syscall: move check of unprivileged_userns_clone to whoamiCmd
This is basic validation and should be performed early
Fixes #12412
Change-Id: I903f7eeafdc22376704985a53d649698cf9d8ef4
Reviewed-on: https://go-review.googlesource.com/14110
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
diff --git a/src/syscall/exec_linux_test.go b/src/syscall/exec_linux_test.go
index 8c87736..bbfd6d0 100644
--- a/src/syscall/exec_linux_test.go
+++ b/src/syscall/exec_linux_test.go
@@ -24,6 +24,13 @@
}
t.Fatalf("Failed to stat /proc/self/ns/user: %v", err)
}
+ // On some systems, there is a sysctl setting.
+ if os.Getuid() != 0 {
+ data, errRead := ioutil.ReadFile("/proc/sys/kernel/unprivileged_userns_clone")
+ if errRead == nil && data[0] == '0' {
+ t.Skip("kernel prohibits user namespace in unprivileged process")
+ }
+ }
cmd := exec.Command("whoami")
cmd.SysProcAttr = &syscall.SysProcAttr{
Cloneflags: syscall.CLONE_NEWUSER,
@@ -42,14 +49,6 @@
cmd := whoamiCmd(t, uid, gid, setgroups)
out, err := cmd.CombinedOutput()
if err != nil {
- // On some systems, there is a sysctl setting.
- if os.IsPermission(err) && os.Getuid() != 0 {
- data, errRead := ioutil.ReadFile("/proc/sys/kernel/unprivileged_userns_clone")
- if errRead == nil && data[0] == '0' {
- t.Skip("kernel prohibits user namespace in unprivileged process")
- }
- }
-
t.Fatalf("Cmd failed with err %v, output: %s", err, out)
}
sout := strings.TrimSpace(string(out))
