-21 10:28:27 +00:00
[release-branch.go1.22] syscall: skip TestAmbientCapsUserns when restricted, document
For #67088
Fixes #69366
Change-Id: I42e7a8d02b161187772f147e3e136ab6e0f71d7f
Reviewed-on: https://go-review.googlesource.com/c/go/+/585059
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Ian Lance Taylor <iant@google.com>
(cherry picked from commit d05af62695
)
Reviewed-on: https://go-review.googlesource.com/c/go/+/612475
This commit is contained in:
parent
6fab4b9a9e
commit
b4086b7c16
@ -53,6 +53,10 @@ const (
|
||||
|
||||
// SysProcIDMap holds Container ID to Host ID mappings used for User Namespaces in Linux.
|
||||
// See user_namespaces(7).
|
||||
//
|
||||
// Note that User Namespaces are not available on a number of popular Linux
|
||||
// versions (due to security issues), or are available but subject to AppArmor
|
||||
// restrictions like in Ubuntu 24.04.
|
||||
type SysProcIDMap struct {
|
||||
ContainerID int // Container ID.
|
||||
HostID int // Host ID.
|
||||
|
@ -642,6 +642,10 @@ func TestAmbientCaps(t *testing.T) {
|
||||
}
|
||||
|
||||
func TestAmbientCapsUserns(t *testing.T) {
|
||||
b, err := os.ReadFile("/proc/sys/kernel/apparmor_restrict_unprivileged_userns")
|
||||
if err == nil && strings.TrimSpace(string(b)) == "1" {
|
||||
t.Skip("AppArmor restriction for unprivileged user namespaces is enabled")
|
||||
}
|
||||
testAmbientCaps(t, true)
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user