diff options
author | Simon Chopin <simon.chopin@canonical.com> | 2024-02-16 17:38:49 +0100 |
---|---|---|
committer | Adhemerval Zanella <adhemerval.zanella@linaro.org> | 2024-02-23 08:50:00 -0300 |
commit | 59e0441d4a1198aa9d21643a6e4f370faec4ffbf (patch) | |
tree | 1c22c7266a3d6b69e9988775f14476c3bf30bdc5 /sysdeps | |
parent | fe00366b63c5cf1a84864647ec4e15721c04ebcf (diff) | |
download | glibc-59e0441d4a1198aa9d21643a6e4f370faec4ffbf.tar glibc-59e0441d4a1198aa9d21643a6e4f370faec4ffbf.tar.gz glibc-59e0441d4a1198aa9d21643a6e4f370faec4ffbf.tar.bz2 glibc-59e0441d4a1198aa9d21643a6e4f370faec4ffbf.zip |
tests: gracefully handle AppArmor userns containment
Recent AppArmor containment allows restricting unprivileged user
namespaces, which is enabled by default on recent Ubuntu systems.
When this happens, as is common with Linux Security Modules, the syscall
will fail with -EACCESS.
When that happens, the affected tests will now be considered unsupported
rather than simply failing.
Further information:
* https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction
* https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
* https://manpages.ubuntu.com/manpages/jammy/man5/apparmor.d.5.html (for
the return code)
V2:
* Fix duplicated line in check_unshare_hints
* Also handle similar failure in tst-pidfd_getpid
V3:
* Comment formatting
* Aded some more documentation on syscall return value
Signed-off-by: Simon Chopin <simon.chopin@canonical.com>
Diffstat (limited to 'sysdeps')
-rw-r--r-- | sysdeps/unix/sysv/linux/tst-pidfd_getpid.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c b/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c index 0354da5abb..ef62fbe941 100644 --- a/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c +++ b/sysdeps/unix/sysv/linux/tst-pidfd_getpid.c @@ -61,7 +61,8 @@ do_test (void) { /* Older kernels may not support all the options, or security policy may block this call. */ - if (errno == EINVAL || errno == EPERM || errno == ENOSPC) + if (errno == EINVAL || errno == EPERM + || errno == ENOSPC || errno == EACCES) exit (EXIT_UNSUPPORTED); FAIL_EXIT1 ("unshare user/fs/pid failed: %m"); } |