os: TestRootChown fails in a user namespace with unmapped supplementary groups

[ophestra]

Go version

go version go1.25.6 linux/amd64

Output of go env in your module/workspace:

AR='ar'
CC='clang -O3 -Werror'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/tmp/gocache'
GOCACHEPROG=''
GODEBUG=''
GOENV=''
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-I . -fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2891874976=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/dev/null'
GOMODCACHE=''
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH=''
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/system/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='off'
GOTELEMETRYDIR=''
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/system/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.25.6'
GOWORK=''
PKG_CONFIG='pkg-config'

What did you do?

Ran ./all.bash of go1.25.6 in a user namespace as a user with unmapped supplementary groups.

What did you see happen?

mbf: (go1.25.6:1) --- FAIL: TestRootChown (0.01s)
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/plain_path (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("target", -1, 65534) = chownat target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/path_in_directory (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("a/b/c/target", -1, 65534) = chownat a/b/c/target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/symlink (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("link", -1, 65534) = chownat link: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/symlink_ending_in_slash (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("link/target", -1, 65534) = chownat link/target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/symlink_chain (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("link", -1, 65534) = chownat link: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/path_with_dot (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("./a/./b/./target", -1, 65534) = chownat ./a/./b/./target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/path_with_dotdot (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("a/../a/b/../../a/b/../b/target", -1, 65534) = chownat a/../a/b/../../a/b/../b/target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/dotdot_no_symlink (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("a/../target", -1, 65534) = chownat a/../target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/dotdot_after_symlink (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("a/../target", -1, 65534) = chownat a/../target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/dotdot_before_symlink (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("b/../a/target", -1, 65534) = chownat b/../a/target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootChown/symlink_ends_in_dot (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:45: root.Chown("a/target", -1, 65534) = chownat a/target: invalid argument; want success
mbf: (go1.25.6:1) --- FAIL: TestRootLchown (0.01s)
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/plain_path (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("target", -1, 65534) = lchownat target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/path_in_directory (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("a/b/c/target", -1, 65534) = lchownat a/b/c/target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/symlink (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("link", -1, 65534) = lchownat link: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/symlink_dotdot_slash (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("link", -1, 65534) = lchownat link: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/symlink_ending_in_slash (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("link/target", -1, 65534) = lchownat link/target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/symlink_dotdot_dotdot_slash (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("dir/link", -1, 65534) = lchownat dir/link: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/symlink_chain (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("link", -1, 65534) = lchownat link: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/path_with_dot (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("./a/./b/./target", -1, 65534) = lchownat ./a/./b/./target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/path_with_dotdot (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("a/../a/b/../../a/b/../b/target", -1, 65534) = lchownat a/../a/b/../../a/b/../b/target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/dotdot_no_symlink (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("a/../target", -1, 65534) = lchownat a/../target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/dotdot_after_symlink (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("a/../target", -1, 65534) = lchownat a/../target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/dotdot_before_symlink (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("b/../a/target", -1, 65534) = lchownat b/../a/target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/symlink_ends_in_dot (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("a/target", -1, 65534) = lchownat a/target: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/symlink_cycle (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("a", -1, 65534) = lchownat a: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/absolute_symlink (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("link", -1, 65534) = lchownat link: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/relative_symlink (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("link", -1, 65534) = lchownat link: invalid argument; want success
mbf: (go1.25.6:1)     --- FAIL: TestRootLchown/symlink_chain_escapes (0.00s)
mbf: (go1.25.6:1)         root_unix_test.go:85: root.Lchown("link", -1, 65534) = lchownat link: invalid argument; want success
mbf: (go1.25.6:1) FAIL
mbf: (go1.25.6:1) FAIL  os      1.058s

What did you expect to see?

All tests pass or skip.

