syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails on CentOS 7 #26385

EduRam · 2018-07-14T10:53:49Z

On CentOS 7, had an error on test TestCloneNEWUSERAndRemapNoRootDisableSetgroups test.
On Fedora28, all tests are sucessfull.

There is a previous Issue on the same matter #11261.
But in my case the message is different: "invalid argument, output:"

What version of Go are you using (`go version`)?

go version go1.10.3 linux/amd64

Does this issue reproduce with the latest release?

yes. i tried tip

What operating system and processor architecture are you using (`go env`)?

$ uname -a
Linux geoserver.localdomain 3.10.0-862.6.3.el7.x86_64 #1 SMP Tue Jun 26 16:32:21 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

$ cat /etc/centos-release
CentOS Linux release 7.5.1804 (Core)

$ getenforce
Disabled

$go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/scatex/.cache/go-build"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/scatex/go"
GORACE=""
GOROOT="/home/scatex/wrk/go"
GOTMPDIR=""
GOTOOLDIR="/home/scatex/wrk/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build047489229=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Checkout go source code
Execute command go/src/all.bash

What did you expect to see?

No errors on test phase.

What did you see instead?

...
...
ok      sync/atomic     0.067s
--- FAIL: TestCloneNEWUSERAndRemapNoRootDisableSetgroups (0.00s)
        exec_linux_test.go:116: Cmd failed with err fork/exec /usr/bin/whoami: invalid argument, output:
--- FAIL: TestCloneNEWUSERAndRemapNoRootSetgroupsEnableSetgroups (0.00s)
        exec_linux_test.go:156: Unprivileged gid_map rewriting with GidMappingsEnableSetgroups must fail
--- FAIL: TestEmptyCredGroupsDisableSetgroups (0.00s)
        exec_linux_test.go:164: fork/exec /usr/bin/whoami: invalid argument
FAIL
FAIL    syscall 0.044s
ok      testing 2.007s
...
...
...
ok      cmd/vet/internal/cfg    0.026s
2018/07/14 06:40:54 Failed: exit status 1

The text was updated successfully, but these errors were encountered:

ianlancetaylor · 2018-07-14T23:50:27Z

CC @LK4D4

EduRam · 2018-07-15T18:33:00Z

Output for command:
$ strace -f go test syscall -test.run=TestCloneNEWUSERAndRemapNoRootDisableSetgroups

strace.txt

EduRam · 2018-07-15T19:43:07Z

The test passes now, after I changed some kernel settings:

# grubby --args="namespace.unpriv_enable=1 user_namespace.enable=1" --update-kernel="/boot/vmlinuz-3.10.0-862.6.3.el7.x86_64"

# echo "user.max_user_namespaces=15076" >> /etc/sysctl.conf

But it was completely uninformed!
Just following generic recipes from web.

EduRam · 2018-07-16T08:41:54Z

On some other Issue, someone asked to run 'unshare' command.
In my case, the error message is "Invalid Argument".
(the same message on failed test)

$ unshare -Ur
unshare: unshare failed: Invalid argument

EduRam · 2018-07-16T10:06:50Z

I just realized there was previous Issues about this ... sorry for duplication:

https://go-review.googlesource.com/c/go/+/49311

I don't have this directory:

/sys/module/user_namespace/parameters/enable

Should function checkUserNS(...) skip if file not found ?
It actually just skips if file is found and do not have value 'Y'.

ianlancetaylor · 2018-07-16T17:25:50Z

I don't think we should unconditionally skip the test if the file does not exist, as my system doesn't have that file either. It sounds like some CentOS 7 systems have that file and some do not, but I don't know what that would be.

LK4D4 · 2018-07-17T01:37:56Z

It looks like now CentOS 7 has unprivileged namespaces disabled by default with kernel parameter.
The thing to check would be if it is CentOS 7 and there is namespace.unpriv_enable=1 in /proc/cmdline, but it's not the first time we add band-aid for CentOS 7. Maybe it's easier just to add some comment to file like "Please find how to enable unprivileged namespaces for your distribution if you want these tests to work properly".

ianlancetaylor · 2018-07-17T02:29:58Z

Is there some way we can detect CentOS and just skip the test? Perhaps look in /etc/lsb-release?

ianlancetaylor · 2018-07-17T02:31:10Z

Maybe it's easier just to add some comment to file like "Please find how to enable unprivileged namespaces for your distribution if you want these tests to work properly".

