Browse code
fix centos when userns not in kernel
Signed-off-by: Jessica Frazelle <acidburn@docker.com>
Jessica Frazelle authored on 2016/03/03 09:58:49Showing 2 changed files
| ... | ... |
@@ -817,7 +817,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *check.C) {
|
| 817 | 817 |
// TestRunSeccompUnconfinedCloneUserns checks that |
| 818 | 818 |
// 'docker run --security-opt seccomp:unconfined syscall-test' allows creating a userns. |
| 819 | 819 |
func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *check.C) {
|
| 820 |
- testRequires(c, SameHostDaemon, seccompEnabled, NotUserNamespace) |
|
| 820 |
+ testRequires(c, SameHostDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace) |
|
| 821 | 821 |
|
| 822 | 822 |
// make sure running w privileged is ok |
| 823 | 823 |
runCmd := exec.Command(dockerBinary, "run", "--security-opt", "seccomp:unconfined", "syscall-test", "userns-test", "id") |
| ... | ... |
@@ -829,7 +829,7 @@ func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *check.C) {
|
| 829 | 829 |
// TestRunSeccompAllowPrivCloneUserns checks that 'docker run --privileged syscall-test' |
| 830 | 830 |
// allows creating a userns. |
| 831 | 831 |
func (s *DockerSuite) TestRunSeccompAllowPrivCloneUserns(c *check.C) {
|
| 832 |
- testRequires(c, SameHostDaemon, seccompEnabled, NotUserNamespace) |
|
| 832 |
+ testRequires(c, SameHostDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace) |
|
| 833 | 833 |
|
| 834 | 834 |
// make sure running w privileged is ok |
| 835 | 835 |
runCmd := exec.Command(dockerBinary, "run", "--privileged", "syscall-test", "userns-test", "id") |
| ... | ... |
@@ -140,6 +140,19 @@ var ( |
| 140 | 140 |
}, |
| 141 | 141 |
"Test requires native Golang compiler instead of GCCGO", |
| 142 | 142 |
} |
| 143 |
+ UserNamespaceInKernel = testRequirement{
|
|
| 144 |
+ func() bool {
|
|
| 145 |
+ if _, err := os.Stat("/proc/self/uid_map"); os.IsNotExist(err) {
|
|
| 146 |
+ /* |
|
| 147 |
+ * This kernel-provided file only exists if user namespaces are |
|
| 148 |
+ * supported |
|
| 149 |
+ */ |
|
| 150 |
+ return false |
|
| 151 |
+ } |
|
| 152 |
+ return true |
|
| 153 |
+ }, |
|
| 154 |
+ "Kernel must have user namespaces configured.", |
|
| 155 |
+ } |
|
| 143 | 156 |
NotUserNamespace = testRequirement{
|
| 144 | 157 |
func() bool {
|
| 145 | 158 |
root := os.Getenv("DOCKER_REMAP_ROOT")
|