os: TestChown and friends fail in a user namespace

[prattmic]

What version of Go are you using (go version)?

$ go version
go version devel +b641f0dcf4 Wed Nov 11 20:26:44 2020 +0000 linux/amd64

Does this issue reproduce with the latest release?

Yes, this is not a new issue.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/usr/local/google/home/mpratt/.cache/go-build"
GOENV="/usr/local/google/home/mpratt/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/usr/local/google/home/mpratt/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/usr/local/google/home/mpratt/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/google/home/mpratt/src/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/google/home/mpratt/src/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="devel +b641f0dcf4 Wed Nov 11 20:26:44 2020 +0000"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/usr/local/google/home/mpratt/src/go/src/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build140714091=/tmp/go-build -gno-record-gcc-switches"

What did you do?

$ unshare -U ../bin/go test os

What did you expect to see?

All tests pass.

What did you see instead?

$ unshare -U ../bin/go test os   
--- FAIL: TestChown (0.00s)
    os_unix_test.go:58: gid: 65534
    os_unix_test.go:60: chown /tmp/_Go_TestChown188607266 -1 65534: chown /tmp/_Go_TestChown188607266: invalid argument
--- FAIL: TestFileChown (0.00s)
    os_unix_test.go:101: gid: 65534
    os_unix_test.go:103: fchown /tmp/_Go_TestFileChown888841753 -1 65534: chown /tmp/_Go_TestFileChown888841753: invalid argument
--- FAIL: TestLchown (0.00s)
    os_unix_test.go:153: gid: 65534
    os_unix_test.go:158: lchown /tmp/_Go_TestLchown8979621482 -1 65534: lchown /tmp/_Go_TestLchown8979621482: invalid argument
FAIL
FAIL    os      18.447s
FAIL

These tests call Getgroups and then tries to chown files to all of those groups.

However, if the test is running in a user namespace (e.g., restricted CI environment), some of the groups may be OVERFLOWGID (65534) which is not a valid gid to use in chown, thus making the test fail.

[navytux]

For the reference TestSCMCredentials also fails under unshare -Um --map-current-user:

=== RUN   TestSCMCredentials
    creds_test.go:81: WriteMsgUnix failed with invalid argument, want EPERM
--- FAIL: TestSCMCredentials (0.00s)

Worked it around with the following patch:

From: Kirill Smelkov <[email protected]>
Date: Mon, 6 Dec 2021 22:50:27 +0300
Subject: [PATCH] syscall: tests: Fix TestSCMCredentials for `unshare -Umc`

---
 src/syscall/creds_test.go | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/syscall/creds_test.go b/src/syscall/creds_test.go
index c1a8b516e8..ed6e80c0c3 100644
--- a/src/syscall/creds_test.go
+++ b/src/syscall/creds_test.go
@@ -78,8 +78,10 @@ func TestSCMCredentials(t *testing.T) {
                        if sys, ok := err.(*os.SyscallError); ok {
                                err = sys.Err
                        }
-                       if err != syscall.EPERM {
-                               t.Fatalf("WriteMsgUnix failed with %v, want EPERM", err)
+                       // can get EINVAL instead of EPERM under `unshare -Umc` because uid0 is not mapped and maps to -1
+                       // see also https://github.com/golang/go/issues/42525
+                       if !(err == syscall.EPERM || err == syscall.EINVAL) {
+                               t.Fatalf("WriteMsgUnix failed with %v, want EPERM/EINVAL", err)
                        }
                }

-- 
2.30.2

[levinzimmermannn]

For the reference TestSCMCredentials also fails under unshare -Um --map-current-user

Also for the reference: this has been applied/fixed upstream with f839aaa (included in go >= 1.19).

[gopherbot]

Change https://go.dev/cl/520055 mentions this issue: os: skip Chown tests for auxiliary groups that fail due to permission errors

[bcmills]

I believe this is fixed by https://go.dev/cl/520055.