syscall: GNU/Linux tests fail when run as root inside container

[mdcnz]

What version of Go are you using (go version)?

1.9 and tip

What operating system and processor architecture are you using (go env)?

host: ubuntu16 x86_64
docker: 17.06.0-ce
container: golang:1.9

What did you do?

Tried to compile and test golang tip using docker golang:1.9 image.

Dockerfile:

FROM golang:1.9
RUN apt-get update && apt-get install -y vim && apt-get upgrade -y
ENV GOROOT_BOOTSTRAP="/usr/local/go"
ENV TIP="/go_tip"
RUN git clone --depth=1 https://go.googlesource.com/go $TIP
WORKDIR $TIP/src
RUN ./all.bash

Tried to build with:
docker build --no-cache -t dogo-img .

What did you expect to see?

All tests pass

What did you see instead?

...
ok  	sync	6.848s
ok  	sync/atomic	0.147s
--- FAIL: TestCloneNEWUSERAndRemapRootDisableSetgroups (0.00s)
	exec_linux_test.go:97: Cmd failed with err fork/exec /usr/bin/whoami: operation not permitted, output: 
--- FAIL: TestCloneNEWUSERAndRemapRootEnableSetgroups (0.00s)
	exec_linux_test.go:97: Cmd failed with err fork/exec /usr/bin/whoami: operation not permitted, output: 
--- FAIL: TestEmptyCredGroupsDisableSetgroups (0.00s)
	exec_linux_test.go:145: fork/exec /usr/bin/whoami: operation not permitted
--- FAIL: TestGroupCleanupUserNamespace (0.00s)
	exec_linux_test.go:261: Cmd failed with err fork/exec /usr/bin/id: operation not permitted, output: 
--- FAIL: TestUnshareMountNameSpace (0.00s)
	exec_linux_test.go:324: unshare failed: , fork/exec /tmp/go-build277915935/syscall/_test/syscall.test: operation not permitted
--- FAIL: TestUnshareMountNameSpaceChroot (3.48s)
	exec_linux_test.go:382: unshare failed: , fork/exec /syscall.test: operation not permitted
--- FAIL: TestAmbientCaps (0.00s)
	exec_linux_test.go:506: SYS_CAPSET: operation not permitted
FAIL
FAIL	syscall	3.551s
ok  	testing	0.969s
ok  	testing/quick	0.441s
...

Might be related to

• 12412
• 13312
• 16283

[mvdan]

If you run whoami or id in the container, do they execute fine?

Have you tried make.bash instead of all.bash? If what you're after is compiling Go, you don't need to run all the tests.

[mdcnz]

Thanks for your response Daniel. Yes, they execute:

whoami
root

id
uid=0(root) gid=0(root) groups=0(root)

make.bash
...
Installed Go for linux/amd64 in /go_tip

[ianlancetaylor]

CC @LK4D4

[LK4D4]

There are definitely not enough permissions in simple docker container to create user or mount namespaces (I'm actually surprised that it was able to create network namespace).
I wonder if we could just check for "permission denied" and "operation not permitted" for needed unshare operations before running tests. @bradfitz added "permission denied" check in 3e4afe2 , so we'd just need to add "operation not permitted"(yeah, it's weird) and add the same for user namespace as well. But that's kinda defies meaning of some tests.
Alternatively, to fix only this issue it's possible to check that we're in docker container.

[dagelf]

The network namespace tests already ignore permission errors. Perhaps ignoring permission errors should be logged as "OK - unable to test, no permission" ?

[tv42]

I wonder if we could just check for "permission denied" and "operation not permitted" for needed unshare operations before running tests. @bradfitz added "permission denied" check in 3e4afe2 , so we'd just need to add "operation not permitted"(yeah, it's weird) and add the same for user namespace as well.

Drive-by clarification: EACCES means "access control told me not to let you do this", and EPERM means "that just won't ever happen (with this kernel, with this input, at this time)". For example, for open(2) EACCES errors are fixable with chmod, EPERM are not.

Perhaps ignoring permission errors should be logged as "OK - unable to test, no permission" ?

Sounds like a case for t.Skip.

[gopherbot]

Change https://golang.org/cl/58170 mentions this issue: syscall: skip some exec tests in container

[LK4D4]

@mdcnz would you mind trying with master?

[mdcnz]

Confirm all tests now pass on master 9d3d370.

Thanks @LK4D4