syscall: TestUnshare fails with "operation not permitted", even with CONFIG_NET_NS=y #17206

owlab-exp · 2016-09-23T08:15:56Z

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (`go version`)?

none

What operating system and processor architecture are you using (`go env`)?

linux arm64

What did you do?

If possible, provide a recipe for reproducing the error.

A complete runnable program is good.

A link on play.golang.org is best.

I am building go1.7.1 on my arm64 machine, with go-linux-arm64-bootstrap.
I performed all.bash in src directory.

What did you expect to see?

Completed build without any error.

What did you see instead?

Build failed with the following error

...
--- FAIL: TestUnshare (0.01s)
    exec_linux_test.go:171: Cmd failed with err fork/exec /bin/cat: operation not permitted, output: 
FAIL
FAIL    syscall 0.960s
...

So, I changed the exec_linux_test.go from this,

165         cmd := exec.Command("cat", path)
166         cmd.SysProcAttr = &syscall.SysProcAttr{
167                 Unshareflags: syscall.CLONE_NEWNET,
168         }
169         out, err := cmd.CombinedOutput()
170         if err != nil {
171                 t.Fatalf("Cmd failed with err %v, output: %s", err, out)
172         }
173 
174         // Check there is only the local network interface
175         sout := strings.TrimSpace(string(out))
176         if !strings.Contains(sout, "lo:") {
177                 t.Fatalf("Expected lo network interface to exist, got %s", sout)
178         }
179 
180         lines := strings.Split(sout, "\n")
181         if len(lines) != 3 {
182                 t.Fatalf("Expected 3 lines of output, got %d", len(lines))
183         }

to this,

165         cmd := exec.Command("cat", path)
166         //cmd.SysProcAttr = &syscall.SysProcAttr{
167         //      Unshareflags: syscall.CLONE_NEWNET,
168         //}
169         out, err := cmd.CombinedOutput()
170         if err != nil {
171                 t.Fatalf("Cmd failed with err %v, output: %s", err, out)
172         }
173 
174         // Check there is only the local network interface
175         sout := strings.TrimSpace(string(out))
176         if !strings.Contains(sout, "lo:") {
177                 t.Fatalf("Expected lo network interface to exist, got %s", sout)
178         }
179 
180         lines := strings.Split(sout, "\n")
181         //if len(lines) != 3 {
182         if len(lines) != 4 {
183                 t.Fatalf("Expected 3 lines of output, got %d", len(lines))
184         }

After those changes, building finished without error.

The text was updated successfully, but these errors were encountered:

minux · 2016-09-23T17:53:25Z

Are you running inside some kind of container that blocked new net namespace creation?

owlab-exp · 2016-09-25T06:59:54Z

I am running it in a physical machine (Hikey board, debian-jessie), not in a container.

mwhudson · 2016-09-25T22:38:26Z

Which kernel? Maybe it doesn't have CONFIG_NET_NS=y set?

owlab-exp · 2016-09-26T00:16:23Z

The kernel is 3.1.8-linaro-hikey.
And /boot/config-3.1.8.0-linaro-hikey shows :

CONFIG_NET_NS=y

minux · 2016-09-26T00:19:20Z

The test already checks for the existence of /proc/self/ns/net before the exec, so I don't think the reason is lack of networking namespace support.

mwhudson · 2016-09-26T00:19:25Z

3.1 still sounds pretty old but I certainly don't know the details here,
sorry.

