os/exec: TestFindExecutableVsNoexec fail in lxd container

[zhsj]

What version of Go are you using (go version)?

$ go version
1.20.2

Does this issue reproduce with the latest release?

yes.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/zsj/.cache/go-build"
GOENV="/home/zsj/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/zsj/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/home/zsj/go"
GOPRIVATE=""
GOPROXY="https://goproxy.cn"
GOROOT="/usr/lib/go-1.20"
GOSUMDB="sum.golang.google.cn"
GOTMPDIR=""
GOTOOLDIR="/usr/lib/go-1.20/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.2"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/dev/null"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build1236278361=/tmp/go-build -gno-record-gcc-switches"

What did you do?

go test -v os/exec -run TestFindExecutableVsNoexec

What did you expect to see?

no fatal

What did you see instead?

lp_linux_test.go:71: remount /tmp/TestFindExecutableVsNoexec2830811350/001 with noexec failed: permission denied

If I run following command, it's indeed no permission to remount.

# mount -t tmpfs tmpfs /tmp/t
# mount -t tmpfs tmpfs -o remount /tmp/t
mount: /tmp/t: cannot remount tmpfs read-write, is write-protected.

So I think the test need to be skipped when the second mount is failed.

[bcmills]

Sounds like the test should be skipped if syscall.Mount returns EROFS.

(At HEAD, I think it could just call testenv.SyscallIsNotSupported.)

[zhsj]

Hmm, I attempt to use testenv.SyscallIsNotSupported, but get stuck with cycle import.

testenv uses os/exec. TestFindExecutableVsNoexec is to test an unexported function in os/exec.

Any suggestions?

[bcmills]

Ideally, rewrite the test to use the exported API. That should at least be possible by invoking exec.LookPath in a subprocess with an appropriate PATH variable, and IIRC there are already a bunch of test helpers in os/exec for running the test binary itself as various commands.

[zhsj]

The second remount seems failed with EACCES.

mount("tmpfs", "/tmp/t", 0x55be2658f240, MS_REMOUNT, NULL) = -1 EACCES (Permission denied)

Probably it's denied by some lxd apparmor/seccomp things. However I'm just using the lxd default options.

[bcmills]

testenv.SyscallIsNotSupported should handle EACCES via the errors.Is(err, fs.ErrPermission) check:
https://cs.opensource.google/go/go/+/master:src/syscall/syscall_unix.go;l=120-121;drc=75c2e97c3c11050847fc221480e1939f29c911e5

[gopherbot]

Change https://go.dev/cl/481620 mentions this issue: os/exec: skip remount in TestFindExecutableVsNoexec on EROFS