[gabyhelp]

Related Issues

• os: TestChown and friends fail in a user namespace #42525 (closed)
• syscall: Test failed in wsl1 #63329
• syscall.TestSetuidEtc() fails in some container setups #46145 (closed)
• syscall: TestGroupCleanupUserNamespace test failure on CentOS #34547 (closed)
• syscall: TestGroupCleanupUserNamespace test failure on Fedora #46752 (closed)
• syscall: GNU/Linux tests fail when run as root inside container #21379 (closed)
• syscall: TestCloneNEWUSERAndRemapNoRootDisableSetgroups fails on CentOS 7 #26385 (closed)
• syscall: when the root user's group ID is not 0, TestSetuidEtc fails #69921 (closed)
• syscall: TestAmbientCapsUserns failed while unprivileged_userns_clone file is missing #32459 (closed)

Related Discussions

• TestSetuidEtc fails during test execution in a container

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[prattmic]

cc @neild

[ophestra]

This program can be used to reproduce the failure by running mbf cure go as a user with supplementary groups. I was hesitant to provide this because it performs a 2-stage bootstrap of LLVM and all of its dependencies before bootstrapping the Go toolchain, and is very expensive. But this is guaranteed to reproduce the failure if all else fails.

[perrinjerome]

I'm also impacted by this, when building golang using https://lab.nexedi.com/nexedi/nxdtest - a test runner which runs in a user namespace using unshare --user --mount --fork --keep-caps.

With a user like this:

$ id 
uid=1000(jerome) gid=1000(jerome) groups=1000(jerome),1001(chronos-access),665357(android-everybody),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),44(video),46(plugdev),100(users),109(kvm),996(ollama)

all the groups become "nogroup" in the user namespace:

$ unshare --user --mount --fork --keep-caps id
uid=1000(jerome) gid=1000(jerome) groups=1000(jerome),65534(nogroup)

so trying to chown to all the user groups in that problematic test

go/src/os/root_unix_test.go

Lines 31 to 44 in 5d1cdac

	groups, err := os.Getgroups()
	if err != nil {
	t.Fatal(err)
	}
	groups = append(groups, os.Getgid())
	for _, test := range rootTestCases {
	test.run(t, func(t *testing.T, target string, root *os.Root) {
	if target != "" {
	if err := os.WriteFile(target, nil, 0o666); err != nil {
	t.Fatal(err)
	}
	}
	for _, gid := range groups {
	err := root.Chown(test.open, -1, gid)

fails with the 65534 (nogroup) group.

With such a user, running unshare --user --mount --fork --keep-caps bash all.bash is enough to reproduce the problem.

Maybe the fix could be to skip the cases where gid == 65534.

[ophestra]

I'm also impacted by this, when building golang using https://lab.nexedi.com/nexedi/nxdtest - a test runner which runs in a user namespace using unshare --user --mount --fork --keep-caps.

With a user like this:

$ id
uid=1000(jerome) gid=1000(jerome) groups=1000(jerome),1001(chronos-access),665357(android-everybody),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),44(video),46(plugdev),100(users),109(kvm),996(ollama)
all the groups become "nogroup" in the user namespace:

$ unshare --user --mount --fork --keep-caps id
uid=1000(jerome) gid=1000(jerome) groups=1000(jerome),65534(nogroup)
so trying to chown to all the user groups in that problematic test

go/src/os/root_unix_test.go

Lines 31 to 44 in 5d1cdac

groups, err := os.Getgroups()
if err != nil {
t.Fatal(err)
}
groups = append(groups, os.Getgid())
for _, test := range rootTestCases {
test.run(t, func(t *testing.T, target string, root *os.Root) {
if target != "" {
if err := os.WriteFile(target, nil, 0o666); err != nil {
t.Fatal(err)
}
}
for _, gid := range groups {
err := root.Chown(test.open, -1, gid)
fails with the 65534 (nogroup) group.
With such a user, running unshare --user --mount --fork --keep-caps bash all.bash is enough to reproduce the problem.

Maybe the fix could be to skip the cases where gid == 65534.

This value is configurable via the kernel.overflowuid sysctl, so comparing against a hardcoded value is unsound. I think checking for supplementary groups with the same gid would work, though.