Confirmed, I'm seeing this failure on a linux/arm debian 8.1 host. http://build.golang.org/log/4598aa4c79dd80307dd9701414397c175e550e73

Anyone care to bisect ?

I am fairly sure that this first appeared in 8261c88 where TestEmptyCredGroupsDisableSetgroups test was added.

This implies that execve ("/usr/bin/whoami") is returning EACCESS. Why would that happen? Can you run /usr/bin/whoami from a shell? Is there any kind of security wrapper around the Go build?

/usr/bin/whoami from a shell works. It is also executed successfully from the other tests in the same file.

I think the test fails because of cmd.SysProcAttr.Credential = &syscall.Credential{} (

Possibly useful information about OS and kernel versions:

$ cat /etc/debian_version
8.1

$ cat /proc/version
Linux version 3.16.0-4-amd64 (debian-kernel@lists.debian.org) (gcc version 4.8.4 (Debian 4.8.4-1) ) #1 SMP Debian 3.16.7-ckt11-1+deb8u3 (2015-08-04)

CC @LK4D4

@ianlancetaylor I think it's because of "/proc/sys/kernel/unprivileged_userns_clone". I'll move this check to whoamiCmd now.

@LK4D4 after echo 1 > /proc/sys/kernel/unprivileged_userns_clone the test passed

@kostya-sh Thanks for update.
I tried to move check of this earlier in code here https://go-review.googlesource.com/#/c/14110/
Could you try it, pls?

CL https://golang.org/cl/14110 mentions this issue.

@LK4D4 it works (though all tests are skipped):

=== RUN   TestCloneNEWUSERAndRemapRootDisableSetgroups
--- SKIP: TestCloneNEWUSERAndRemapRootDisableSetgroups (0.00s)
    exec_linux_test.go:63: skipping root only test
=== RUN   TestCloneNEWUSERAndRemapRootEnableSetgroups
--- SKIP: TestCloneNEWUSERAndRemapRootEnableSetgroups (0.00s)
    exec_linux_test.go:70: skipping root only test
=== RUN   TestCloneNEWUSERAndRemapNoRootDisableSetgroups
--- SKIP: TestCloneNEWUSERAndRemapNoRootDisableSetgroups (0.00s)
    exec_linux_test.go:31: kernel prohibits user namespace in unprivileged process
=== RUN   TestCloneNEWUSERAndRemapNoRootSetgroupsEnableSetgroups
--- SKIP: TestCloneNEWUSERAndRemapNoRootSetgroupsEnableSetgroups (0.00s)
    exec_linux_test.go:31: kernel prohibits user namespace in unprivileged process
=== RUN   TestEmptyCredGroupsDisableSetgroups
--- SKIP: TestEmptyCredGroupsDisableSetgroups (0.00s)
    exec_linux_test.go:31: kernel prohibits user namespace in unprivileged process
PASS
ok      syscall 0.006s

@kostya-sh I think it's ok, they should be skipped if it's impossible to clone userns.