On 26 September 2016 at 13:16, Hun Jae Lee notifications@github.com wrote:

The kernel is 3.1.8-linaro-hikey.
And /boot/config-3.1.8.0-linaro-hikey shows :

CONFIG_NET_NS=y

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#17206 (comment), or mute
the thread
https://github.com/notifications/unsubscribe-auth/AApBFuvQsEl-GVYA1cfA9_ifZLWXMkdJks5qtw7ggaJpZM4KEuEV
.

mdcnz · 2016-10-24T06:09:17Z

Saw this issue in a docker container:
starting from docker golang:1.7.3-wheezy image
removed go1.7.3
downloaded go1.4 binaries
git clone latest go source
ran ./all.bash as root

--- FAIL: TestUnshare (0.00s)
exec_linux_test.go:177: Cmd failed with err fork/exec /bin/cat: operation not permitted

If test is skipped, build is successful.

go version devel +3cbfcaa Mon Oct 24 02:33:39 2016 +0000 linux/amd64

CAFxX · 2017-03-14T23:04:27Z

Ran into this today using docker:

FROM ubuntu:latest
RUN apt-get -y update && apt-get install -y git golang build-essential gcc
RUN git clone https://github.com/golang/go.git
CMD cd go/src; GOROOT_BOOTSTRAP=`go env GOROOT` ./all.bash

bradfitz · 2017-03-14T23:11:49Z

@CAFxX, privileged container or not? Kernel version? What does "ubuntu:latest" currently resolve to?

gopherbot · 2017-07-14T19:02:55Z

CL https://golang.org/cl/48571 mentions this issue.

shanemhansen · 2017-09-12T21:55:44Z

FWIW I verified that go1.9 docker builds work if you use the --privileged.

belka-ew mentioned this issue Sep 25, 2016

syscall: TestUnshare failure #17224

Closed

quentinmit changed the title ~~exec_linux_test.go:171: Cmd failed with err fork/exec /bin/cat: operation not permitted~~ syscall: TestUnshare fails with "operation not permitted", even with CONFIG_NET_NS=y Oct 3, 2016

quentinmit added this to the Go1.8 milestone Oct 3, 2016

quentinmit added the NeedsInvestigation label Oct 3, 2016

rsc modified the milestones: Go1.9, Go1.8 Nov 11, 2016

bradfitz added the Testing label Jul 14, 2017

gopherbot closed this as completed in 121d076 Jul 14, 2017

ianlancetaylor mentioned this issue Oct 23, 2017

syscall: TestUnshare failure #22391

Closed

golang locked and limited conversation to collaborators Sep 12, 2018

gopherbot added the FrozenDueToAge label Sep 12, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

syscall: TestUnshare fails with "operation not permitted", even with CONFIG_NET_NS=y #17206

syscall: TestUnshare fails with "operation not permitted", even with CONFIG_NET_NS=y #17206

owlab-exp commented Sep 23, 2016

minux commented Sep 23, 2016 via email

owlab-exp commented Sep 25, 2016

mwhudson commented Sep 25, 2016

owlab-exp commented Sep 26, 2016

minux commented Sep 26, 2016 via email

mwhudson commented Sep 26, 2016

mdcnz commented Oct 24, 2016

CAFxX commented Mar 14, 2017

bradfitz commented Mar 14, 2017

gopherbot commented Jul 14, 2017

shanemhansen commented Sep 12, 2017

syscall: TestUnshare fails with "operation not permitted", even with CONFIG_NET_NS=y #17206

syscall: TestUnshare fails with "operation not permitted", even with CONFIG_NET_NS=y #17206

Comments

owlab-exp commented Sep 23, 2016

What version of Go are you using (go version)?

What operating system and processor architecture are you using (go env)?

What did you do?

If possible, provide a recipe for reproducing the error.

A complete runnable program is good.

A link on play.golang.org is best.

What did you expect to see?

What did you see instead?

minux commented Sep 23, 2016 via email

owlab-exp commented Sep 25, 2016

mwhudson commented Sep 25, 2016

owlab-exp commented Sep 26, 2016

minux commented Sep 26, 2016 via email

mwhudson commented Sep 26, 2016

mdcnz commented Oct 24, 2016

CAFxX commented Mar 14, 2017

bradfitz commented Mar 14, 2017

gopherbot commented Jul 14, 2017

shanemhansen commented Sep 12, 2017

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?