From 85f722dea018724f8aa083c50d268a5888aea424 Mon Sep 17 00:00:00 2001
From: Aleksa Sarai <cyphar@cyphar.com>
Date: Sun, 28 Jun 2015 11:14:24 +1000
Subject: [PATCH 1/2] libcontainer: user: fix GetAdditionalGroupsPath to match
 API

The old GetAdditionalGroups* API didn't match the rest of
libcontainer/user, we make functions that take io.Readers and then make
wrappers around them. Otherwise we have to do dodgy stuff when testing
our code.

Fixes: d4ece29c0bd38 ("refactor GetAdditionalGroupsPath")
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
---
 libcontainer/user/user.go | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/libcontainer/user/user.go b/libcontainer/user/user.go
index 13226dbfa..964e31bfd 100644
--- a/libcontainer/user/user.go
+++ b/libcontainer/user/user.go
@@ -349,17 +349,12 @@ func GetExecUser(userSpec string, defaults *ExecUser, passwd, group io.Reader) (
 	return user, nil
 }
 
-// GetAdditionalGroupsPath looks up a list of groups by name or group id
-// against the group file. If a group name cannot be found, an error will be
-// returned. If a group id cannot be found, it will be returned as-is.
-func GetAdditionalGroupsPath(additionalGroups []string, groupPath string) ([]int, error) {
-	groupReader, err := os.Open(groupPath)
-	if err != nil {
-		return nil, fmt.Errorf("Failed to open group file: %v", err)
-	}
-	defer groupReader.Close()
-
-	groups, err := ParseGroupFilter(groupReader, func(g Group) bool {
+// GetAdditionalGroups looks up a list of groups by name or group id against
+// against the given /etc/group formatted data. If a group name cannot be found,
+// an error will be returned. If a group id cannot be found, it will be returned
+// as-is.
+func GetAdditionalGroups(additionalGroups []string, group io.Reader) ([]int, error) {
+	groups, err := ParseGroupFilter(group, func(g Group) bool {
 		for _, ag := range additionalGroups {
 			if g.Name == ag || strconv.Itoa(g.Gid) == ag {
 				return true
@@ -405,3 +400,14 @@ func GetAdditionalGroupsPath(additionalGroups []string, groupPath string) ([]int
 	}
 	return gids, nil
 }
+
+// Wrapper around GetAdditionalGroups that opens the groupPath given and gives
+// it as an argument to GetAdditionalGroups.
+func GetAdditionalGroupsPath(additionalGroups []string, groupPath string) ([]int, error) {
+	group, err := os.Open(groupPath)
+	if err != nil {
+		return nil, fmt.Errorf("Failed to open group file: %v", err)
+	}
+	defer group.Close()
+	return GetAdditionalGroups(additionalGroups, group)
+}

From 14f271fe4c0e5c17e7b0610ed352cca0b6f0e981 Mon Sep 17 00:00:00 2001
From: Aleksa Sarai <cyphar@cyphar.com>
Date: Sun, 28 Jun 2015 11:18:20 +1000
Subject: [PATCH 2/2] libcontainer: user: update tests for GetAdditionalGroups

Update the tests to use the test-friendly GetAdditionalGroups API,
rather than making random files for no good reason.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
---
 libcontainer/user/user_test.go | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/libcontainer/user/user_test.go b/libcontainer/user/user_test.go
index ffb0760e2..0e37ac3dd 100644
--- a/libcontainer/user/user_test.go
+++ b/libcontainer/user/user_test.go
@@ -1,9 +1,7 @@
 package user
 
 import (
-	"fmt"
 	"io"
-	"io/ioutil"
 	"reflect"
 	"sort"
 	"strconv"
@@ -355,7 +353,7 @@ this is just some garbage data
 	}
 }
 
-func TestGetAdditionalGroupsPath(t *testing.T) {
+func TestGetAdditionalGroups(t *testing.T) {
 	const groupContent = `
 root:x:0:root
 adm:x:43:
@@ -419,14 +417,9 @@ this is just some garbage data
 	}
 
 	for _, test := range tests {
-		tmpFile, err := ioutil.TempFile("", "get-additional-groups-path")
-		if err != nil {
-			t.Error(err)
-		}
-		fmt.Fprint(tmpFile, groupContent)
-		tmpFile.Close()
+		group := strings.NewReader(groupContent)
 
-		gids, err := GetAdditionalGroupsPath(test.groups, tmpFile.Name())
+		gids, err := GetAdditionalGroups(test.groups, group)
 		if test.hasError && err == nil {
 			t.Errorf("Parse(%#v) expects error but has none", test)
 			continue