user namespace fix & test for #6800

[Blub]

This is the first part of the previous PR #6865 with only the patches relevant to fix #6800 separated out.

It may be reasonable to squash the first two commits, but for reviewing purposes I left them separate for now.
The first patch also adds HAVE_CRED_USER_NS which I ended up not using (see the second patch's comment about HAVE_KUID_HAS_MAPPING). Once the rest of the PR is good enough to merge I can remove that.

PS: Sorry for taking so long...

[Blub]

Looks like I forgot to add user_namespace_common.kshlib to dist_pkgdata_SCRIPTS in the user namespace test's Makefile.am.

[behlendorf]

@Blub thanks for splitting this in to a separate PR. I'll give it a good review tomorrow and do some manual testing to verify it. In the meanwhile the bots did determine that the new test case is failing on CentOS 7 (only) and that needs to be investigated.

When you do refresh this please go ahead and squash all three of these commits. You'll also need to rebase on master to resolve the Kernel.org build failure.

[codecov]

Codecov Report

Merging #7270 into master will decrease coverage by 0.03%.
The diff coverage is 54.34%.

@@            Coverage Diff             @@
##           master    #7270      +/-   ##
==========================================
- Coverage   76.44%   76.41%   -0.04%     
==========================================
  Files         327      328       +1     
  Lines      103922   104006      +84     
==========================================
+ Hits        79447    79480      +33     
- Misses      24475    24526      +51

Flag	Coverage Δ
#kernel	76.22% <58.82%> (+0.19%)	⬆️
#user	65.62% <53.33%> (-0.25%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 639b189...021c942. Read the comment docs.

[Blub]

The failed test uses centos 7 which, while compiling user namespace support into the kernel (and therfore enabling CONFIG_USER_NS & friends) needs boot parameters to actually enable it. (see [1])

So the question is: should I try to detect this in the test suite or will you adapt the build bot?

[1] https://discuss.linuxcontainers.org/t/centos-7-kernel-514-693-cannot-start-any-nodes-after-update/641/16?u=brauner

[stgraber]

From https://discuss.linuxcontainers.org/t/lxd-on-centos-7/1250

The instructions to enable the right bits are:

grubby --args="user_namespace.enable=1" --update-kernel="$(grubby --default-kernel)"
grubby --args="namespace.unpriv_enable=1" --update-kernel="$(grubby --default-kernel)"
echo "user.max_user_namespaces=3883" > /etc/sysctl.d/99-userns.conf
reboot

After the reboot, the kernel will be properly configured for use of user namespaces.
This is only needed on Centos/RHEL kernels, all other distros behave as one would expect :)

[behlendorf]

@Blub let me update the CentOS 7 bots. @stgraber thanks for the concise instructions!

[behlendorf]

@Blub alright the CentOS 7 bots have been updated.

The only issue I ran in to was that the new test case fails when run in-tree due to the constrained path set by the ZFS Test Suite (the bots test with packages which is why they missed it). Using full paths for touch and chmod let's us avoid the issue, how about updating the test case like this.

Please go ahead and squash and rebase this on master then force update the PR.

diff --git a/tests/zfs-tests/tests/functional/user_namespace/user_namespace_001.ksh b/tests/zfs-tests/tests/functional/user_namespace/user_namespace_
index 3d95a1d..6be30ab 100755
--- a/tests/zfs-tests/tests/functional/user_namespace/user_namespace_001.ksh
+++ b/tests/zfs-tests/tests/functional/user_namespace/user_namespace_001.ksh
@@ -51,9 +51,12 @@ log_onexit cleanup
 
 log_assert "Check root in user namespaces"
 
+TOUCH=$(readlink -e $(which touch))
+CHMOD=$(readlink -e $(which chmod))
+
 for i in ${files[*]}; do
-       log_must touch $TESTDIR/$i
-       log_must chmod 0644 $TESTDIR/$i
+       log_must $TOUCH $TESTDIR/$i
+       log_must $CHMOD 0644 $TESTDIR/$i
 done
 
 log_must chown 0:0 $TESTDIR/rroot_rroot
@@ -62,25 +65,25 @@ log_must chown $ROOT_UID:$OTHER_UID $TESTDIR/uroot_other
 log_must chown $OTHER_UID:$ROOT_UID $TESTDIR/uother_uroot
 log_must chown $OTHER_UID:$OTHER_UID $TESTDIR/uother_uother
 
-log_mustnot user_ns_exec chmod 02755 $TESTDIR/rroot_rroot
+log_mustnot user_ns_exec $CHMOD 02755 $TESTDIR/rroot_rroot
 log_mustnot test -g $TESTDIR/rroot_rroot
 
-log_must user_ns_exec chmod 02755 $TESTDIR/uroot_uroot
+log_must user_ns_exec $CHMOD 02755 $TESTDIR/uroot_uroot
 log_must test -g $TESTDIR/uroot_uroot
 
-log_must user_ns_exec chmod 02755 $TESTDIR/uroot_other
+log_must user_ns_exec $CHMOD 02755 $TESTDIR/uroot_other
 log_must test -g $TESTDIR/uroot_other
 
-log_must user_ns_exec chmod 02755 $TESTDIR/uother_uroot
+log_must user_ns_exec $CHMOD 02755 $TESTDIR/uother_uroot
 log_must test -g $TESTDIR/uother_uroot
 
-log_must user_ns_exec chmod 02755 $TESTDIR/uother_uother
+log_must user_ns_exec $CHMOD 02755 $TESTDIR/uother_uother
 log_must test -g $TESTDIR/uother_uother
 
-log_mustnot user_ns_exec touch $TESTDIR/rroot_rroot
-log_must chmod 0666 $TESTDIR/rroot_rroot
+log_mustnot user_ns_exec $TOUCH $TESTDIR/rroot_rroot
+log_must $CHMOD 0666 $TESTDIR/rroot_rroot
 for i in ${files[*]}; do
-       log_must user_ns_exec touch $TESTDIR/$i
+       log_must user_ns_exec $TOUCH $TESTDIR/$i
 done
 
 log_pass "Check root in user namespaces"

[behlendorf]

Looks good! Thanks!

[behlendorf]

Merged and added to the list for the 0.7.7 release. Thanks!