In general the tests have to pass for users who don't understand what the code does. So while that would be easier for us, it would just be mystifying for most people installing Go. If the test can't reliably pass, we have to just skip it.

LK4D4 · 2018-07-17T04:59:44Z

@ianlancetaylor Yeah, apparently all centos releases have /etc/centos-release file, maybe we can just check its presence

EduRam · 2018-07-17T09:00:32Z

In general the tests have to pass for users who don't understand what the code does.

It's me :)

... maybe we can just check its presence

Can I have a try on the fix ?
(check /etc/centos-release presence)

If you feel more confortable I can give a try testing on rhel7.5, before making any decision.

ianlancetaylor · 2018-07-17T12:51:59Z

@EduRam Sure, send a fix, if you can do it very soon for the 1.11 release. Thanks.

gopherbot · 2018-07-17T22:59:50Z

Change https://golang.org/cl/124555 mentions this issue: syscall: update check for UserNS support for CentOS 7.5+

EduRam · 2018-07-17T23:14:12Z

I think I have found the root cause of the problem.

I had no problems executing the syscall package tests after running the command:

$ sudo sysctl user.max_user_namespaces=15000
$ cat /proc/sys/user/max_user_namespaces
15000

By default that variable is 0, and the tests failed.

$ cat /proc/sys/user/max_user_namespaces
0

My submitted fix will not check the existence of file "/etc/centos-release" as suggested.
Instead it will read the value from "/proc/sys/user/max_user_namespaces", and skip tests if equals to 0.

Could this also be ok ?

ALTree added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jul 14, 2018

ALTree changed the title ~~Test Fail: TestCloneNEWUSERAndRemapNoRootDisableSetgroups~~ syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails Jul 14, 2018

ALTree added the Testing An issue that has been verified to require only test changes, not just a test failure. label Jul 14, 2018

ianlancetaylor changed the title ~~syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails~~ syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails on CentOS 7 Jul 14, 2018

ianlancetaylor added this to the Go1.11 milestone Jul 14, 2018

EduRam mentioned this issue Jul 17, 2018

syscall: update check for UserNS support for CentOS 7.5+ #26427

Closed

gopherbot closed this as completed in ce09ce4 Jul 18, 2018

golang locked and limited conversation to collaborators Jul 18, 2019

gopherbot added the FrozenDueToAge label Jul 18, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails on CentOS 7 #26385

syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails on CentOS 7 #26385

EduRam commented Jul 14, 2018 •

edited

ianlancetaylor commented Jul 14, 2018

EduRam commented Jul 15, 2018

EduRam commented Jul 15, 2018 •

edited

EduRam commented Jul 16, 2018 •

edited

EduRam commented Jul 16, 2018 •

edited

ianlancetaylor commented Jul 16, 2018

LK4D4 commented Jul 17, 2018

ianlancetaylor commented Jul 17, 2018

ianlancetaylor commented Jul 17, 2018

LK4D4 commented Jul 17, 2018

EduRam commented Jul 17, 2018 •

edited

ianlancetaylor commented Jul 17, 2018

gopherbot commented Jul 17, 2018

EduRam commented Jul 17, 2018

syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails on CentOS 7 #26385

syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails on CentOS 7 #26385

Comments

EduRam commented Jul 14, 2018 • edited

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

What did you do?

What did you expect to see?

What did you see instead?

ianlancetaylor commented Jul 14, 2018

EduRam commented Jul 15, 2018

EduRam commented Jul 15, 2018 • edited

EduRam commented Jul 16, 2018 • edited

EduRam commented Jul 16, 2018 • edited

ianlancetaylor commented Jul 16, 2018

LK4D4 commented Jul 17, 2018

ianlancetaylor commented Jul 17, 2018

ianlancetaylor commented Jul 17, 2018

LK4D4 commented Jul 17, 2018

EduRam commented Jul 17, 2018 • edited

ianlancetaylor commented Jul 17, 2018

gopherbot commented Jul 17, 2018

EduRam commented Jul 17, 2018

EduRam commented Jul 14, 2018 •

edited

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?

EduRam commented Jul 15, 2018 •

edited

EduRam commented Jul 16, 2018 •

edited

EduRam commented Jul 16, 2018 •

edited

EduRam commented Jul 17, 2018 •

edited