From 5ac77ed6d9451cd6c985f3959142e6968dc64f9f Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 12 Mar 2025 14:39:57 -0700 Subject: [PATCH 1/2] libct/int: add/use needUserNS helper Signed-off-by: Kir Kolyshkin --- libcontainer/integration/exec_test.go | 19 ++++--------------- libcontainer/integration/execin_test.go | 9 ++------- libcontainer/integration/utils_test.go | 8 ++++++++ 3 files changed, 14 insertions(+), 22 deletions(-) diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go index f18dd50f2..2d58ccc4b 100644 --- a/libcontainer/integration/exec_test.go +++ b/libcontainer/integration/exec_test.go @@ -3,7 +3,6 @@ package integration import ( "bytes" "encoding/json" - "errors" "fmt" "os" "os/exec" @@ -30,9 +29,7 @@ func TestExecPS(t *testing.T) { } func TestUsernsExecPS(t *testing.T) { - if _, err := os.Stat("/proc/self/ns/user"); os.IsNotExist(err) { - t.Skip("Test requires userns.") - } + needUserNS(t) testExecPS(t, true) } @@ -122,10 +119,7 @@ func TestRlimit(t *testing.T) { } func TestUsernsRlimit(t *testing.T) { - if _, err := os.Stat("/proc/self/ns/user"); os.IsNotExist(err) { - t.Skip("Test requires userns.") - } - + needUserNS(t) testRlimit(t, true) } @@ -1515,9 +1509,7 @@ func TestInitJoinPID(t *testing.T) { } func TestInitJoinNetworkAndUser(t *testing.T) { - if _, err := os.Stat("/proc/self/ns/user"); os.IsNotExist(err) { - t.Skip("Test requires userns.") - } + needUserNS(t) if testing.Short() { return } @@ -1764,10 +1756,7 @@ next_fd: // Test that a container using user namespaces is able to bind mount a folder // that does not have permissions for group/others. func TestBindMountAndUser(t *testing.T) { - if _, err := os.Stat("/proc/self/ns/user"); errors.Is(err, os.ErrNotExist) { - t.Skip("userns is unsupported") - } - + needUserNS(t) if testing.Short() { return } diff --git a/libcontainer/integration/execin_test.go b/libcontainer/integration/execin_test.go index aa7c01548..e6be1f544 100644 --- a/libcontainer/integration/execin_test.go +++ b/libcontainer/integration/execin_test.go @@ -69,10 +69,7 @@ func TestExecIn(t *testing.T) { } func TestExecInUsernsRlimit(t *testing.T) { - if _, err := os.Stat("/proc/self/ns/user"); os.IsNotExist(err) { - t.Skip("Test requires userns.") - } - + needUserNS(t) testExecInRlimit(t, true) } @@ -502,9 +499,7 @@ func TestExecInOomScoreAdj(t *testing.T) { } func TestExecInUserns(t *testing.T) { - if _, err := os.Stat("/proc/self/ns/user"); os.IsNotExist(err) { - t.Skip("Test requires userns.") - } + needUserNS(t) if testing.Short() { return } diff --git a/libcontainer/integration/utils_test.go b/libcontainer/integration/utils_test.go index 9b4121bc5..d73fc6806 100644 --- a/libcontainer/integration/utils_test.go +++ b/libcontainer/integration/utils_test.go @@ -2,6 +2,7 @@ package integration import ( "bytes" + "errors" "fmt" "os" "os/exec" @@ -231,3 +232,10 @@ func runContainerOk(t testing.TB, config *configs.Config, args ...string) *stdBu func destroyContainer(container *libcontainer.Container) { _ = container.Destroy() } + +func needUserNS(t testing.TB) { + t.Helper() + if _, err := os.Stat("/proc/self/ns/user"); errors.Is(err, os.ErrNotExist) { + t.Skip("Test requires userns.") + } +} From 9aeb7905cfa14656b52acd6a504edd769b60be66 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 13 Mar 2025 08:11:38 -0700 Subject: [PATCH 2/2] tests/int/selinux: fix skip message It was a mistake to say that SELinux need to be in the enforcing mode for these tests to run. It only needs to be enabled. Signed-off-by: Kir Kolyshkin --- tests/integration/selinux.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/integration/selinux.bats b/tests/integration/selinux.bats index 84b2368b9..53a3ea728 100644 --- a/tests/integration/selinux.bats +++ b/tests/integration/selinux.bats @@ -5,7 +5,7 @@ load helpers function setup() { requires root # for chcon if ! selinuxenabled; then - skip "requires SELinux enabled and in enforcing mode" + skip "requires SELinux enabled" fi setup_busybox