Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails on CentOS 7 #26385

Closed
EduRam opened this issue Jul 14, 2018 · 14 comments
Closed

syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails on CentOS 7 #26385

EduRam opened this issue Jul 14, 2018 · 14 comments

Comments

@EduRam
Copy link
Contributor

@EduRam EduRam commented Jul 14, 2018

On CentOS 7, had an error on test TestCloneNEWUSERAndRemapNoRootDisableSetgroups test.
On Fedora28, all tests are sucessfull.

There is a previous Issue on the same matter #11261.
But in my case the message is different: "invalid argument, output:"

What version of Go are you using (go version)?

go version go1.10.3 linux/amd64

Does this issue reproduce with the latest release?

yes. i tried tip

What operating system and processor architecture are you using (go env)?

$ uname -a
Linux geoserver.localdomain 3.10.0-862.6.3.el7.x86_64 #1 SMP Tue Jun 26 16:32:21 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
$ cat /etc/centos-release
CentOS Linux release 7.5.1804 (Core)
$ getenforce
Disabled
$go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/scatex/.cache/go-build"
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/scatex/go"
GORACE=""
GOROOT="/home/scatex/wrk/go"
GOTMPDIR=""
GOTOOLDIR="/home/scatex/wrk/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build047489229=/tmp/go-build -gno-record-gcc-switches"

What did you do?

  1. Checkout go source code
  2. Execute command go/src/all.bash

What did you expect to see?

No errors on test phase.

What did you see instead?

...
...
ok      sync/atomic     0.067s
--- FAIL: TestCloneNEWUSERAndRemapNoRootDisableSetgroups (0.00s)
        exec_linux_test.go:116: Cmd failed with err fork/exec /usr/bin/whoami: invalid argument, output:
--- FAIL: TestCloneNEWUSERAndRemapNoRootSetgroupsEnableSetgroups (0.00s)
        exec_linux_test.go:156: Unprivileged gid_map rewriting with GidMappingsEnableSetgroups must fail
--- FAIL: TestEmptyCredGroupsDisableSetgroups (0.00s)
        exec_linux_test.go:164: fork/exec /usr/bin/whoami: invalid argument
FAIL
FAIL    syscall 0.044s
ok      testing 2.007s
...
...
...
ok      cmd/vet/internal/cfg    0.026s
2018/07/14 06:40:54 Failed: exit status 1
@ALTree ALTree changed the title Test Fail: TestCloneNEWUSERAndRemapNoRootDisableSetgroups syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails Jul 14, 2018
@ALTree ALTree added the Testing label Jul 14, 2018
@ianlancetaylor ianlancetaylor changed the title syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails on CentOS 7 Jul 14, 2018
@ianlancetaylor ianlancetaylor added this to the Go1.11 milestone Jul 14, 2018
@ianlancetaylor
Copy link
Contributor

@ianlancetaylor ianlancetaylor commented Jul 14, 2018

CC @LK4D4

@EduRam
Copy link
Contributor Author

@EduRam EduRam commented Jul 15, 2018

Output for command:
$ strace -f go test syscall -test.run=TestCloneNEWUSERAndRemapNoRootDisableSetgroups

strace.txt

@EduRam
Copy link
Contributor Author

@EduRam EduRam commented Jul 15, 2018

The test passes now, after I changed some kernel settings:

# grubby --args="namespace.unpriv_enable=1 user_namespace.enable=1" --update-kernel="/boot/vmlinuz-3.10.0-862.6.3.el7.x86_64"
# echo "user.max_user_namespaces=15076" >> /etc/sysctl.conf

But it was completely uninformed!
Just following generic recipes from web.

@EduRam
Copy link
Contributor Author

@EduRam EduRam commented Jul 16, 2018

On some other Issue, someone asked to run 'unshare' command.
In my case, the error message is "Invalid Argument".
(the same message on failed test)

$ unshare -Ur
unshare: unshare failed: Invalid argument
@EduRam
Copy link
Contributor Author

@EduRam EduRam commented Jul 16, 2018

I just realized there was previous Issues about this ... sorry for duplication:

https://go-review.googlesource.com/c/go/+/49311

I don't have this directory:

/sys/module/user_namespace/parameters/enable

Should function checkUserNS(...) skip if file not found ?
It actually just skips if file is found and do not have value 'Y'.

@ianlancetaylor
Copy link
Contributor

@ianlancetaylor ianlancetaylor commented Jul 16, 2018

I don't think we should unconditionally skip the test if the file does not exist, as my system doesn't have that file either. It sounds like some CentOS 7 systems have that file and some do not, but I don't know what that would be.

@LK4D4
Copy link
Contributor

@LK4D4 LK4D4 commented Jul 17, 2018

It looks like now CentOS 7 has unprivileged namespaces disabled by default with kernel parameter.
The thing to check would be if it is CentOS 7 and there is namespace.unpriv_enable=1 in /proc/cmdline, but it's not the first time we add band-aid for CentOS 7. Maybe it's easier just to add some comment to file like "Please find how to enable unprivileged namespaces for your distribution if you want these tests to work properly".

@ianlancetaylor
Copy link
Contributor

@ianlancetaylor ianlancetaylor commented Jul 17, 2018

Is there some way we can detect CentOS and just skip the test? Perhaps look in /etc/lsb-release?

@ianlancetaylor
Copy link
Contributor

@ianlancetaylor ianlancetaylor commented Jul 17, 2018

Maybe it's easier just to add some comment to file like "Please find how to enable unprivileged namespaces for your distribution if you want these tests to work properly".

In general the tests have to pass for users who don't understand what the code does. So while that would be easier for us, it would just be mystifying for most people installing Go. If the test can't reliably pass, we have to just skip it.

@LK4D4
Copy link
Contributor

@LK4D4 LK4D4 commented Jul 17, 2018

@ianlancetaylor Yeah, apparently all centos releases have /etc/centos-release file, maybe we can just check its presence

@EduRam
Copy link
Contributor Author

@EduRam EduRam commented Jul 17, 2018

In general the tests have to pass for users who don't understand what the code does.

It's me :)

... maybe we can just check its presence

Can I have a try on the fix ?
(check /etc/centos-release presence)

If you feel more confortable I can give a try testing on rhel7.5, before making any decision.

@ianlancetaylor
Copy link
Contributor

@ianlancetaylor ianlancetaylor commented Jul 17, 2018

@EduRam Sure, send a fix, if you can do it very soon for the 1.11 release. Thanks.

@gopherbot
Copy link

@gopherbot gopherbot commented Jul 17, 2018

Change https://golang.org/cl/124555 mentions this issue: syscall: update check for UserNS support for CentOS 7.5+

@EduRam
Copy link
Contributor Author

@EduRam EduRam commented Jul 17, 2018

I think I have found the root cause of the problem.

I had no problems executing the syscall package tests after running the command:

$ sudo sysctl user.max_user_namespaces=15000
$ cat /proc/sys/user/max_user_namespaces
15000

By default that variable is 0, and the tests failed.

$ cat /proc/sys/user/max_user_namespaces
0

My submitted fix will not check the existence of file "/etc/centos-release" as suggested.
Instead it will read the value from "/proc/sys/user/max_user_namespaces", and skip tests if equals to 0.

Could this also be ok ?

@gopherbot gopherbot closed this in ce09ce4 Jul 18, 2018
@golang golang locked and limited conversation to collaborators Jul 18, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
5 participants
You can’t perform that action at this time.